Rev. 2 vs. Rev. 3: what changed, and when it becomes your problem.

The five structural changes

Dimension	Rev. 2	Rev. 3
SOURCE ALIGNMENT	Derived from SP 800-53 Rev. 4 era	Aligned with SP 800-53 Rev. 5 moderate baseline, with a published crosswalk
FAMILIES	14 requirement families	17, adding Planning, System & Services Acquisition, and Supply Chain Risk Management
REQUIREMENTS	110 requirements	Consolidated and restructured set: fewer, denser requirements, with several Rev. 2 items merged or withdrawn and new ones added
PARAMETERS	Fixed requirement text	Organization-Defined Parameters (ODPs): values set by the imposing agency or the organization, and defensible either way
ASSESSMENT	SP 800-171A + DoD Assessment Methodology (SPRS scoring)	SP 800-171A Rev. 3 with restructured assessment objectives

What the changes mean operationally

• The three new families are process families. Planning, System & Services Acquisition, and Supply Chain Risk Management demand working processes (vendor evaluation, acquisition security, planning discipline) that configuration alone can't satisfy. Contractors whose programs are pure tooling feel these the most.
• ODPs turn requirements into decisions. Where Rev. 2 told you what to do, Rev. 3 often asks the imposing agency, or you, to set the value: review frequencies, timing windows, scope choices. Every ODP needs a recorded value and a rationale, because assessors will ask for both.
• Consolidation doesn't reduce the work. A merged requirement still contains its parents' substance, and the Rev. 3 assessment objectives test that substance. Reading "fewer requirements" as "less work" is the first mistake of casual transitions.
• Most evidence can be re-indexed. Objective-level evidence built under 800-171A largely carries over once it has been deliberately remapped to the Rev. 3 objective structure.

Which one binds you? Read the contract.

On the DoD side, DFARS-based work generally still points at Rev. 2, and CMMC currently assesses against Rev. 2, pending DoD's own rulemaking to adopt Rev. 3. On the civilian side, some agency processes are already moving: GSA's CUI guidance for contractor systems is an early example of Rev. 3 with ODPs in use (see GSA authorization). In both, the revision incorporated into each contract or agreement is the one that binds that work. Contractors serving both markets should plan to run two baselines side by side instead of waiting for a clean switchover date.