Acquisition Analyst, Office of the DoD CIO

0790-AM01 202510 The Regulatory Plan and the Unified Agenda of Federal Regulatory and Deregulatory Actions 0790 Office of the Secretary OS 0700 Department of War DOW Cybersecurity Maturity Model Certification (CMMC) Program

This amendment defines a deadline and period for transition from the requirement to comply with NIST SP 800-171 Revision 2, to a requirement to comply with NIST SP 800-171 Revision 3. Significant changes between these two documents include added specificity in the security requirements and introduction of organization-defined parameters (ODP) in select security requirements. In addition to revising the NIST documents that are incorporated by reference in 32 CFR part 170, this amendment adds administrative edits and clarifying content in multiple areas as necessary to effect the transition.

]]> Other Significant First Time Published in The Unified Agenda Final Rule Stage Undetermined No Fully or Partially Exempt 32 CFR 170 5 U.S.C. 301 Pub. L 116-92, sec. 1648 133 Stat. 1198 Yes

With this amendment, DoD amends the Cybersecurity Maturity Model Certification (CMMC) Program to define a period for transition from the requirement to comply with NIST SP 800-171 Revision 2, to a requirement to comply with NIST SP 800-171 Revision 3. As described by NIST, the significant changes between these two documents include added specificity in the security requirements and introduction of organization-defined parameters (ODPs) in select security requirements. In addition to revising documents incorporated by reference in this rule, this amendment adds administrative edits and clarifying content in multiple areas.

]]>

5 U.S.C. 301; Sec. 1648, Pub. L. 116-92, 133 Stat. 1198.

]]>

None

]]>

In addition to the change from NIST SP 800-171 revision 2 to revision 3, which impacted CMMC Level 2 and LEvel 3 assessment objectives, this rule amendment is based on a more current estimate of the size of the Defense Industrial Base. Overall, we estimate approximately 20% fewer total companies will be impacted by 32 CFR Part 170.

]]>

None

]]> Interim Final Rule 07/00/2026 No Businesses Governmental Jurisdictions Organizations Undetermined No No No No Carrie Cardwell Acquisition Analyst, Office of the DoD CIO 0790 Office of the Secretary OS 571 372-4410 carrie.m.cardwell.civ@mail.mil 4800 Mark Center Drive , Suite 11G14, Alexandria VA 22350