Pentagon CMMC moves to NIST SP 800-171 Revision 3
1 JULY 2026, WASHINGTON
The Department of Defense is updating the Cybersecurity Maturity Model Certification program to align with NIST SP 800-171 Revision 3. The rulemaking carries RIN 0790-AM01, and the department targeted a July 2026 interim final rule. An interim final rule can take effect before its comment period closes, so defense contractors should watch for the published date rather than wait for a final rule.
SP 800-171 Revision 3 is a general security-controls baseline, not a post-quantum instrument. The alignment updates the controls that defense contractors must meet to protect controlled unclassified information. On its own, the move does not require quantum-resistant cryptography.
The department has said separately that CMMC must add post-quantum requirements. That signals a later step rather than part of the Revision 3 alignment, and it fits the broader defense timeline that requires systems to support post-quantum cryptography by the end of 2030. Contractors reading the Revision 3 changes should therefore expect post-quantum controls to appear in a future CMMC update.
Why it matters. CMMC decides who can win defense work, so changes to its control baseline reach the whole defense industrial base. The Revision 3 alignment is a security update now, but the department's statement that CMMC must add post-quantum requirements tells contractors where the program is heading. Organizations that fold a cryptographic inventory into their CMMC preparation will be ready when post-quantum controls follow.