NIST 800-171 OPDs In Excel?

Where can I download NIST 800-171 rev 3 ODPs in Excel format? 

In April 2025, the US Department of Defense (DoD) released a memorandum that defines what the DoD expects for Organization Defined Parameters (ODP) when implementing NIST SP 800-171 Rev 3. Unfortunately, the DoD chose to keep those ODP values in PDF format, so it is not the most user friendly approach to help with adoption.

ComplianceForge published the NIST 800-171 R2 To R3 Transition Guide and on page 11, there is a link to download the tables in Excel format, including the ODPs!

AO Level Analysis for NIST 800-171 R3

The R2 to R3 Transition Guide provides an Assessment Objective (AO)-level analysis to address differences for NIST 800-171 R2 to R3:

• Over 1/3 are minimal effort (clear, direct mapping)
• Approximately 1/5 are moderate effort (indirect mapping)
• Approximately 1/2 are significant effort (no clear mapping or new AOs)

This guide also addresses the logical dependencies that exist from "orphaned AOs" that are not in NIST 800-171A R3, but a requirement to demonstrate evidence of due diligence and due care still exists for specific functions (e.g., maintenance operations, roles & responsibilities, inventories, physical security, etc.).

For those organizations needing to upgrade from NIST SP 800-171 R2 to R3, it is worth taking a look at ComplianceForge's NIST 800-171 / CMMC product lineup that already includes coverage for NIST SP 800-171 R3, including the ODPs