The Department of Defense has issued a class deviation to keep NIST SP 800-171 Revision 2 as the applicable baseline for DFARS 252.204-7012 and CMMC Level 2. This decision remains in effect until acquisition regulations are updated to reflect the new NIST SP 800-171 Revision 3 framework. Contractors and procurement teams must verify the specific cybersecurity baseline stated in each solicitation before adjusting compliance plans. The deviation ensures that publication of Revision 3 does not automatically change requirements for existing defense contracts.
Read the full story at app.govly.com.
Photo: cskkkk / Pixabay
