03.17.02Acquisition Strategies, Tools, and Methods in Rev. 3

New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full.

New
Rev. 3 · not adopted
Supply Chain Risk Management · new family

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

The requirement

Rev. 3 · not adopted 03.17.02 Acquisition Strategies, Tools, and Methods

Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.

NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.

Determination statements

What an assessor would check under NIST SP 800-171A Rev. 3. 6 statements, each one answered yes or no.

03.17.02[01] acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.
03.17.02[02] acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.
03.17.02[03] acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.
03.17.02[04] acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
03.17.02[05] acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
03.17.02[06] acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

NIST SP 800-171A Rev. 3, verbatim.

What NIST says

New security requirement based on SR-05 (SP 800-53, Rev 5); newly added to the (SP 800-53B) moderate baseline

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.

NIST's Rev. 3 discussion for 03.17.02

The acquisition process provides an important vehicle for protecting the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind purchases, requiring tamperevident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, the insertion of counterfeits, the insertion of malicious software or backdoors, and poor development practices throughout the system life cycle. Organizations also consider providing incentives for suppliers to implement safeguards, promote transparency in their processes and security practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risks, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security requirements of the organization. Contracts may specify documentation protection requirements.

Supply Chain Risk Management in Rev. 3

SR Supply Chain Risk Management is one of the three families Rev. 3 adds; none of its requirements has a Rev. 2 number.

Supply Chain Risk Management in the catalog comparison

What this means for you now

Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.17.02 and SPRS has no score for it. If you already do what it describes, note where the evidence lives; that costs nothing and answers the question later.

Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.

Where this page's facts come from

Rev. 3 03.17.02 text, determination statements, parameters, class and note: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]