NIST withdrew the original SP 800-171A (June 2018) on 14 May 2024 and superseded it with Rev. 3, which assesses SP 800-171 Rev. 3. That creates a real question for contractors, because the CMMC rule's Level 2 requirements are identical to Rev. 2. Ask your assessor or contracting officer which version your contract uses.
What the NIST pages say
The page for the 2018 document lists it as withdrawn on 14 May 2024 and superseded by 800-171A Rev. 3. It describes assessment procedures and a methodology for evaluating the security requirements of SP 800-171, usable for self-assessments, independent third-party assessments or government-sponsored assessments, with rigor set by depth and coverage attributes.
The Rev. 3 page, published May 2024, gives the same description and lists SP 800-171 Rev. 3 as its companion publication part. It links to the related SP 800-172A Rev. 3 and SP 800-172 Rev. 3.
What the CMMC rule says
The CMMC model section, 32 CFR 170.14, says Level 2 requirements are identical to the requirements in NIST SP 800-171 R2 and that assessment of the requirements is prescribed by NIST SP 800-171A and 800-172A. The section as fetched does not say which revision of 171A applies, so I could not confirm that. The program's own guidance and your assessor should settle it.
Why the mismatch matters
Rev. 3 requirements and Rev. 2 requirements are not the same list. Assessment procedures are written against one list. Using procedures for a different revision can leave objectives that do not line up with the requirement you are meeting.
What to do
- Read your contract and the clauses it cites. Note the revision of 800-171 named.
- Ask your C3PAO, sponsor or contracting officer in writing which assessment guide applies.
- Use that guide for your self-assessment so your evidence matches the objectives assessors will use.
- Record the answer, who gave it and the date.
- If you plan for Rev. 3 already, keep a mapping so you can show both.
Organize evidence per objective
Whichever revision applies, assessment procedures break each requirement into objectives. Keep one evidence folder or record set per requirement, with a short note per objective saying what proves it. That structure works for any revision and any assessor.
Do not trust old explainers
Many guides still link to the 2018 document. Check the NIST page for status before you use any procedure set.
Quick check
Is the 2018 SP 800-171A still current?
No. NIST lists it as withdrawn on 14 May 2024 and superseded by Rev. 3.
Does Rev. 3 of 171A assess the same requirements as the CMMC Level 2 text?
Not necessarily. Rev. 3 is the companion to SP 800-171 Rev. 3, while the CMMC text cites Rev. 2 requirements. Confirm with your assessor.
Safeguard's compliance and evidence automation keeps records organized per requirement. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
