DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3

Inside Cybersecurity reports that the Defense Department plans to use an interim final rule to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3, a faster path than the proposed-rule process stakeholders expected. The 2026 unified agenda, published July 3, says the amendment will define both a deadline and a transition period. It also says DoD will update the NIST documents incorporated by reference in 32 CFR Part 170 and add administrative edits and clarifying content needed for the change.

Transition undersells the work. CMMC Level 2 currently rests on Rev. 2’s 110 controls for protecting controlled unclassified information on nonfederal systems. NIST published Rev. 3 in May 2024 while DoD was still finalizing the CMMC program rule, leaving the October 2024 Title 32 rule tied to Rev. 2. The agenda says Rev. 3 adds specificity in security requirements and introduces organization-defined parameters in select requirements. For primes and subcontractors, that means control mapping, evidence updates and assessment timing become contract-risk questions, not document-cleanup tasks.

Interim final rule authority gives DoD speed and creates residue. It can put the new requirement into effect with a shorter window and take comments after the fact, reducing stakeholder delay in a program already split across a Title 32 program rule and a Defense Federal Acquisition Regulation Supplement phase-in. It also leaves certified third-party assessment organizations and contractors implementing against text that can still change in the final rule. The immediate questions are the useful ones: how long the transition runs, when it starts, and what happens to contractors still operating under Rev. 2 when the deadline expires.