3.4.4Think before you change in Rev. 3
Reworded: 03.04.04 Impact Analyses.
Status as of 2026-09-08
Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.
Side by side
Rev. 2 · in force 3.4.4 Security Impact Analysis
Assessment objectives · 800-171A
- [a] the security impact of changes to the system is analyzed prior to implementation
Rev. 3 · not adopted 03.04.04 Impact Analyses
a. Analyze changes to the system to determine potential security impacts prior to change implementation.
b. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.
Determination statements · 800-171A Rev. 3
- 03.04.04.a changes to the system are analyzed to determine potential security impacts prior to change implementation.
- 03.04.04.b the security requirements for the system continue to be satisfied after the system changes have been implemented.
Draws on Rev. 2 3.4.4.
Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.
Word by word
The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.
removed in Rev. 3 added in Rev. 3
Rev. 2 3.4.4 → Rev. 3 03.04.04 Impact Analyses
6 words kept, 3 removed, 27 added. Rev. 3 statement labels omitted for the comparison.
What NIST says changed
- New security requirement title
- Added part b. to verify the security requirements continue to be satisfied.
- Updated discussion to show relationship to 03.04.03
NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.
NIST's Rev. 3 discussion for 03.04.04
Organizational personnel with security responsibilities conduct impact analyses that include reviewing system security plans, policies, and procedures to understand security requirements; reviewing system design documentation and operational procedures to understand how system changes might affect the security state of the system; reviewing the impacts of system changes on supply chain partners with stakeholders; and determining how potential changes to a system create new risks and the ability to mitigate those risks. Impact analyses also include risk assessments to understand the impacts of changes and determine whether additional security requirements are needed. Changes to the system may affect the safeguards and countermeasures previously implemented. This requirement is related to <a href="#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.04.03">03.04.03</a>. Not all changes to the system are configuration controlled.
What this means for you now
Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.4.4 as written in Rev. 2.
Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.
Where this page's facts come from
- Rev. 2 text and objectives
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Mapping and change class
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Rev. 3 03.04.04
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]