NIST Special Publication 800-171 defines the security requirements for protecting Controlled Unclassified Information in non-federal systems. It's the foundation for CMMC Level 2 and—as of January 2026—the basis for GSA's civilian CUI protection requirements. Revision 3 brings significant changes that affect how MSPs implement, document, and verify compliance for their clients.
Key Changes from Rev 2 to Rev 3
Consolidated Requirements: 110 to 97
Rev 3 consolidates the 110 requirements from Rev 2 into 97 requirements. This isn't a reduction in scope—several requirements were merged, reorganized, or incorporated into broader controls. The actual security expectations remain comparable, but the structure is more efficient.
Three New Control Families
Rev 3 adds three new control families to the existing 14, expanding coverage to areas that Rev 2 addressed less explicitly. The 17 families now cover: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, planning, risk assessment, security assessment, supply chain risk management, system and communications protection, system and information integrity, and program management.
Organization-Defined Parameters (ODPs)
This is the most operationally significant change. ODPs require organizations to explicitly define and document implementation-specific values for each control. Instead of a generic "limit system access to authorized users," the organization must specify how access is limited, what constitutes authorization, and how it's verified.
ODPs move compliance from "check the box" to "show your work." For MSPs, this means documentation must be more specific and tailored to each client's environment.
More Prescriptive Verification
Rev 3 includes more detailed assessment procedures through the companion NIST SP 800-171A Rev 3. Each requirement has explicit assessment objectives and methods, making it clearer what assessors will evaluate and what evidence they'll expect.
GSA Adoption: Beyond DoD
On January 5, 2026, the General Services Administration adopted NIST 800-171 Rev 3 for civilian CUI protection. This means contractors and entities handling CUI for civilian agencies—not just DoD—must now implement Rev 3 requirements.
GSA's framework requires independent assessment by a Third-Party Assessment Organization or independent security assessor, with reassessment every three years or upon major change. Nine "showstopper" requirements must be met before CUI authorization is granted.
This expansion means more MSP clients fall under NIST 800-171 requirements—any organization doing business with federal civilian agencies that involves CUI.
What MSPs Should Do
Update Documentation to Rev 3
If clients have existing SSPs and compliance documentation based on Rev 2, these need to be updated to reflect the Rev 3 control structure, new control families, and ODP requirements. This isn't a minor edit—the reorganization requires mapping existing implementations to the new structure.
Address ODP Requirements
Review every control and define the organization-specific parameters. This requires understanding each client's environment well enough to specify how each control is implemented—generic documentation won't pass a Rev 3 assessment.
Assess New Control Families
Evaluate client environments against the new control families, particularly supply chain risk management and planning. These areas may have gaps that didn't exist under Rev 2 because they weren't explicitly required.
Prepare for Independent Assessment
Under GSA's framework, independent assessment is required—not optional. MSPs should help clients prepare for third-party assessment with the same rigor applied to CMMC C3PAO preparation.
NIST 800-171 and Multi-Framework Alignment
NIST 800-171 is the common thread connecting CMMC and GSA CUI requirements. Organizations that implement Rev 3 thoroughly are simultaneously building the foundation for CMMC Level 2 compliance. The multi-framework approach—implementing to the most stringent standard and mapping across requirements—is especially effective here because CMMC and GSA CUI compliance share the same underlying control set.
Explore the Full Series
This spoke connects to the pillar and other posts on multi-framework compliance:
Take the Next Step
Beachhead Solutions helps MSPs implement and document NIST 800-171 Rev 3 requirements across their client base. Schedule An Eval to see how ComplianceEZ™ supports CUI protection documentation and compliance scoring. Visit our Downloads & Resources library for compliance tools and guides.
Learn more about ComplianceEZ™.
