What Rev. 3 changes in your program
Rev. 3 realigns 800-171 with SP 800-53 Rev. 5, expands from 14 to 17 requirement families, consolidates the requirement set, and introduces Organization-Defined Parameters, values that your imposing agency or you must decide and defend. Each of those changes reaches your SSP, your evidence structure, and your assessment story. Handled casually, a Rev. 3 "update" breaks the Rev. 2 posture your current contracts still depend on. We treat it as a production run, which keeps the change to a controlled delta.
The transition service
- Contractual baseline inventory. We record which contracts incorporate Rev. 2, which reference Rev. 3, which are silent, and what your primes are signaling. Everything else depends on this step.
- Rev. 2-to-Rev. 3 crosswalk. Your implemented requirements are mapped to the Rev. 3 structure and marked as carried, consolidated, changed, or new.
- Requirement disposition analysis. Every delta gets a recorded decision: already satisfied, satisfied with modification, gap to implement, or not applicable with rationale.
- New-family implementation. We stand up Planning, System & Services Acquisition, and Supply Chain Risk Management as working processes.
- ODP decision register. Every Organization-Defined Parameter is listed, given a value (agency-directed where applicable), justified, and traceable.
- SSP conversion restructures the Rev. 2 SSP to Rev. 3 and keeps the Rev. 2 view your active contracts still require.
- Evidence remapping. Artifacts are re-indexed to SP 800-171A Rev. 3 assessment objectives, and everything that legitimately carries over is reused.
- Rev. 3 assessment rehearsal. We run a mock assessment against the Rev. 3 methodology before any customer or authorizing official tests it.
- Dual-baseline operation. Where customers require both revisions, one control implementation is reported against two baselines under managed compliance.
A good first step is the free Rev. 3 Transition-Readiness Checklist. In ten minutes it tells you whether you're looking at a delta or a rebuild, and which of your artifacts will survive the crosswalk.
Questions contractors ask us
Do we have to move to Rev. 3 now?
Only if a contract, agreement, or agency process requires it. NIST finalized Rev. 3 in May 2024 and it supersedes Rev. 2 as a publication, but contractors follow the version incorporated into their contracts. Much DoD work still points at Rev. 2 (and CMMC currently assesses against it), while some civilian-agency processes reference Rev. 3. Start with a contractual baseline inventory before you migrate anything.
What actually changed in Rev. 3?
Rev. 3 aligns more closely with SP 800-53 Rev. 5, grows from 14 to 17 requirement families (adding Planning, System & Services Acquisition, and Supply Chain Risk Management), consolidates the requirement set, and adds Organization-Defined Parameters (ODPs) whose values are set by the imposing agency or the organization. SP 800-171A Rev. 3 is the matching assessment methodology. The full breakdown is in the executive guide.
Can we operate Rev. 2 and Rev. 3 at the same time?
Yes, and many contractors will have to, because different customers will incorporate different baselines for years. A dual-baseline operation keeps one control implementation with a crosswalked SSP and evidence mapped to both requirement sets. Each customer sees its own compliant picture, and you still run a single program.
Will our Rev. 2 SSP and evidence carry over?
Mostly, yes, if they were built at the objective level. The transition is a structured conversion: requirements are crosswalked, dispositions recorded, ODP values decided and documented, new-family gaps implemented, and evidence remapped to 800-171A Rev. 3 objectives. It's real work, but it builds on the program you already have.
Scope your Rev. 3 transition as a delta on today's program.
Tell us your contract mix and current posture, and a practitioner will come back with a baseline inventory approach and a fixed transition scope. Or email rj@indirectit.com directly.