Federal and defense cyber frameworks compared

Which federal or defense framework to pursue first

Start with your role. Contractors handling CUI in nonfederal systems build to NIST SP 800-171 Rev. 2 now, because DFARS 252.204-7012 still points to that revision, and the DoD's CMMC Level 2 requirements are identical to its 110 requirements. Federal agency system owners run NIST SP 800-53 Rev. 5 under FISMA, using the baselines in SP 800-53B matched to system impact level. The NIST Cybersecurity Framework is voluntary for most organizations, though some customers or suppliers require it, and a 2017 executive order made it mandatory for federal agencies. Do not treat the CSF as a substitute for either mandatory set.

Doing more than one makes sense when one organization holds several roles, such as a contractor that also operates a federal system, or a company that must show CUI safeguards to a prime while also using the CSF for board reporting. In that case, the SP 800-171 Rev. 2 requirements form the contractual baseline and the CSF can organize the program around them. Confirm with your contracting officer and your prime which revision and which DFARS clause version apply to each contract, because a DoW class deviation issued on 3 September 2026 uses a revised DFARS 252.204-7012 that names Rev. 2, and a proposed FAR overhaul would move contractors toward Rev. 3 with ODP values published by the DoW CIO.

On CMMC timing, the DoW suspended CMMC Phase II on 13 July 2026, so Level 2 C3PAO certification is not currently required under the scheduled Phase II date of 10 November 2026. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Ask your contracting officer whether a Level 2 self-assessment or a certification will appear in each solicitation, and keep your SPRS score and assessment evidence current, since those are what you can be asked to show now.

How SP 800-53, SP 800-171, CMMC and the CSF compare

This table compares NIST SP 800-53, NIST SP 800-171, CMMC and the NIST CSF on who must use them, what they cover, legal force, structure, assessment and proof. Read each row against your contracts and systems, because the right choice depends on which obligation you already carry.

Dimension	NIST SP 800-53 Rev. 5	NIST SP 800-171 Rev. 3	CMMC (32 CFR Part 170)	NIST CSF 2.0
Who must use it	Federal agencies and contractors whose federal systems fall under FISMA and OMB Circular A-130, as applied by the agency	Nonfederal organizations that handle CUI, as set by federal agencies in contracts and 32 CFR 2002	DoD contractors and subcontractors whose contracts carry the CMMC clause (252.204-7021) once it applies	No federal mandate for most organizations; some customers or suppliers require it, and federal agencies were required to use it by a 2017 executive order
System or data covered	Federal information systems at a chosen impact level, plus a privacy baseline	Nonfederal systems that process, store or transmit CUI	Contractor systems handling Federal contract information (Level 1) or CUI (Level 2 and 3)	Any organization's cybersecurity risk, expressed as outcomes across six functions
Legal force	Binding on federal systems through FISMA and agency policy, not on private firms by itself	Binding only through contract or agency requirements that incorporate it	Binding through DFARS contract clauses; the CMMC rule is in force, but Phase II is suspended	Voluntary; NIST is not a regulatory agency
Structure and count	324 base controls and 872 control enhancements in the Rev. 5.2.0 OSCAL catalog, organized in 20 families; tailored by baseline	97 security requirements in 17 families, with organization-defined parameters that the nonfederal organization may need to assign	Level 2 uses the 110 Rev. 2 requirements in 14 domains; Level 1 uses 15 requirements; Level 3 adds 24 Rev. 5 SP 800-172 requirements	Core of outcomes organized in six functions, with implementation examples and informative references to other standards
Assessment method	Assessment procedures in SP 800-53A Rev. 5 with examine, interview and test methods; assessed by agency or authorizing official	Assessment objectives in SP 800-171A Rev. 3; scored against each requirement	Self-assessment or third-party assessment against SP 800-171A objectives; a requirement is MET only with final evidence	Self-directed; NIST publishes the framework but offers no assessment program
Proof it produces	Authorization and assessment documentation for federal systems, reviewed by agencies and Inspectors General	Assessment results and System Security Plan documentation; no certificate from NIST	Level 1 and Level 2 self-assessment affirmations posted to SPRS; Level 2 certificate only when the certification phase applies; Level 3 assessed by DCMA DIBCAC	No certificate. Any proof is your own documented mapping and evidence, or what a customer accepts
Right choice when	Your agency or prime contract names SP 800-53 for federal systems, or you operate a federal system that needs an authorization path	Your contract requires protecting CUI in your own nonfederal systems and you need a requirement set to implement	You hold DoD contracts with a CMMC clause, or you must show assessed evidence for CUI to a prime or the DoD	You need a voluntary common language for risk and governance, or a customer asks for CSF alignment without a formal audit
Key condition to confirm	Which impact level and baseline your contracting officer or authorizing official requires	Whether the agency or contract has assigned the ODP values, since NIST does not assign them	Current CMMC phase and whether your contract requires Level 2 certification or self-assessment	Which mappings your customers accept, since NIST does not check non-NIST informative references

Which framework applies to your system, contract or program

Four situations cover most US federal and defense conversations, and each one starts from a different binding source. Identify which situation you are in before choosing a control set, because the source determines the baseline, the assessor and the proof a buyer or agency will ask for.

Federal system owned by an agency

If your team operates an information system on behalf of a federal agency, FISMA and OMB Circular A-130 set the obligations, and the agency authorizes the system. Build against the SP 800-53 Rev. 5 control baselines in SP 800-53B that match the system's impact level, with the privacy baseline where personal data is involved. Expect proof in the form of the agency's authorization package and assessment results that follow SP 800-53A procedures, and confirm with the agency which baseline and parameters it expects. Agencies, not contractors, decide which overlays apply.

Nonfederal system holding CUI

When a contractor stores, processes or transmits CUI in its own systems, agencies set the protection requirements through 32 CFR 2002.14(h)(2), which requires NIST SP 800-171 unless the CUI category's authority or an agreement says otherwise. Confirm in the contract which revision applies, because the current NIST version is Rev. 3 while DoD contract terms currently reference Rev. 2. Expect the contract clause to define your evidence obligations, including any ODP values the agency must supply.

DoD contract with Federal contract information only

If a DoD contract involves only Federal contract information and no CUI, the CMMC Level 1 requirements apply, which are the 15 safeguarding requirements of FAR 52.204-21. Build against that short list and document how each requirement is met. Expect a self-assessment with an affirmation rather than a third-party certification, and confirm with the contracting officer whether the solicitation carries CMMC clauses such as DFARS 252.204-7021 or 252.204-7025.

DoD contract handling CUI

DoD contracts involving CUI bring in 32 CFR Part 170 and DFARS 252.204-7012 together. CMMC Level 2 maps to the 110 requirements of SP 800-171 Rev. 2, and the Department of War has said it will enforce Rev. 2 in the interim even though NIST withdrew it. Check the current phase in the DoW CIO's guidance, because the eCFR schedule and the paused rollout differ. Expect a self-assessment posted to SPRS now, and a C3PAO certification only if the contract requires it under the phase in force.

Voluntary adoption

If no statute or contract requires a framework, the NIST Cybersecurity Framework 2.0 is the common starting point because it organizes outcomes without prescribing controls. NIST does not offer certification for CSF implementations, so the proof you produce is internal evidence, customer attestations or a mapped control set you can show to buyers. Ask customers which control set they reference, since many map the CSF to SP 800-53 or SP 800-171 in their questionnaires.

Rev. 2 or Rev. 3: which SP 800-171 set to build against now

The short answer is to build to SP 800-171 Rev. 2 for current contracts and map Rev. 3 now. NIST withdrew Rev. 2 on 14 May 2024 and published Rev. 3 with 97 requirements, but the CMMC rule still makes the Level 2 requirements identical to Rev. 2 under 32 CFR 170.14(c)(3), so DoD contractors are assessed against the 110 Rev. 2 requirements. DoW Class Deviation 2026-O0025, Revision 3 (signed 3 September 2026) has contracting officers use a revised DFARS 252.204-7012 that names Rev. 2 explicitly, and it cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. The contract clause, not NIST's publication status, is what you will be measured against.

The direction of travel is toward Rev. 3. A FAR overhaul proposed rule published 23 June 2026 would require contractors handling CUI to comply with SP 800-171 Rev. 3 using organization-defined parameter (ODP) values published by the DoW CIO. Comments closed 23 July 2026, and the rule was not final as of October 2026. Confirm its status with your contracting officer and in the Federal Register before you change a contract baseline. Rev. 3 also introduces ODPs that NIST does not assign, so if a federal agency does not specify them, the nonfederal organization must assign them. Ask whether the DoW will publish values for your contract type.

Plan the move as a delta, not a rebuild. Keep your Rev. 2 control set as the system of record, and add a crosswalk that maps each Rev. 2 requirement to its Rev. 3 counterpart, flags the 33 requirements NIST counts as withdrawn and the 19 it counts as new, and records where ODP values will be needed. The NIST change analysis spreadsheet and the Rev. 3 OSCAL catalog are the right inputs for that crosswalk. Assign an owner to each ODP and keep the evidence for the new Rev. 3 families (Planning, System and Services Acquisition, and Supply Chain Risk Management) in the same evidence store, so a future switch changes the assessment objectives, not your architecture.

Who assesses each framework and what the result is

This table compares who checks each US federal or defense framework, the standard they are checked against, what the result looks like and what recurs afterward. Read each column as a separate regime, because a self-assessment, a third-party certification and an agency inspection produce different proof.

Framework and level	Who assesses	Assessment standard	What is issued	Recurring obligation
CMMC Level 1	The organization itself (self-assessment)	FAR 52.204-21 safeguarding requirements, 15 in total	Self-assessment result posted in SPRS	Annual affirmation by a senior official, plus the DFARS 252.204-7012 obligations that remain in place
CMMC Level 2 (self-assessment)	The organization itself, for applicable contracts where the self-assessment path applies	NIST SP 800-171A assessment objectives, against the 110 Rev. 2 requirements	Score and SPRS posting; no third-party certificate	Annual affirmation; the 2026 DoW CIO memorandum and class deviation keep Rev. 2 as the baseline
CMMC Level 2 (certification)	C3PAOs authorized or accredited by The Cyber AB; currently suspended for Phase II	NIST SP 800-171A assessment objectives, with evidence in final form	Certification assessment result tied to the CMMC Level 2 requirement set	Annual affirmation; confirm current status with the DoW CIO before planning any certification
CMMC Level 3	DCMA DIBCAC	NIST SP 800-172 selected requirements with DoD-assigned parameters	Certification assessment result issued by DCMA DIBCAC	Confirm the applicable phase and affirmation terms in the contract and the current CMMC rule
FISMA for federal systems	Agency Inspectors General, who assess agency system security and report to OMB	NIST SP 800-53 controls, with assessment procedures in SP 800-53A	Independent assessment findings reported to OMB; no certificate	Continuous assessment and reporting under OMB Circular A-130 timelines; confirm agency requirements
NIST CSF 2.0 (voluntary)	The organization or its customers; NIST offers no conformity assessment	Outcomes in the Core, with no fixed assessment procedure	No certificate or NIST-issued result; any report is the organization's own or a customer's review	Set by the customer or contract that requires the CSF; NIST does not certify CSF implementations
NIST SP 800-171 in contracts without CMMC	The contracting party, through the contract's own review terms	SP 800-171 requirements as incorporated by the contract	Contract-specific evidence; confirm what the contracting officer will accept	Ongoing obligations set in the DFARS clause and contract; confirm with the contracting officer

Where SP 800-53, SP 800-171 and CSF work overlaps

SP 800-171 Rev. 3, SP 800-53 Rev. 5 and the CSF 2.0 are linked by NIST's own tailoring and mapping work, so evidence gathered once can often serve more than one requirement set. The overlap is real only where each mapping is checked against your own systems, and the CMMC Level 2 requirements still follow Rev. 2 for DoD contracts.

Rev. 3 tailored from 800-53

NIST built the SP 800-171 Rev. 3 requirements by tailoring SP 800-53 Rev. 5 controls in the SP 800-53B moderate baseline. Controls were removed when they were primarily the federal government's responsibility, not directly tied to CUI confidentiality, adequately covered by other controls, or not applicable. A team that already runs a moderate 800-53 program can trace many Rev. 3 requirements back to a control it has evidence for, but it should confirm each trace rather than assume it.

CSF 2.0 links to both

The CSF 2.0 Reference Tool export lists informative references to SP 800-53 Rev. 5.2.0 and SP 800-171 Rev. 3, among other standards. These references let a team start from CSF outcomes and see which specific controls support each one. Treat them as a starting map: the references show where NIST and other contributors see a link, not that a control fully satisfies an outcome in your environment.

OLIR crosswalk for CSF to 800-53

NIST's Online Informative References (OLIR) catalog hosts a CSF 2.0 to SP 800-53 Rev. 5.2.0 crosswalk. Use it to pull the specific control identifiers behind each CSF subcategory before building a control matrix. Record which crosswalk version you used, since the control set is updated in numbered releases and your evidence map must point to the release your assessor reviews.

CMMC domains map to 800-171 families

The CMMC Model has 14 domains that map to the security requirement families of SP 800-171 Rev. 2, and each requirement ID follows the DD.L#-REQ pattern, such as AC.L2-3.1.1. Level 2 assessments still use the Rev. 2 requirements because 32 CFR 170.14(c)(3) makes them identical to Rev. 2. A team preparing for CMMC should map its evidence to Rev. 2 numbering now, even if its CSF or 800-53 work is organized around Rev. 3.

Verify every non-NIST mapping

NIST says it does not check the correctness of non-NIST mappings and that listing a mapping does not imply endorsement. Mappings from other organizations, including vendor and third-party crosswalks, can differ in granularity and interpretation. Before relying on any mapping in a contract response or assessment, check each link against your own configuration, policy and evidence, and record who made the mapping and when.

In what order to build the program

This sequence starts with the information boundary, then builds the control set the current contract terms require, and adds the newer Revision 3 and governance layers only when the contract or buyers ask for them. Each step closes with evidence you can show a contracting officer or assessor.

Scope the CUI and contract information boundary
Identify every system, enclave, person and service provider that stores, processes or transmits federal contract information (FCI) or controlled unclassified information (CUI). Confirm the boundary with the contracting officer and the contract clauses in writing, since they define what counts as CUI for that award. If your team runs a federal system itself, NIST SP 800-53 is the control catalog that applies under FISMA and OMB Circular A-130, so confirm with the agency which baseline it assigns. Done means a signed boundary diagram and an asset inventory that names each in-scope component and its owner.
Implement the 110 Rev. 2 requirements
Build the 110 requirements in 14 families that CMMC Level 2 uses. NIST withdrew SP 800-171 Rev. 2 on 14 May 2024, but 32 CFR 170.14(c)(3) keeps the Level 2 requirements identical to Rev. 2, so DoD contractors are still assessed against it. Assign an owner to each requirement, write the policies and procedures, configure the technical controls and keep records as they are created. Test each requirement against the SP 800-171A (June 2018) assessment objectives. Done means every requirement has an owner, a written implementation and evidence in final form, because drafts do not count toward MET.
Self-assess and post the result to SPRS
Score the environment against all 110 requirements, recording the scope, the date and the assessor for each finding. Post the result to SPRS as the contract requires, and keep the obligations that remain in place: Phase 1 self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 duties. The Department of War suspended CMMC Phase II on 13 July 2026. Because Phase II is suspended, confirm with the contracting officer whether your award requires a Level 2 C3PAO certification or only a self-assessment before you commit budget to a third-party assessment. Done means a dated assessment record that matches the SPRS entry and a list of any requirements not yet MET.
Map the Rev. 3 delta and ODP values
Map your Rev. 2 evidence to the 97 Rev. 3 requirements using NIST's change analysis, which counts 19 new requirements and 33 withdrawn ones. Rev. 3 adds 88 organization-defined parameters (ODPs) across 50 requirements. NIST does not assign their values, and if a federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Keep this as a delta, because a FAR overhaul proposed rule of 23 June 2026 would require Rev. 3 with DoW-published ODP values but was not final as of October 2026. Done means a mapping table that lists each Rev. 3 requirement, its evidence and the ODP values in use, reviewed against the revision your contract names.
Layer the CSF as governance language
Add NIST CSF 2.0 when buyers, insurers or board reporting ask for an outcome-based view. The CSF is voluntary, and NIST does not certify CSF implementations, so use it to describe the program and never to claim a certification. Map your 800-171 evidence to CSF subcategories with NIST's CSF 2.0 Reference Tool and its informative references. NIST does not check non-NIST mappings, so validate each link against your own records. Done means a CSF profile that cross-references existing evidence and states plainly that NIST issues no certificate for it.

What the suspended CMMC Phase II means for your timeline

The most important point for your planning is that CMMC Phase II is suspended, not repealed. On 13 July 2026 the Department of War suspended Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts, along with later implementation milestones. The department then started a 60-day review by a CMMC Reform Task Force. Any date you build into a capture or bid plan should treat that review outcome as open until the department publishes what comes next.

Two official sources currently describe the schedule differently. The DoW CIO About CMMC page states that implementation is paused in Phase 1, which began 10 November 2025, and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Until the rule text is amended, the eCFR is the legal baseline, so do not assume the phase dates in the regulation have disappeared. Ask your contracting officer which phase applies to each solicitation and which clause version the contract carries, and record the answer in the contract file.

Several obligations stay in force regardless of the Phase II suspension. Phase I self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations for safeguarding covered defense information and reporting cyber incidents all remain in place. Confirm with the contracting officer which SP 800-171 revision each solicitation names, since the DoW has directed reliance on Revision 2 in the interim. Because this status changed within months, re-check the current phase in every solicitation and with the contracting officer before each bid, option exercise or certification decision, and keep dated notes of each answer.

Questions contractors and agencies ask before hiring help

Can a defense contractor self-assess against CMMC right now?

Yes, for the current phase, self-assessment is the path that applies, but confirm the status with the contracting officer before relying on it. The DoW CIO 'About CMMC' page says implementation is paused in Phase 1, which began 10 November 2025, and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, so the two sources disagree on timing. On 13 July 2026 the Department of War suspended Phase 2, which would have required Level 2 C3PAO certification. Phase 1 self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Ask your contracting officer which level and assessment type each contract requires.

What does a CMMC Level 2 certification assessment cost?

The 2024 CMMC final rule estimated a Level 2 C3PAO certification assessment plus initial affirmation at $112,345 per assessment for an other-than-small entity and $101,752 for a small entity. The same rule estimated three-year totals, including two annual affirmations, at $117,768 and $104,670. These are the rule's estimates, not quotes, and they cover the assessor's fee rather than the remediation work that comes before it. Your own cost depends on the number of in-scope systems, how much evidence already exists, the cost of any remediation and the labor your staff spend. Ask any assessor or implementation partner for a written scope that separates assessment fees, remediation and recurring affirmations.

How long does CMMC readiness take?

No supplied source gives a readiness duration, so treat any number you hear from a vendor as unverified. The timeline depends on how far your environment already matches the 110 Rev. 2 requirements, how many systems hold CUI, how many external service providers are in scope, and whether policies, system security plans and evidence exist in final form. Assessors accept a requirement only when every applicable objective in NIST SP 800-171A is met with evidence in final form, not drafts, so documentation work often sets the pace. Ask for a scope-based schedule with named milestones and the dependencies your staff must clear.

What does a readiness project need from our internal staff?

It needs named owners with access to the systems being assessed. Expect input from IT operations for configuration and account evidence, security staff for policy and incident procedures, legal or contracts staff for the CUI and FCI scope, and a senior sponsor who can approve remediation work. Your team also has to own decisions that an outside party cannot make, such as which contracts carry CUI and which external providers store it. Confirm in the written scope which tasks DeployOpen performs and which your staff must complete, and agree on how quickly reviews and approvals will return.

Does NIST issue certifications for NIST SP 800-171 or the CSF?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services and has no plans to develop a conformity assessment program. The same is true of NIST SP 800-171: NIST publishes the requirements and the assessment procedures in SP 800-171A, but the proof a DoD contractor receives comes from the CMMC program, through a C3PAO for Level 2 certification or a self-assessment at the level the contract allows. Any offer of a NIST certificate should be treated as a red flag.

Is SP 800-171 Rev. 3 required now for DoD contracts?

For DoD contracts, not yet in a way you can plan around without checking. NIST published SP 800-171 Rev. 3 on 14 May 2024, and it remains the current NIST version. However, the CMMC rule still incorporates Rev. 2, and DoW Class Deviation 2026-O0025, Revision 3 names Rev. 2 explicitly, citing a 13 July 2026 DoW CIO memorandum that requires baseline compliance with Rev. 2 while Phase 2 is suspended. A proposed FAR overhaul published 23 June 2026 would move contractors handling CUI to Rev. 3, but that rule was not final as of October 2026. Ask your contracting officer which revision each solicitation references, and plan for Rev. 3 as a likely future baseline with its organization-defined parameters.

What does DeployOpen prepare, and what does an assessor issue?

DeployOpen plans, implements, documents and hardens the self-hosted open-source platforms in your own environment, and it prepares the systems, controls and evidence that a compliance assessment will review. It does not issue audit reports, attestations or certifications. For CMMC Level 2, a C3PAO or the assessment body named in the program issues the certification, and for self-assessments the organization makes its own determination and posts results in SPRS. Most DeployOpen engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts. Ask for a written statement that maps each deliverable to the requirement IDs it supports and names who signs off on the evidence.

How DeployOpen scopes SP 800-171, SP 800-53 and CMMC readiness

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, so the assessment itself stays with the assessor or certification body.

How we scope

Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope names which system boundary, CUI flows and control set (for example SP 800-171 or SP 800-53) are in play.
We confirm with the client which CMMC level and contract clauses apply before any readiness work begins.

How we build

We map existing controls to the requirement IDs or control IDs in scope and record gaps against each one.
Controls are configured and hardened in the client's own cloud accounts, data centers or air-gapped networks.
Security testing of in-scope applications and infrastructure is run where the written scope includes it.

How we hand over

Deliverables include system documentation, control implementation records and evidence collected in final form.
Each requirement is traced to the evidence that would support an assessor's review under the relevant assessment objectives.
The client receives documented procedures so its own staff can operate and show the controls after handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
Retainers can cover control drift checks when NIST revisions, DoW memoranda or DFARS clauses change requirements.
Clients should confirm with their contracting officer or assessor which version and deadline apply to their contracts.

US federal and defense cybersecurity frameworks compared