The full map
| Family | What it covers | Rev. 3 notes |
|---|---|---|
| 3.1 ACCESS CONTROL | Who can reach what: least privilege, session control, remote access, CUI flow enforcement | Carried forward; several requirements consolidated, review cadences become ODPs |
| 3.2 AWARENESS & TRAINING | Role-based security training and insider-threat awareness | Carried forward; training frequency values are ODPs |
| 3.3 AUDIT & ACCOUNTABILITY | Logging, retention, review, correlation, and protection of audit records | Carried forward; event types and review frequencies are ODPs |
| 3.4 CONFIGURATION MANAGEMENT | Baselines, change control, least functionality, software restrictions | Carried forward; consolidated |
| 3.5 IDENTIFICATION & AUTHENTICATION | User and device identification, MFA, authenticator management, replay resistance | Carried forward; password and authenticator rules re-expressed with ODPs |
| 3.6 INCIDENT RESPONSE | IR capability, detection, reporting, testing | Carried forward; adds emphasis on IR testing and reporting timelines as parameters |
| 3.7 MAINTENANCE | Controlled maintenance, tools, and maintenance personnel | Carried forward; consolidated |
| 3.8 MEDIA PROTECTION | Marking, storage, transport, sanitization of media carrying CUI | Carried forward |
| 3.9 PERSONNEL SECURITY | Screening and termination/transfer procedures | Carried forward |
| 3.10 PHYSICAL PROTECTION | Facility access, visitor control, physical monitoring | Carried forward |
| 3.11 RISK ASSESSMENT | Risk assessments, vulnerability scanning and remediation | Carried forward; adds supply-chain-aware risk framing, scan frequencies as ODPs |
| 3.12 SECURITY ASSESSMENT & MONITORING | Control assessment, continuous monitoring, information exchange agreements | Renamed (was "Security Assessment"); the SSP requirement moves to the Planning family |
| 3.13 SYSTEM & COMMS PROTECTION | Boundary protection, cryptography, session protection, CUI confidentiality in transit/at rest | Carried forward; cryptography requirements re-expressed with ODPs |
| 3.14 SYSTEM & INFO INTEGRITY | Flaw remediation, malicious code protection, monitoring | Carried forward; consolidated |
| 3.15 PLANNING (NEW) | Policies and procedures, the System Security Plan, rules of behavior | New family; the SSP now lives here as a first-class planning artifact |
| 3.16 SYSTEM & SERVICES ACQUISITION (NEW) | Security engineering principles, unsupported components, external system services | New family; buying decisions get a security gate |
| 3.17 SUPPLY CHAIN RISK MANAGEMENT (NEW) | SCRM plan, acquisition strategies, supply chain controls and processes | New family; your vendors become part of your assessable posture |
Why the three new families bite
The 14 carried-forward families are largely configuration families: a well-engineered Microsoft environment satisfies most of their objectives technically. The three new families are process families. Planning requires ongoing planning work and an SSP that stays current. System & Services Acquisition means purchases get a security evaluation before money moves. Supply Chain Risk Management means the vendors inside your boundary are identified, evaluated, and monitored, with records an assessor can examine.
Contractors whose Rev. 2 programs were tooling-heavy and process-light will feel the transition in these three families more than in the crosswalk. The response is to assess readiness honestly and build the three processes deliberately.
The governing rule: your contracts decide when Rev. 3 binds you. The families above matter today for planning and for civilian processes that are moving early (see GSA), while most DoD work is still assessed against Rev. 2. The Rev. 2 vs. Rev. 3 executive guide has the full context.
Need the three process families built and running?
Tell us where your program stands and a practitioner will scope Planning, Acquisition, and SCRM as working processes with evidence attached. Or email rj@indirectit.com directly.