NIST SP 1352: 800-171A Rev. 3 and CMMC Explained

NIST has released a new resource aimed directly at small businesses working to understand cybersecurity assessments for Controlled Unclassified Information.

Published September 16, 2026, NIST Special Publication 1352 is titled Assessing Security Requirements for Controlled Unclassified Information (CUI): NIST Special Publication 800-171A, Revision 3 Small Business Primer. NIST

That is a long title, but the purpose is relatively straightforward.

NIST wants to make the assessment concepts contained in SP 800-171A Rev. 3 more approachable for small businesses. The primer is intended for business leaders and employees responsible for managing implementation of SP 800-171 Rev. 3, conducting self-assessments, or preparing to work with external assessors. NIST

For organizations in the Defense Industrial Base, however, there is an important distinction to understand.

NIST publishing new Rev. 3 assessment guidance does not mean the current CMMC assessment baseline automatically changed to Rev. 3.

Understanding why requires separating SP 800-171 from SP 800-171A and separating NIST publications from current DoD contractual and CMMC requirements

First, What Is NIST SP 1352?

SP 1352 is not a new set of cybersecurity requirements.

It is a primer designed to help small businesses understand NIST SP 800-171A Rev. 3, the publication containing assessment procedures associated with the security requirements in SP 800-171 Rev. 3.

NIST describes the goal of SP 1352 as helping the small-business community understand foundational SP 800-171 assessment concepts and basic strategies for planning for an assessment. NIST

That distinction matters because the 800-171 family contains publications serving different purposes.

At a high level:

SP 800-171 describes security requirements for protecting CUI in nonfederal systems and organizations.

SP 800-171A provides assessment procedures and methodology for evaluating those security requirements.

NIST published both Revision 3 documents in May 2024. SP 800-171A Rev. 3 specifically provides assessment procedures that organizations, third-party assessors, and government assessors can use when evaluating implementation of the Rev. 3 security requirements. NIST Computer Security Resource Center

SP 1352 now provides a more accessible introduction to that assessment publication for the small-business community.

Why NIST Created a Small Business Primer

Anyone who has worked through the NIST 800-171 publications knows they are not light reading.

For a small business without a large cybersecurity or compliance staff, understanding not only the security requirements but also how those requirements may be assessed can be challenging.

NIST specifically recognizes that small businesses operate with constraints involving time, budget, IT personnel, and other resources. Its stated goal with the primer is to make foundational assessment concepts easier to understand and help organizations begin planning for assessments. NIST

This is also part of a broader effort.

In August 2025, NIST published SP 1318, a separate small-business primer focused on implementing SP 800-171 Rev. 3. NIST described that publication as the first part of an effort to break down Rev. 3 concepts for the small-business community. NIST Computer Security Resource Center

SP 1352 now approaches the subject from the assessment side.

Together, the two primers reinforce an important concept:

Implementing security requirements and assessing those requirements are related, but they are not the same activity.

800-171 and 800-171A Serve Different Purposes

The letter A in SP 800-171A is easy to overlook, but it represents an important distinction.

SP 800-171 establishes the security requirements.

SP 800-171A provides procedures for assessing those requirements.

The assessment publication helps answer a different question. Instead of simply asking what security requirement exists, it provides a methodology for determining whether the requirement has been implemented.

NIST states that SP 800-171A Rev. 3 assessment procedures are flexible and can be used for organizational assessments, independent third-party assessments, and government-sponsored assessments. The depth and coverage of those assessments can vary depending on the purpose of the assessment. NIST Computer Security Resource Center

For small businesses new to the CUI ecosystem, understanding this relationship can make the larger NIST framework easier to navigate.

It also helps explain why NIST created a separate primer focused specifically on assessment.

But What About CMMC?

This is where organizations need to pay close attention to the distinction between a current NIST publication and the requirements currently being enforced through DoD contracts and CMMC.

As of September 2026, DoD states that CMMC implementation is paused in Phase 1 following the suspension of Phase II in July 2026.

DoD’s current CMMC information states that Level 2 self-assessments continue to be based on the 110 security requirements in NIST SP 800-171 Revision 2. DoD also states that cybersecurity compliance with Rev. 2 continues through self-assessments and selected government-led assessments during the current CMMC review. Defense Information System Agency

That means the publication of SP 1352 should not be interpreted as an announcement that CMMC has suddenly transitioned its current assessment baseline to SP 800-171 Rev. 3.

These are related developments, but they are not the same thing.

NIST develops and publishes cybersecurity standards and assessment methodologies.

DoD determines how cybersecurity requirements are incorporated into its acquisition and contracting framework.

Those timelines do not necessarily move together.

I discussed the broader concept of assessment readiness in CMMC Assessment Readiness: What “Ready” Actually Looks Like.

So Why Pay Attention to Rev. 3 Now?

Even though current CMMC Phase 1 requirements remain tied to Rev. 2, the Rev. 3 publications are still worth understanding.

NIST SP 800-171 Rev. 3 represents the current revision of NIST’s security requirements for protecting CUI in nonfederal systems. SP 800-171A Rev. 3 provides the corresponding assessment methodology. NIST is now investing additional effort in helping small businesses understand both publications. NIST Computer Security Resource Center

That makes SP 1352 useful as an educational resource even when an organization’s current contractual obligations remain tied to Rev. 2.

It also provides insight into how NIST currently approaches security assessment concepts.

For organizations trying to understand where the broader CUI protection framework is heading, that context can be valuable.

What it should not do is create confusion about which requirements currently apply to a particular contract.

Current Standard Does Not Always Mean Current Contractual Requirement

The release of SP 1352 highlights a broader lesson that applies well beyond this particular publication.

Cybersecurity standards evolve.

Contracts, regulations, acquisition rules, and assessment programs may adopt those standards on different timelines.

As a result, organizations should be careful when encountering phrases such as “the latest NIST standard” or “the current revision.”

Those statements may be technically accurate while still failing to answer the more important question:

Which revision does the applicable requirement actually reference?

That distinction is particularly important right now because someone searching NIST will naturally encounter Rev. 3 publications, while someone reviewing current DoD CMMC Phase 1 requirements will still encounter Rev. 2.

Both can be correct at the same time.

The Bottom Line

NIST SP 1352 is a welcome addition to the growing collection of resources intended to make CUI cybersecurity requirements more understandable for small businesses.

It provides an accessible introduction to SP 800-171A Rev. 3 and helps explain foundational concepts involved in assessing the implementation of CUI security requirements.

For Defense Industrial Base organizations, however, the timing also makes an important distinction especially visible.

NIST’s current Rev. 3 assessment guidance and DoD’s current CMMC assessment requirements are not presently the same baseline.

DoD currently states that CMMC remains in Phase 1 and Level 2 self-assessments continue against the 110 requirements of SP 800-171 Rev. 2. At the same time, NIST continues developing resources around Rev. 3. NIST

Understanding both is useful.

Understanding which one actually applies is essential.