CMMC vs. NIST 800-171: What Your Suppliers Actually Need

Introduction

If you buy from a supplier that touches Department of Defense contracts, you've probably heard both terms thrown around as if they're interchangeable: CMMC and NIST 800-171. They're not. One is a list of 110 security controls. The other is a program for proving you've implemented them. Mixing them up in a purchase order or a supplier questionnaire gets you the wrong answer, and right now, with CMMC's verification requirement suspended and under review, getting the distinction right matters more than it did a year ago.

This article explains what each one actually is, who imposes it and through which contract clause, which revision of the controls is live today, and what you should actually ask a supplier before you sign a PO.

What NIST SP 800-171 Actually Is

NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," is a control catalog published by the National Institute of Standards and Technology. It lists technical and administrative security requirements a company must implement if it stores, processes, or transmits Controlled Unclassified Information, or CUI, on its own systems. Think access control, multi-factor authentication, audit logging, incident response, encryption of CUI at rest and in transit, and physical security of the equipment that touches it.

NIST doesn't enforce this document. NIST writes it. Enforcement comes from the contract clause that references it: DFARS 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting." That clause has been in DoD contracts since 2016, with a deadline of December 31, 2017 to implement the security requirements in 800-171, plus a separate obligation to report cyber incidents to the DoD within 72 hours of discovery. If your supplier has a DoD contract or subcontract involving CUI, this clause is almost certainly already in their paperwork, with or without CMMC in the picture.

What CMMC Actually Is

CMMC, the Cybersecurity Maturity Model Certification, is not a different control set. At Level 2, it is the same 110 requirements from NIST 800-171, repackaged as a certification program. The question 800-171 asks is "what controls do you need to have." The question CMMC asks is "how do we verify you actually have them." CMMC adds three tiers: Level 1 (basic self-assessment, for companies handling only Federal Contract Information), Level 2 (self-assessment or third-party assessment, mapped directly to the 110 NIST 800-171 controls), and Level 3 (government-led assessment, for the highest-sensitivity work, adding controls from NIST 800-172).

CMMC is imposed through a different clause than the one that imposes 800-171 itself: DFARS 252.204-7021. That clause requires a contractor to have a current CMMC certificate at the required level before contract award. Without 7021 in a solicitation, there is no CMMC certification requirement, even if 7012 and its underlying 800-171 obligations are still sitting in the contract.

NIST 800-171 vs. CMMC, Side by Side

The Revision 2 vs. Revision 3 Problem

This is where most secondary write-ups get it wrong, so it's worth being precise. NIST published a major rewrite of the control catalog, SP 800-171 Revision 3, in final form on May 14, 2024. Revision 3 reorganizes the requirements to align with NIST SP 800-53 Revision 5, introduces organization-defined parameters, and trims the control count to 97 across 17 families, down from 110 across 14 families in Revision 2.

That rewrite is not what your supplier is being held to today. Twelve days before NIST finalized Revision 3, the Department of Defense issued Class Deviation 2024-O0013, which pins DFARS 252.204-7012 to Revision 2 specifically, overriding the clause's normal language that would have pulled in whatever version of 800-171 was "in effect at the time the solicitation is issued." That deviation remains in effect. As of this writing, DFARS 252.204-7012 and the CMMC Level 2 control mapping still point to the 110 requirements in Revision 2, not the 97 in Revision 3. Expect this to change eventually through formal rulemaking, but there is no published date for that cutover. If a supplier tells you they're assessed against Revision 3 for a DoD contract, ask them to show you where that's documented, because the current rule says otherwise.

CMMC Phase 2 Is Suspended, Not Gone

CMMC's rollout plan called for Phase 2 to start requiring third-party assessments, performed by accredited C3PAOs, as a condition of contract award for companies needing Level 2. On July 13, 2026, the Department of War suspended that phase and opened a 60-day review of the program. On September 3, 2026, that suspension was codified in Class Deviation 2026-O0025, Revision 3, which directs contracting officers to strip third-party assessment requirements out of active and upcoming solicitations and contracts.

What that means in practice: a self-assessment against the 110 Revision 2 requirements, scored in the Supplier Performance Risk System (SPRS), is still required. An independently audited CMMC Level 2 certificate from a C3PAO is not currently required for award, because the mechanism that would require it has been pulled from contracts. CMMC Level 1 self-assessment, for companies handling only Federal Contract Information rather than CUI, was never part of the suspension and still applies. Nothing here repeals NIST 800-171 itself or DFARS 252.204-7012. A supplier handling CUI still has to implement the controls and still has to self-report a score. What changed is who checks the paperwork, not whether the paperwork exists.

SPRS Scores and POA&Ms

Under DFARS 252.204-7019 and -7020, a contractor handling CUI must have a current self-assessment score on file in SPRS, recalculated at least every three years or whenever the security plan changes. The score starts at 110 (every Revision 2 requirement met) and loses points for each unmet control, with some controls worth more than others. A negative score is possible and is not automatically disqualifying, but it has to be current and it has to be honest.

Where a supplier hasn't fully implemented a requirement, they're allowed to document it in a Plan of Action and Milestones, or POA&M: what's missing, how it will be fixed, and by when. A POA&M is not a loophole to avoid implementing controls indefinitely. It's a time-bound commitment, and under the current rules certain requirements can't be left open on a POA&M at all. If a supplier's SPRS score relies on a POA&M that's years old with no progress, that's a signal worth asking about directly.

What Flows Down to a Subcontractor

DFARS 252.204-7012 has a flow-down requirement: if a prime contractor subcontracts work that involves CUI, the prime has to include 7012 in the subcontract too, and the sub has to meet the same 800-171 Revision 2 requirements. This is where a lot of exposure for manufacturers actually sits, because a sub several tiers down a supply chain often doesn't realize they're handling CUI (a technical drawing, a part spec, a bill of materials tied to a defense program) and hasn't put the controls in place or the clause in their own subcontracts.

The CMMC clause, 7021, is supposed to flow down too, scoped to the level of CUI or FCI the subcontractor actually handles, not automatically the same level as the prime. With Phase 2 suspended, the practical flow-down obligation right now is mostly the 800-171 self-assessment and SPRS score, not a third-party certificate.

Clause	What it imposes	Applies to
DFARS 252.204-7012	Implement NIST SP 800-171 Rev 2 (110 controls); report cyber incidents within 72 hours	Any contractor or sub handling CUI
DFARS 252.204-7019	Have a current NIST 800-171 self-assessment score posted in SPRS	Any contractor or sub handling CUI
DFARS 252.204-7020	Allow DoD to verify the assessment; flow down the same requirement to subs	Any contractor or sub handling CUI
DFARS 252.204-7021	Hold a CMMC certificate or self-assessment at the required level before award	Contractor or sub, scoped to the solicitation

What to Put in Your Purchase Order

Don't write "CMMC certified" into a PO as a blanket requirement unless the end contract actually calls for it. Right now that line can't be satisfied the way it could have been a year ago, because third-party certification isn't being issued under Phase 2 as a condition of award. Instead, reference what's actually enforceable today: a current SPRS score under DFARS 252.204-7019/-7020, and a statement of whether the supplier is a covered contractor under 252.204-7012 for the specific CUI involved in your order. If the end item flows into a program with a known CMMC level requirement, state that level and ask which assessment type (self or third-party) applies to that specific contract, rather than assuming a certificate exists.

What to Ask a Supplier

Before you place an order that touches a DoD-linked program, ask the supplier directly:

• Do you handle CUI under this order, and is DFARS 252.204-7012 in your own contract?
• What is your current SPRS score, and what date was it last submitted?
• Do you have open POA&Ms, and what's the remediation date on each?
• Have you flowed 7012 and, if applicable, 7021 down to any sub you use for this work?
• Which NIST 800-171 revision are you assessed against (it should be Revision 2 right now), and has anyone told you otherwise?
• If CMMC Level 2 applies to this program, is your path self-assessment or third-party, and has that changed since the Phase 2 suspension?

A supplier who answers these specifically, with dates and scores, is one you can trust to keep the paperwork current. A supplier who answers "we're CMMC compliant" without a score, a date, or a clause number is giving you a marketing answer, not a compliance answer.

Conclusion

NIST SP 800-171 is the control set. CMMC is the verification program wrapped around it, and at Level 2 it checks the same 110 Revision 2 requirements, not a different list. DFARS 252.204-7012 puts the controls on a contractor; DFARS 252.204-7021 puts certification on top of that. As of today, the controls are unchanged and still Revision 2, while the third-party certification piece of CMMC Phase 2 is suspended under a class deviation signed September 3, 2026, following the July 13, 2026 suspension. Self-assessment, SPRS scores, and POA&Ms are still the operative mechanism. Write your purchase orders against what's actually enforceable, ask for scores and dates rather than a certificate, and check back on the Phase 2 review before you assume anything here is permanent.