Rev. 2 vs. Rev. 3: what changed, and when it becomes your problem.

The five structural changes

Dimension	Rev. 2	Rev. 3
SOURCE ALIGNMENT	Derived from SP 800-53 Rev. 4 era	Aligned with SP 800-53 Rev. 5 moderate baseline, with a published crosswalk
FAMILIES	14 requirement families	17 — adding Planning, System & Services Acquisition, and Supply Chain Risk Management
REQUIREMENTS	110 requirements	Consolidated and restructured set (fewer, denser requirements — several Rev. 2 items merged or withdrawn, new ones added)
PARAMETERS	Fixed requirement text	Organization-Defined Parameters (ODPs): values set by the imposing agency or the organization, and defensible either way
ASSESSMENT	SP 800-171A + DoD Assessment Methodology (SPRS scoring)	SP 800-171A Rev. 3 with restructured assessment objectives

What the changes mean operationally

• The three new families are process families. Planning, System & Services Acquisition, and Supply Chain Risk Management demand working processes — vendor evaluation, acquisition security, planning discipline — not just configurations. Contractors whose programs are pure tooling feel these the most.
• ODPs turn requirements into decisions. Where Rev. 2 told you what to do, Rev. 3 frequently asks the imposing agency — or you — to set the value: review frequencies, timing windows, scope choices. Every ODP needs a recorded value and a rationale, because assessors will ask for both.
• Consolidation is not relief. A merged requirement still contains its parents' substance, and the Rev. 3 assessment objectives test that substance. Mapping "fewer requirements" to "less work" is the first mistake of casual transitions.
• Evidence must be re-indexed, not recreated. Objective-level evidence built under 800-171A carries over substantially — after a deliberate remapping to the Rev. 3 objective structure.

Which one binds you? Read the contract.

DoD lane: DFARS-based work generally continues to point at Rev. 2 — and CMMC currently assesses against Rev. 2 — pending DoD's own rulemaking to adopt Rev. 3. Civilian lanes: some agency processes are already moving; GSA's CUI guidance for contractor systems is an early example of Rev. 3-with-ODPs in the wild (see GSA authorization). The rule that never changes: the revision incorporated into each contract or agreement is the one that binds that work. Contractors serving both markets should plan for dual-baseline operation, not a clean switchover date.