3.12.3Monitor controls continuously in Rev. 3

Reworded: 03.12.03 Continuous Monitoring.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.12.3 Security Control Monitoring

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

Assessment objectives · 800-171A

[a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of the controls

Rev. 3 · not adopted 03.12.03 Continuous Monitoring

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Determination statements · 800-171A Rev. 3

03.12.03[01] a system-level continuous monitoring strategy is developed.
03.12.03[02] a system-level continuous monitoring strategy is implemented.
03.12.03[03] ongoing monitoring is included in the continuous monitoring strategy.
03.12.03[04] security assessments are included in the continuous monitoring strategy.

Draws on Rev. 2 3.4.9, 3.12.3.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

~~removed in Rev. 3~~ added in Rev. 3

Rev. 2 3.12.3 → Rev. 3 03.12.03 Continuous Monitoring

~~Monitor security controls on an~~ Develop and implement a system-level continuous monitoring strategy that includes ongoing ~~basis to ensure the continued effectiveness of the controls.~~ monitoring and security assessments.

1 words kept, 14 removed, 14 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

New security requirement title
Aligned with SP 800-53, Rev 5; rephrased to provide more comprehensive detail on and foundational tasks for continuous monitoring; outcome unchanged

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Minor change”. At adoption, Bedrock files this under “Review”.

NIST's Rev. 3 discussion for 03.12.03

Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk-based decisions. Different types of security requirements may require different monitoring frequencies.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.12.3 as written in Rev. 2.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from

Rev. 2 text and objectives: bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.12.03: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]