Official references
Read the right revision.
Requirements, assessment procedures, and enhanced safeguards—grouped by the baseline they support.
Publication status and applicability are different
NIST has superseded the earlier publications below. The official CMMC program overview reviewed October 24, 2026 still names SP 800-171 Revision 2 for Level 2. A newer NIST final publication does not automatically change your contract or CMMC assessment baseline. Record the applicable requirements and assessment editions, and confirm the current program position (opens in a new tab).
On this page: Revision 2 and related publications · Revision 3 publications · Cybersecurity Framework
Revision 2 and related publications
The earlier set: requirements first, their assessment procedures next, then supplemental enhanced requirements. These editions are withdrawn by NIST but remain relevant where the applicable program or agreement still names them.
NIST SP 800-171 Revision 2 (opens in a new tab)
Published February 2020; updated January 2021. Withdrawn May 14, 2024; superseded by Revision 3. The requirements baseline named in the CMMC Level 2 guidance reviewed here.
NIST SP 800-171A · June 2018 (opens in a new tab)
Published June 2018. Withdrawn May 14, 2024; superseded by SP 800-171A Revision 3. Assessment procedures used with the Revision 2 requirements. This edition has no revision number in its official title.
NIST SP 800-172 · February 2021 (opens in a new tab)
Published February 2021. Withdrawn May 13, 2026; superseded by SP 800-172 Revision 3. Supplements SP 800-171 Revision 2 with enhanced safeguards for CUI associated with critical programs or high value assets. It is not a blanket addition to every Level 2 implementation.
Assessment counterpart: SP 800-172A · March 2022 (opens in a new tab). Withdrawn May 13, 2026; superseded by SP 800-172A Revision 3.
Revision 3 publications
The current NIST final set: use each requirements publication with its corresponding assessment procedures when adopted by the applicable agency, program, or agreement.
NIST SP 800-171 Revision 3 (opens in a new tab)
Final, May 2024; supersedes Revision 2. NIST’s current requirements for protecting CUI in nonfederal systems. Use to understand the revised baseline and plan for adoption where applicable.
NIST SP 800-171A Revision 3 (opens in a new tab)
Final, May 2024; supersedes the June 2018 edition. Procedures for assessing SP 800-171 Revision 3. Keep these paired with that revision rather than substituting them into a Revision 2 checklist.
NIST SP 800-172 Revision 3 (opens in a new tab)
Final, May 2026; supersedes the February 2021 edition. Enhanced safeguards aligned with SP 800-171 Revision 3, supporting protection against advanced persistent threats and cyber resiliency. Agencies select applicable enhanced requirements according to their mission needs and risks.
Assessment counterpart: SP 800-172A Revision 3 (opens in a new tab). Final, May 2026; supersedes the March 2022 edition.
Why 800-172 jumps to Revision 3
The original 2021 publication is titled SP 800-172, not “Revision 1.” NIST made a one-time numbering change for SP 800-172 and SP 800-172A to align with the SP 800-171 Revision 3 family. The May 2026 editions are final publications; their earlier public drafts are obsolete. Read NIST’s release announcement (opens in a new tab).
The broader risk framework
NIST Cybersecurity Framework (CSF) 2.0 (opens in a new tab)
Final, February 26, 2024 · NIST CSWP 29. A framework of cybersecurity outcomes for understanding, prioritizing, and communicating risk across the organization. Use it to connect governance and program decisions to business needs. It allows different approaches to achieving outcomes; it does not prescribe one rigid implementation sequence.
CSF 2.0 provides broader risk context alongside the SP 800-171/172 requirements and assessment publications above. Using CSF alone does not demonstrate that CMMC requirements are met.
Visit NIST’s CSF resource center (opens in a new tab) for profiles, quick-start guides, and supporting material.
Publication status and links reviewed October 24, 2026. Follow each NIST publication page for its document history, authoritative PDF, and any later changes.