03.15.01Policy and Procedures in Rev. 3
New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full. It carries organization-defined parameters.
Status as of 2026-09-08
Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.
The requirement
Rev. 3 · not adopted 03.15.01 Policy and Procedures
a. Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI.
b. Review and update policies and procedures [Assignment: organization-defined frequency].
NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.
Determination statements
What an assessor would check under NIST SP 800-171A Rev. 3. 6 statements, each one answered yes or no.
- 03.15.01.a[01] policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
- 03.15.01.a[02] policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
- 03.15.01.a[03] procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
- 03.15.01.a[04] procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
- 03.15.01.b[01] policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>.
- 03.15.01.b[02] policies and procedures are updated <A.03.15.01.ODP[01]: frequency>.
NIST SP 800-171A Rev. 3, verbatim.
Organization-defined parameters
Blanks the organization fills in. Defining each value is itself a determination in 800-171A Rev. 3.
- A.03.15.01.ODP[01] the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined.
What NIST says
- New security requirement based on all-1 controls (SP 800-53, Rev 5) that were formerly tailored as "NFO"
- Added new ODP: frequency to review and update policies and procedures
NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.
NIST's Rev. 3 discussion for 03.15.01
This requirement addresses policies and procedures for the protection of CUI. Policies and procedures contribute to security assurance and should address each family of the CUI security requirements. Policies can be included as part of the organizational security policy or be represented by separate policies that address each family of security requirements. Procedures describe how policies are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security plans or in one or more separate documents.
Planning in Rev. 3
PL Planning is one of the three families Rev. 3 adds; none of its requirements has a Rev. 2 number.
What this means for you now
Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.15.01 and SPRS has no score for it. If you already do what it describes, note where the evidence lives and what value you use for the parameters above; that costs nothing and answers the question later.
Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.
Where this page's facts come from
- Rev. 3 03.15.01 text, determination statements, parameters, class and note
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]