Cybersecurity Updates: NIST Publishes SP 800-171 Revision 3. What Changed, And What Comes Next?

In May 2024, the National Institute of Standards and Technology (NIST) published Special Publication 800-171 Rev 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and the accompanying assessment guide, 800-171A Rev 3, Assessing Security Requirements for Controlled Unclassified Information. Although the U.S. Department of Defense (DOD) has clarified that Revision 2 will continue to be the compliance standard for contractors that are subject to DFARS 252.204-7012, Safeguarding Covered Defense Information, until DOD announces otherwise, contractors should continue to think about how to comply with Revision 3's requirements in the event they become new standards for compliance. NIST applied both substantive and stylistic changes in Revision 3, which are covered below.