The 14 requirement families
- Access Control
- Awareness & Training
- Audit & Accountability
- Security Assessment
- Configuration Management
- Identification & Authentication
- Incident Response
- Maintenance
- Media Protection
- Physical Protection
- Personnel Security
- Risk Assessment
- System & Communications Protection
- System & Information Integrity
Revision 2, Revision 3, and the DoD contract
Revision 3 was published in May 2024 and has 97 requirements. DoD Class Deviation 2024-O0013 retains Revision 2 for the affected DoD contract requirements; see DoD class deviations and the revision guide. Read the clause and applicable deviation in your contract rather than switching revisions merely because a newer NIST publication exists.
Requirements and assessment objectives
A requirement is the security outcome to implement. NIST SP 800-171A provides assessment procedures; the DoD Level 2 Assessment Guide organizes Level 2 around 320 assessment objectives. Assessors examine records, interview personnel, and test implementation. The requirement directory is a requirement-by-requirement reference; the Level 2 assessment explainer covers how the program assesses them.
How DFARS and CMMC use NIST SP 800-171
DFARS 252.204-7012 establishes safeguards for covered defense information. 7019 addresses assessment notice and 7020 addresses DoD assessment access and requirements. Under the current deviation, contracting officers use 252.240-7997; those older clauses are not described as deleted. See DFARS compliance and current status. CMMC Level 2 maps one-for-one to the 110 Revision 2 requirements (170.14); compare NIST SP 800-171 and CMMC.
How to work toward implementation
- Identify CUI and the system boundary.
- Document how each requirement is implemented in the SSP.
- Use the checklist to review objectives and supporting evidence.
- Calculate a self-reported SPRS estimate and record gaps.
- Track remediation, distinguishing an operational plan from a Conditional CMMC POA&M.
For example, a logging policy may state that alerts exist, but an objective review also needs configuration and test records. Documentation alone is not proof that the implementation works (DoD Level 2 Assessment Guide).