The full map
| Family | What it covers | Rev. 3 notes |
|---|---|---|
| 3.1 ACCESS CONTROL | Who can reach what: least privilege, session control, remote access, CUI flow enforcement | Carried forward; several requirements consolidated, review cadences become ODPs |
| 3.2 AWARENESS & TRAINING | Role-based security training and insider-threat awareness | Carried forward; training frequency values are ODPs |
| 3.3 AUDIT & ACCOUNTABILITY | Logging, retention, review, correlation, and protection of audit records | Carried forward; event types and review frequencies are ODPs |
| 3.4 CONFIGURATION MANAGEMENT | Baselines, change control, least functionality, software restrictions | Carried forward; consolidated |
| 3.5 IDENTIFICATION & AUTHENTICATION | Identity proofing, MFA, authenticator management, replay resistance | Carried forward; password and authenticator rules re-expressed with ODPs |
| 3.6 INCIDENT RESPONSE | IR capability, detection, reporting, testing | Carried forward; adds emphasis on IR testing and reporting timelines as parameters |
| 3.7 MAINTENANCE | Controlled maintenance, tools, and maintenance personnel | Carried forward; consolidated |
| 3.8 MEDIA PROTECTION | Marking, storage, transport, sanitization of media carrying CUI | Carried forward |
| 3.9 PERSONNEL SECURITY | Screening and termination/transfer procedures | Carried forward |
| 3.10 PHYSICAL PROTECTION | Facility access, visitor control, physical monitoring | Carried forward |
| 3.11 RISK ASSESSMENT | Risk assessments, vulnerability scanning and remediation | Carried forward; adds supply-chain-aware risk framing, scan frequencies as ODPs |
| 3.12 SECURITY ASSESSMENT & MONITORING | Control assessment, continuous monitoring, information exchange agreements | Renamed (was "Security Assessment"); the SSP requirement moves to the Planning family |
| 3.13 SYSTEM & COMMS PROTECTION | Boundary protection, cryptography, session protection, CUI confidentiality in transit/at rest | Carried forward; cryptography requirements re-expressed with ODPs |
| 3.14 SYSTEM & INFO INTEGRITY | Flaw remediation, malicious code protection, monitoring | Carried forward; consolidated |
| 3.15 PLANNING — NEW | Policies and procedures, the System Security Plan, rules of behavior | New family; the SSP now lives here as a first-class planning artifact |
| 3.16 SYSTEM & SERVICES ACQUISITION — NEW | Security engineering principles, unsupported components, external system services | New family; buying decisions get a security gate |
| 3.17 SUPPLY CHAIN RISK MANAGEMENT — NEW | SCRM plan, acquisition strategies, supply chain controls and processes | New family; your vendors become part of your assessable posture |
Why the three new families bite
The 14 carried-forward families are largely configuration families — a well-engineered Microsoft environment satisfies most of their objectives technically. The three new families are process families. Planning demands a living planning discipline, not a one-time SSP. System & Services Acquisition means purchases get evaluated for security before money moves. Supply Chain Risk Management means the vendors inside your boundary are identified, evaluated, and monitored — with records an assessor can examine.
Contractors whose Rev. 2 programs were tooling-heavy and process-light will feel the transition here, not in the crosswalk. That's not a reason to panic; it's a reason to assess readiness honestly and build the three processes deliberately.
Remember the governing rule: your contracts decide when Rev. 3 binds you. The families above matter today for planning and for early-moving civilian processes — see GSA — while most DoD work still assesses against Rev. 2. Full context in the Rev. 2 vs. Rev. 3 executive guide.
Need the three process families built, not described?
Tell us where your program stands and a practitioner will scope Planning, Acquisition, and SCRM as working processes with evidence attached. Or email rj@indirectit.com directly.