The CMMC rule at 32 CFR 170 states that Level 2 requirements are identical to NIST SP 800-171 Rev. 2, even though NIST published Rev. 3 in May 2024. Plan against Rev. 2 for CMMC, watch your contract for any other instruction, and track Rev. 3 for what is coming.
What the rule text says
The regulation says CMMC Level 2 requirements are identical to those in NIST SP 800-171 R2. Assessment follows SP 800-171A from June 2018. The rule text does not state a practice count in the part we read, though the scoring section implies a maximum of 110, which is the number of Level 2 requirements under Rev. 2.
Level 1 uses 15 requirements drawn from FAR 52.204-21. Level 3 uses 24 requirements selected from SP 800-172 as of February 2021.
What Rev. 3 is
NIST finalized SP 800-171 Rev. 3 on 14 May 2024, replacing Rev. 2 from January 2021. It protects the confidentiality of CUI in nonfederal systems and lists 17 families, including Planning and Supply Chain Risk Management. NIST also published SP 800-171A Rev. 3 for assessment procedures. NIST links a change analysis spreadsheet from the Rev. 3 page, and that is the place to see the line by line differences.
What to do with two versions
Treat Rev. 2 as your compliance target for CMMC today, because that is what the rule names. Check each contract for clauses that call out a different revision or a deviation. Our post on the Rev. 3 class deviation covers that thread.
Then use Rev. 3 as a design guide. Supply chain risk management and planning will matter, and building toward them costs little if you do it early. For software vendors, that means an SBOM habit and a written supplier review process.
Avoid these mistakes
Do not claim Rev. 3 compliance as a CMMC result. The assessment is against the version in the rule.
Do not wait for the rules to settle. Most Rev. 2 work carries over.
Do not forget the companions. SP 800-172 Rev. 3 was finalized in May 2026 and the page says the 2021 version was withdrawn. CMMC Level 3 text still cites the February 2021 version, so confirm which text your assessor will use.
Where Safeguard fits
SBOM and dependency scanning and compliance and evidence automation in Safeguard help produce records for supply chain and configuration requirements. They do not make a company CMMC compliant, and no certification is implied.
Quick check
Which revision does CMMC Level 2 use according to the rule text?
SP 800-171 Rev. 2, per 32 CFR 170.14.
How many families does Rev. 3 list?
Seventeen, according to the NIST publication page.
Sources
Last reviewed: 19 October 2026.
