NIST 800-171 Survived the CMMC Pause. It Was Always the Real Requirement.

Strip away the acronyms and defense cybersecurity is one document: NIST Special Publication 800-171. 110 requirements across 14 families, written to protect Controlled Unclassified Information on contractor systems.

Everything else, CMMC included, is plumbing that got bolted on to enforce that document.

A short history of the plumbing

DFARS 252.204-7012 put 800-171 into defense contracts with full implementation due by the end of 2017. Enforcement was self-attestation, which is to say the honor system.

The honor system produced a decade of inflated scores. So DoD added scoring and SPRS reporting in 2020 (7019/7020), then CMMC (32 CFR Part 170) to make somebody verify. On July 13, 2026 the third-party verification got suspended. The document underneath never blinked.

The memo is explicit that during the pause the department enforces “baseline compliance with NIST SP 800-171 Rev 2” through self-assessments and government-led assessments. Rev 2 is today’s baseline; NIST published Rev 3 in 2024, and my read is the program migrates there eventually. The work you do against Rev 2’s objectives carries forward heavily either way.

It’s spreading past defense

The FAR Council has a proposed rule (FAR Case 2017-016) to standardize CUI protection across ALL federal contracting, built on the same NIST foundation. Defense contractors got 800-171 first. My read: your civilian-agency peers are next, and the contractors who treated it as a real security baseline instead of a defense-only tax will be reusing their work.

What this means on a Tuesday

• Your 7012 contracts require the 110 controls today. Suspension or not.
• Your self-assessment against the 800-171A objectives feeds a SPRS score somebody at your company signs for annually.
• The government kept 2 enforcement tools: DIBCAC assessments and the False Claims Act. Both are active.

CMMC might come back as a certification, come back compressed, or fade out entirely. I genuinely don’t know, and neither does anyone selling you certainty about it.

The 110 requirements underneath it are in your contracts right now and heading for the rest of government. Work the requirement. Let Washington argue about the wrapper.