3.14.3Act on advisories in Rev. 3

Reworded: 03.14.03 Security Alerts, Advisories, and Directives.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.14.3 Security Alerts & Advisories

Monitor system security alerts and advisories and take action in response.

Assessment objectives · 800-171A

[a] system security alerts and advisories are monitored
[b] actions in response to system security alerts and advisories are taken

Rev. 3 · not adopted 03.14.03 Security Alerts, Advisories, and Directives

a. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis.

b. Generate and disseminate internal system security alerts, advisories, and directives, as necessary.

Determination statements · 800-171A Rev. 3

03.14.03.a system security alerts, advisories, and directives from external organizations are received on an ongoing basis.
03.14.03.b[01] internal security alerts, advisories, and directives are generated, as necessary.
03.14.03.b[02] internal security alerts, advisories, and directives are disseminated, as necessary.

Draws on Rev. 2 3.14.3.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

~~removed in Rev. 3~~ added in Rev. 3

Rev. 2 3.14.3 → Rev. 3 03.14.03 Security Alerts, Advisories, and Directives

~~Monitor~~ Receive system security alerts, advisories, and directives from external organizations on an ongoing basis. Generate and disseminate internal system security alerts, advisories, and ~~take action in response.~~ directives, as necessary.

6 words kept, 5 removed, 20 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

New security requirement title
Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for security alerts, advisories and directives

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.

NIST's Rev. 3 discussion for 03.14.03

There are many publicly available sources of system security alerts and advisories. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) generate security alerts and advisories to maintain situational awareness across the Federal Government and in nonfederal organizations. Software vendors, subscription services, and industry Information Sharing and Analysis Centers (ISACs) may also provide security alerts and advisories. Compliance with security directives is essential due to the critical nature of many of these directives and the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.14.3 as written in Rev. 2.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from

Rev. 2 text and objectives: bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.14.03: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]