[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Fpentagon-cmmc-nist-sp-800-171-rev-3":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Fpentagon-cmmc-nist-sp-800-171-rev-3.md","Pentagon CMMC Moves to NIST SP 800-171 Revision 3, With Post-Quantum Requirements to Follow","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"pentagon-cmmc-moves-to-nist-sp-800-171-revision-3","Pentagon CMMC moves to NIST SP 800-171 Revision 3",[18,19,20],"p",{},[21,22,23],"strong",{},"1 JULY 2026, WASHINGTON",[18,25,26],{},"The Department of Defense is updating the Cybersecurity Maturity Model Certification program to align with NIST SP 800-171 Revision 3. The rulemaking carries RIN 0790-AM01, and the department targeted a July 2026 interim final rule. An interim final rule can take effect before its comment period closes, so defense contractors should watch for the published date rather than wait for a final rule.",[18,28,29],{},"SP 800-171 Revision 3 is a general security-controls baseline, not a post-quantum instrument. The alignment updates the controls that defense contractors must meet to protect controlled unclassified information. On its own, the move does not require quantum-resistant cryptography.",[18,31,32],{},"The department has said separately that CMMC must add post-quantum requirements. That signals a later step rather than part of the Revision 3 alignment, and it fits the broader defense timeline that requires systems to support post-quantum cryptography by the end of 2030. Contractors reading the Revision 3 changes should therefore expect post-quantum controls to appear in a future CMMC update.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," CMMC decides who can win defense work, so changes to its control baseline reach the whole defense industrial base. The Revision 3 alignment is a security update now, but the department's statement that CMMC must add post-quantum requirements tells contractors where the program is heading. Organizations that fold a cryptographic inventory into their CMMC preparation will be ready when post-quantum controls follow.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2026-07-01","The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 via a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.",false,"md",[49,52,55],{"q":50,"a":51},"Is CMMC a post-quantum requirement?","Not yet. The update aligns CMMC with NIST SP 800-171 Revision 3, which is a general security-controls baseline rather than a post-quantum instrument. The Department of Defense has said CMMC must add post-quantum requirements in a later step.",{"q":53,"a":54},"When does the Revision 3 alignment take effect?","The Department of Defense targeted a July 2026 interim final rule under RIN 0790-AM01. An interim final rule can take effect before the comment period closes, so defense contractors should track the published date rather than wait for a final rule.",{"q":56,"a":57},"Who does CMMC affect?","CMMC applies to the defense industrial base, the contractors and subcontractors that handle controlled unclassified information for the Department of Defense. The move to Revision 3 updates the security controls those organizations must meet to win and keep defense work.",[59],"washington-dc","\u002Fassets\u002Fog-default.png",[62,63],"Defense Industrial Base","Cross-Sector",{},"2026-09-23",true,"\u002Fnews\u002Fpentagon-cmmc-nist-sp-800-171-rev-3",[69],{"label":70,"url":71},"U.S. Department of Defense, \"Cybersecurity Maturity Model Certification Program,\" rulemaking RIN 0790-AM01, targeted interim final rule, 2026.","https:\u002F\u002Fwww.reginfo.gov\u002Fpublic\u002Fdo\u002FeAgendaViewRule?RIN=0790-AM01",[73,76],{"label":74,"url":75},"Pentagon Sets 2030 and 2031 Post-Quantum Deadlines","\u002Fnews\u002Fpentagon-post-quantum-cryptography-strategy-2030-2031",{"label":77,"url":78},"Executive Order 14412 Directs Post-Quantum Contractor Rules Under the FAR by 2030","\u002Fnews\u002Feo-14412-contractor-far-rules-2030",{"title":5,"description":45},"Pentagon CMMC Moves to NIST SP 800-171 Rev. 3","pentagon-cmmc-nist-sp-800-171-rev-3","news\u002Fpentagon-cmmc-nist-sp-800-171-rev-3",[84,85,86,87,88],"defense industrial base","federal compliance","post-quantum cryptography","supply chain","for government","The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 through a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.","zfHbwJLGPQYp5Ewj8vJQQZxb4gaVp_kmHw-D-5lzj2g",1792182885440]