Where the transition stands
The move from NIST SP 800-171 Rev 2 to Rev 3 is no longer just a NIST publication sitting on the shelf. It is now on the formal rulemaking track. A Department of War rulemaking, carried in the federal Unified Agenda under regulatory identifier RIN 0790-AM01, would amend 32 CFR Part 170, the rule that governs the CMMC program, to establish a deadline and a transition period for moving from Rev 2 to Rev 3.
The Unified Agenda lists that action at the Final Rule Stage, and it is expected to be issued as an interim final rule. That combination matters. Final Rule Stage means the drafting and internal review are far enough along that a proposed-rule comment round is not the next step, and an interim final rule can take effect on publication while comments are still collected. In plain terms: when this publishes, it can carry real dates with it rather than opening another year of notice-and-comment.
What the rule would actually do
This rulemaking does not rewrite the security requirements. NIST already did that when it published Rev 3. What the DoW rule does is decide when and how the CMMC program switches the standard its assessments are measured against, and how long contractors get to make the move.
Two pieces are expected in the rule:
| A deadline | A date after which Rev 3, not Rev 2, is the standard that CMMC Level 2 assessments and SPRS scoring are measured against. |
| A transition period | A defined window before that deadline during which contractors, and the assessment ecosystem, are expected to migrate documentation, evidence, and scoring from Rev 2 to Rev 3. |
The length of that transition window is the number every contractor wants and the one nobody has yet. It is not set until the rule publishes. For the control-level detail of what changes between the two revisions, see the Rev 2 vs. Rev 3 delta, requirement by requirement.
Timing: a target date came and went
A publication date in July was projected for this rule. That date has passed with no rule published. So the honest read on timing is: the action is at the Final Rule Stage, it is expected as an interim final rule, and the actual date remains unknown.
Part of the delay sits inside a larger picture. The CMMC program is under a broader reform review, the same review that led the Department of War to pause the Phase 2 third-party certification mechanism in July 2026. That context is worth understanding on its own terms, because it shapes how fast anything CMMC-related moves right now; see what the Phase 2 suspension changed, and what it did not. A rule that sets a hard transition deadline is exactly the kind of action that a reform review can hold until the surrounding program direction is settled.
The new signal: industry says prepare now
On August 27, 2026, at an NDIA webinar, industry participants explicitly urged the defense industrial base to prepare for Rev 3 while the CMMC reform review continues. That guidance was reported by Inside Defense.
It is important to read that signal for exactly what it is, and is not. It is industry guidance: experienced practitioners telling contractors not to be caught flat-footed when the rule lands. It is not a government effective date, and it does not change the standard your next assessment is measured against. Nobody at that webinar can move the deadline; only the published rule does that.
The useful takeaway is the posture, not a date. When people who assess and advise across the DIB start saying "get ready now," they are reacting to the same Final Rule Stage status described above. The preparation they are pointing to is low-regret work you can do without knowing the deadline, and it is the work covered in the last section.
Why Rev 3 is a real transition, not a renumbering
Rev 3 is a structural change to the standard, not a cosmetic refresh. Three things about it drive the preparation work:
It restructures the framework
Rev 3 reorganizes and consolidates requirements and drops the Rev 2 split between basic and derived requirements. A requirement you documented under one Rev 2 identifier may live under a different number, or be folded into a broader control, in Rev 3. Documentation built entirely around Rev 2 numbering needs a cross-reference to survive an assessment cleanly.
It adds specificity
Rev 3 pushes more detail into what each requirement expects, which tends to raise the bar on the evidence an assessor looks for. Implementation statements that were adequate under Rev 2's more general language may need to be sharpened to show the specific behavior Rev 3 describes.
It introduces organization-defined parameters
This is the change contractors feel most directly. Rev 3 introduces organization-defined parameters (ODPs): specific configurable values inside a requirement that you must define and record, rather than satisfying with a general statement. The maximum failed login attempts before lockout, the minimum password length, the session-timeout threshold. Each ODP is a value you have to choose, document, and be able to defend. For contractors on DoD contracts, DoD sets minimum values these must meet, which turns each ODP into both a configuration task and a documentation task.
For how 1TEN is building Rev 3 support, including ODP handling and a Rev 2 to Rev 3 gap view, see the 1TEN Rev 3 rollout plan.
What to do now
The right posture is to keep your Rev 2 program current while quietly setting yourself up to move fast when the rule sets a date. Both halves matter. Chasing Rev 3 early can cost you against a Rev 2 assessment you actually have to pass; ignoring Rev 3 entirely leaves you exposed when the window turns out to be short.
| Stay on Rev 2 for real work | Rev 2 is the standard your next assessment and your SPRS score are measured against. Do not pause a certification effort to wait for Rev 3. Keep your SPRS score honest and your Rev 2 documentation assessment-ready. |
| Preserve your Rev 2 record | Keep a clean, dated record of your Rev 2 implementation and evidence. That record is the raw material you map forward, and it is proof of your compliance history for the period Rev 2 was in force. |
| Inventory controls and evidence | Know what you have implemented and what evidence backs each control. You cannot map to Rev 3 what you have not first catalogued in Rev 2. |
| Start the forward mapping | Begin working out how each Rev 2 control and its evidence maps into the Rev 3 structure, and where the genuine new gaps are: the ODPs to define and the requirements with no clean Rev 2 predecessor. |
| Watch for the published rule | The deadline and transition window become real only when RIN 0790-AM01 publishes. Track that, not webinar commentary, for the dates you plan against. |
Handled this way, the transition becomes a mapping and documentation exercise on top of a compliance program you already run, not a restart. The contractors who struggle will be the ones who treated Rev 2 as throwaway work; the ones who kept a disciplined Rev 2 record will have most of what Rev 3 asks for already in hand.