NIST published SP 800-171 Revision 3 in May 2024, but DoD contracts and CMMC assessments still point to Revision 2; use Rev 2 for assessments now and prepare your program to absorb Rev 3’s structure, alignment with SP 800-53 Rev 5, and organization-defined parameters.
NIST expanded and reshaped assessment objectives in SP 800-171A Rev. 3, which changes evidence planning, sampling, and scoring for contractors that handle CUI.
Continuous monitoring under NIST SP 800-171 means you operate, measure, and improve control performance with automation and human review on a defined cadence, then produce evidence that shows that operation over time.
NIST SP 800-171 Rev 3 turns many requirements into organization-defined parameters that you must set, document, and defend, and DoD now assigns specific values for a subset that contractors must use.
Mobile endpoints enter the CUI boundary as soon as users access or store CUI on them, so you need clear scope, NIST SP 800-171 controls applied to iOS and Android, and enforceable MDM or MAM policies before you allow mobile access.