# NIST 800-171 Rev 2 vs Rev 3 Change Analysis Summary

> Build a stronger NIST-aligned incident response program with our practical NIST Incident Response Workbook. Define ownership, improve execution, and simplify compliance.

canonical: https://secureframe.com/compliance-resources/nist-rev2-vs-rev3-change-analysis-summary

### NIST 800-171 Rev 2 vs Rev 3 Change Analysis Summary

NIST 800-171 Revision 3 didn’t just renumber controls. It restructured nearly half of them, added three new families, and introduced 88 organization-defined parameters that every DoD contractor will eventually need to address. While CMMC still requires Rev 2 today, the DoD’s April 2025 ODP memo signals the transition is coming. This resource helps you understand the gap before it becomes urgent. This free spreadsheet gives you a clear, at-a-glance view of what changed across all 17 control families, pulled directly from NIST’s official R2-to-R3 change analysis.

What you'll get:

- Side-by-side Rev 2 and Rev 3 requirement counts for every family
- Number of changes, new ODPs, and withdrawn requirements per family
- The three new families and new requirements for every family clearly flagged