How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena adds the assessor-facing submission layer that almost none of them ship: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and cryptographic provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

NIST 800-171 Rev 3

NIST SP 800-171 Rev. 3: What Changed, What CMMC Will Adopt, When

NIST published SP 800-171 Rev. 3 in May 2024. CMMC currently certifies to Rev. 2 — but Rev. 3 will eventually replace it in DoD acquisitions. This page covers the structural changes (organization-defined parameters, withdrawn controls, three new families), what your Rev. 2 SSP will need to rewrite, and the realistic timeline for DoD adoption based on the 32 CFR Part 170 rulemaking cadence.

Free CMMC Quick Score See pricing

Why Rev. 3 exists

NIST aligned 800-171 with the broader 800-53 Rev. 5 baseline and pulled out the ambiguity that made Rev. 2 implementations inconsistent. Rev. 3 introduces Organization-Defined Parameters (ODPs) — explicit places where the contractor must declare a value (password length, audit retention, etc.) rather than leave it implicit. That's the biggest structural change.

What's actually different

97 controls in Rev. 3 vs 110 in Rev. 2. Net reduction, but density goes up.
Three new control families: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR).
~60 ODPs the contractor must explicitly define and document.
Withdrawn controls: a number of Rev. 2 controls were removed as redundant or moved into other families.
New 800-171A Rev. 3 assessment objectives — fewer objectives overall (~270 vs 320 in Rev. 2), but with tighter language.

What CMMC will probably do

32 CFR Part 170 — the CMMC Program rule, effective December 2024 — references NIST 800-171 Rev. 2 explicitly. Moving CMMC to Rev. 3 requires a rule change, which means a Federal Register notice, comment period, and final rule. Based on past rulemaking cadence, that's a multi-year process.

Industry expectation: DoD will continue accepting Rev. 2 CMMC certifications through at least 2027-2028, with a transition window before any mandatory Rev. 3 cutover. If you're certifying in the next 18 months, plan against Rev. 2. If your assessment is two-plus years out, build a SSP that documents ODPs even though Rev. 2 doesn't require them — it makes the eventual migration painless.

What to do now

Document ODPs proactively. Password length, lockout threshold, audit retention, scanning frequency — capture each one in your SSP even under Rev. 2.
Build supply-chain risk artifacts. Rev. 3's SR family will demand a documented supplier risk process. Start one now; it doubles as evidence for the existing SR.3 control in Rev. 2.
Stop relying on tribal knowledge. Anywhere Rev. 2 was vague, Rev. 3 forces explicit declaration. Implicit controls are the first thing to fail under Rev. 3.
Use a tool that tracks both. Athena's SSP generator writes Rev. 2 today and is being extended to emit Rev. 3 + ODPs automatically when DoD adopts it.

Frequently asked questions

Do I need to assess against NIST 800-171 Rev. 3 today?

No. CMMC and DFARS 252.204-7012 still reference Rev. 2 as the required baseline. Rev. 3 is published but not yet incorporated into the regulations that drive contractor obligations. Voluntary Rev. 3 alignment is forward-looking, not required.

When will DoD require NIST 800-171 Rev. 3 for CMMC?

Unknown — but not soon. Moving CMMC to Rev. 3 requires amending 32 CFR Part 170 and possibly DFARS 7012. Based on past rulemaking timelines, expect a multi-year process with a transition window. Realistic earliest mandatory date is 2028, with Rev. 2 certifications honored through their three-year validity.

What are Organization-Defined Parameters (ODPs)?

ODPs are values the contractor must explicitly declare in their implementation. Examples: password length, account lockout threshold, audit log retention period, scanning frequency. Rev. 2 leaves many of these implicit; Rev. 3 forces them to be documented and assessable.

Is Rev. 3 easier or harder to implement than Rev. 2?

Tighter, not easier. Fewer controls but more explicit requirements. Organizations with mature documentation and configuration baselines will find Rev. 3 cleaner. Organizations that relied on implicit interpretations of Rev. 2 will find Rev. 3 harder because each ambiguity now requires an explicit declaration.