The key sentence in Class Deviation 2024-O0013 Revision 1 is that contractors subject to the deviation clause must comply with NIST SP 800-171 Revision 2 rather than simply following the version otherwise in effect at solicitation. The deviation says it remains in effect until rescinded.
Status note: reviewed September 4, 2026. Phase II is suspended, Phase I remains in force, and the Department of War's CMMC Reform Task Force review is still open. Re-check the official CMMC page before publication if this article is published after that date.
The rule in plain English
That is why NIST's publication of Rev. 3 in May 2024 did not by itself move current DFARS 252.204-7012 compliance to Rev. 3.
For contractors, the acquisition document controls. Always review the clause actually incorporated into the solicitation or contract, including deviations.
How to implement it without overbuilding
Keep a contract-clause matrix showing which version of 252.204-7012 applies, which NIST revision it points to, and the source/date of any deviation.
Do not let a generic compliance platform automatically switch your active control set to Rev. 3 without checking the contractual basis.
What evidence to keep
Keep the executed contract, solicitation/amendments, deviation text, internal control-matrix version, and legal/procurement interpretation when needed.
Evidence should make clear which baseline the self-assessment or control-status statement used.
Where teams get into trouble
The editorial trap is saying 'NIST withdrew Rev. 2, so Rev. 2 no longer applies.' A second trap is quoting an old DFARS page without checking the current deviation note.
Small-contractor walkthrough
A proposal team sees NIST's Rev. 3 publication and assumes every new DoD solicitation now uses it. The contract team checks the class deviation and the actual clause language first, then labels the active control baseline so technical staff do not silently mix revisions.
Status articles require two dates: the date of the underlying government action and the date the article was last verified. Keep those dates visible so a later reader can distinguish a current rule from an older rollout assumption.
Planning should favor controls and evidence that remain useful under multiple reform outcomes while avoiding claims about future deadlines or assessment structure until an authoritative source adopts them.
- Review contract clauses.
- Save the deviation text.
- Label the active control baseline.
- Separate Rev. 3 planning.
What the May 22, 2024 Revision 1 means for the active baseline
NIST published SP 800-171 Rev. 3 in May 2024, but a NIST publication does not automatically rewrite an incorporated DFARS clause. DoD issued Class Deviation 2024-O0013 and Revision 1 to direct contracting officers to use revised DFARS 252.204-7012 language pointing covered contractor information systems to NIST SP 800-171 Rev. 2. The deviation remains the acquisition reason Rev. 2 continues to govern the current baseline used here.
This is why a contractor can correctly say Rev. 3 is the newer NIST publication while still using Rev. 2 for current DFARS/CMMC implementation. Acquisition applicability controls the contract. A compliance tool that automatically replaces Rev. 2 with Rev. 3 because NIST marked Rev. 2 superseded can corrupt the contractor's control and evidence record.
Keep NIST publication, deviation, and contract dates separate
Record the NIST publication date, class-deviation date, and the date or version of the solicitation or executed clause the organization relies on. These answer different questions: what NIST has published, what DoD acquisition officials were directed to use, and what language governs the particular contract. A baseline change should be triggered by an authoritative acquisition or program action, not a vendor dashboard or article.
Maintain a contract-clause matrix with contract identifier, clause/deviation version, active NIST revision, current assessment/control-matrix version, and owner. This lets the security team explain why a Rev. 3 transition project can exist beside a Rev. 2 production evidence set without mixing conclusions.
Prepare for Rev. 3 without overwriting current Rev. 2 evidence
Maintain a separate Rev. 2-to-Rev. 3 transition register. Reuse factual evidence such as inventories, architecture, access reviews, incident records, configuration data, and provider information, but keep the control mapping and compliance conclusion tied to the active baseline. Identify Rev. 3 gaps, organization-defined decisions, and long-lead architecture work as planning items.
Before publishing any statement that Rev. 3 now applies to CMMC/DFARS, check current DoD CIO CMMC pages, acquisition regulations or deviations, and the actual contract. The July 2026 reform review adds another reason to keep current fact separate from future planning: durable security improvements can continue while future assessment structure and implementation timing are reconsidered.
Archive the superseded control matrix when the baseline eventually changes instead of silently editing it in place. Historical evidence should show which requirements and contract interpretation were active when a self-assessment, affirmation, or management decision was made.
A short working check
- ✓Review contract clauses.
- ✓Save the deviation text.
- ✓Label the active control baseline.
- ✓Separate Rev. 3 planning.
- ✓Watch for rescission/replacement.
- ✓Update assessments when the baseline changes.
Common questions
What is a class deviation?
It is an authorized departure from standard acquisition regulation text or policy for a class of contracting actions.
Does Rev. 3 supersede the deviation?
No. NIST publication status does not automatically rescind DoD acquisition deviations.
How long does 2024-O0013 last?
Revision 1 says it remains in effect until rescinded.
Should a new contract be checked individually?
Yes. Review the actual solicitation/contract and current acquisition guidance.
Did NIST withdraw Rev. 2?
NIST superseded Rev. 2 with Rev. 3 as a publication, but DoD acquisition applicability is controlled by the contract and current deviation/rule language, so Rev. 2 remains the active baseline here.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
