# DoD Keeps Revision 2 CUI Baseline

NIST SP 800-171 Revision 3 establishes 97 security requirements across 17 families, including 88 organization-defined parameters, for contractors, universities, laboratories, and service providers handling Controlled Unclassified Information (CUI). However, DoD Class Deviation 2024-O0013 keeps Revision 2 as the applicable baseline for DFARS 252.204-7012 and CMMC Level 2 until acquisition regulations are updated. For procurement teams and contractors, publication of Revision 3 does not by itself change the requirements applicable to a specific defense solicitation or contract.

- Contractors should verify the cybersecurity baseline stated in each solicitation and contract before changing policies, assessment plans, or compliance investments.
- Organizations handling CUI can use Revision 3 to understand the updated framework, but should distinguish its requirements from the Revision 2 baseline currently identified for DFARS 252.204-7012 and CMMC Level 2.
- Procurement teams should specify the applicable revision in acquisition documents to reduce ambiguity for bidders and avoid misaligned security assessments.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 11, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- U.S. Department of Defense (DoD)

### Sources
- [NIST 800-171 Rev 3: Requirements & Changes — CASRAI](https://casrai.org/guides/nist-800-171-rev-3) - CASRAI