Why this is a program, not a document swap
Rev. 3 realigns 800-171 with SP 800-53 Rev. 5, expands from 14 to 17 requirement families, consolidates the requirement set, and introduces Organization-Defined Parameters — values that your imposing agency, or you, must actually decide and defend. Every one of those changes touches your SSP, your evidence structure, and your assessment story. Done casually, a Rev. 3 "update" breaks the Rev. 2 posture your current contracts still depend on. Done as a production run, it's a controlled delta.
The transition service
- Contractual baseline inventory — which contracts incorporate Rev. 2, which reference Rev. 3, which are silent, and what your primes are signaling. This is the gate for everything else.
- Rev. 2-to-Rev. 3 crosswalk — your implemented requirements mapped to the Rev. 3 structure: carried, consolidated, changed, or new.
- Requirement disposition analysis — a recorded decision for every delta: already satisfied, satisfied with modification, gap to implement, or not applicable with rationale.
- New-family implementation — Planning, System & Services Acquisition, and Supply Chain Risk Management stood up as working processes, not paper.
- ODP decision register — every Organization-Defined Parameter enumerated, valued (agency-directed where applicable), justified, and traceable.
- SSP conversion — the Rev. 2 SSP restructured to Rev. 3 without losing the Rev. 2 view your active contracts still require.
- Evidence remapping — artifacts re-indexed to SP 800-171A Rev. 3 assessment objectives, reusing everything that legitimately carries over.
- Rev. 3 assessment rehearsal — a mock assessment against the Rev. 3 methodology before any customer or authorizing official tests it.
- Dual-baseline operation — where customers require both revisions, one control implementation reported against two baselines under managed compliance.
Start with the checklist: the free Rev. 3 Transition-Readiness Checklist tells you in ten minutes whether you're looking at a delta or a rebuild — and which of your artifacts will survive the crosswalk.
Questions contractors ask us
Do we have to move to Rev. 3 now?
Only if a contract, agreement, or agency process requires it. NIST finalized Rev. 3 in May 2024 and it supersedes Rev. 2 as a publication — but contractors follow the version incorporated into their contracts. Much DoD work still points at Rev. 2 (and CMMC currently assesses against it), while some civilian-agency processes reference Rev. 3. The right move is a contractual baseline inventory, not a reflexive migration.
What actually changed in Rev. 3?
Closer alignment with SP 800-53 Rev. 5, expansion from 14 to 17 requirement families (adding Planning, System & Services Acquisition, and Supply Chain Risk Management), consolidation of the requirement set, and Organization-Defined Parameters (ODPs) whose values are set by the imposing agency or the organization. There is a matching assessment methodology in SP 800-171A Rev. 3. Full breakdown in the executive guide.
Can we operate Rev. 2 and Rev. 3 at the same time?
Yes — and many contractors will have to, because different customers will incorporate different baselines for years. A dual-baseline operation keeps one control implementation with a crosswalked SSP and evidence mapped to both requirement sets, so each customer sees its own compliant picture without you running two programs.
Will our Rev. 2 SSP and evidence carry over?
Substantially, yes — if they were built at the objective level. The transition is a structured conversion: requirements are crosswalked, dispositions recorded, ODP values decided and documented, new-family gaps implemented, and evidence remapped to 800-171A Rev. 3 objectives. It's real work, but it's a delta — not a restart.
Get your Rev. 3 transition scoped as a delta, not a restart.
Tell us your contract mix and current posture — a practitioner will come back with your baseline inventory approach and a fixed transition scope. Or email rj@indirectit.com directly.