CMMC vs NIST SP 800-171: The Difference, and Rev 3
By Shaheer Malik · Updated Oct 28, 2026
NIST SP 800-171 is the set of security requirements for protecting CUI; CMMC is the DoD program that verifies a contractor meets them. CMMC Level 2 is identical to the 110 requirements of NIST SP 800-171 Revision 2, so the two map one to one. DoD still requires Revision 2, even though NIST published Revision 3 in May 2024.[1][3][5]
Side by side
| NIST SP 800-171 | CMMC | |
|---|---|---|
| What it is | A NIST publication of security requirements | A DoD assessment and certification program (32 CFR part 170) |
| Who sets it | NIST | DoD |
| How it reaches you | DFARS 252.204-7012, when you handle covered defense information | DFARS 252.204-7021, when a contract names a CMMC level |
| How it is checked | Your own implementation and assessment; government Medium or High assessments | Self-assessment, C3PAO or DIBCAC, posted in SPRS with affirmations |
Sources: the rule says the Level 2 requirements “are identical to the requirements in NIST SP 800-171 R2.”[1][2] DFARS 252.204-7012 requires adequate security on covered contractor information systems, including NIST SP 800-171.[4]
How to map NIST SP 800-171 to CMMC
One to one: each CMMC Level 2 ID adds a domain code to the NIST number. NIST 3.1.1 becomes AC.L2-3.1.1, NIST 3.13.11 becomes SC.L2-3.13.11.[1] Level 1’s 15 requirements map to 17 NIST SP 800-171A objectives, because three FAR requirements were split into phrases.[1]
Does CMMC use NIST SP 800-171 Revision 3?
No. The rule incorporates Revision 2 by reference.[1] NIST lists Revision 3 (May 2024) as superseding Revision 2,[3] but DoD’s September 3, 2026 class deviation still “requires baseline compliance with NIST SP 800-171 Rev 2.”[5] Federal News Network reports that DoD’s CMMC reform task force recommended implementing Revision 3; DoD has not adopted it.[6]
What to do
Build to Revision 2 for contracts today. If you are designing new controls, note where Revision 3 asks for more so a later switch is cheaper. Track changes on the CMMC timeline.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
Is NIST SP 800-171 the same as CMMC?
No. NIST SP 800-171 is the requirement set; CMMC is the DoD program that verifies it. CMMC Level 2 uses exactly the 110 requirements of NIST SP 800-171 Rev. 2.
Does CMMC 2.0 use NIST SP 800-171 Rev 3?
No. The CMMC rule incorporates Revision 2, and the September 2026 class deviation restates the Rev. 2 baseline. NIST published Revision 3 in May 2024.
If I comply with NIST SP 800-171, am I CMMC compliant?
You meet the Level 2 requirements, but you also need the CMMC status your contract asks for (self-assessment or C3PAO) posted in SPRS, plus annual affirmations.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- NIST SP 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems (checked Oct 22, 2026)
- NIST SP 800-171 Revision 3 (May 2024) (checked Oct 28, 2026)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- Federal News Network: RFI offers path forward for DoD with CMMC (Jason Miller, Oct 27, 2026) (checked Oct 28, 2026)
More on the rules behind cmmc
- Which DFARS Clause Establishes CMMC? 7021, 7025 and 7012
- SPRS Score and CMMC: What It Is and How It’s Calculated
- FCI vs CUI in CMMC: What Each Is and Why It Matters
- CMMC and ITAR: Does One Satisfy the Other?
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.