Part 1: Do you know what binds you?
- Contract inventory exists. You can list every active contract and agreement with a CUI or 800-171 obligation, and which revision each one incorporates.
- Flow-downs are captured. Prime flow-downs are in the inventory too, recorded as you received them.
- Customer signals are tracked. You know which customers and agencies have referenced Rev. 3, ODPs, or new assessment expectations in the last year.
Part 2: Will your current program survive a crosswalk?
- Your SSP is organized by requirement. Each requirement has its own addressable implementation statement, which is the unit a crosswalk converts.
- Evidence is objective-level. Artifacts are indexed to 800-171A assessment objectives, so they can be re-indexed to Rev. 3 objectives instead of recollected.
- Your POA&M is current. Open items have owners, dates, and status, because they carry into the Rev. 3 disposition analysis as they are.
Part 3: The Rev. 3 deltas
- Planning exists as a process. Security planning recurs on a regular schedule, separate from writing the SSP.
- Acquisition has a security gate. New systems and services get a security evaluation before purchase, which is the substance of the System & Services Acquisition family.
- Suppliers are risk-managed. You evaluate and monitor the vendors inside your boundary, which is the substance of Supply Chain Risk Management.
- You know what an ODP is. Someone in your organization can explain Organization-Defined Parameters and who sets their values for each customer.
- Review frequencies are recorded. Access reviews, log reviews, and revalidations have defined, documented cadences, which are the raw material of an ODP register.
- Dual-baseline is on your roadmap. If you serve both DoD (Rev. 2 today) and early-moving civilian processes, you have a plan for operating both views from one implementation.
Scoring it: If you checked 10 to 12, Rev. 3 is a managed delta for you. At 6 to 9, the crosswalk will work but the new families need real construction. At 5 or fewer, fix the Rev. 2 foundation first, because a transition can't crosswalk what was never mapped. Either way, the executive guide explains what you're walking into, and the transition service is the fixed-scope version of this list.
Get the working copy
Email me the checklist + the transition briefing.
We'll send the working checklist plus a short practical series on Rev. 3 sequencing that you can unsubscribe from anytime. You can also email rj@indirectit.com directly.