NIST 800-171 R3

NIST 800-171 Rev 3 was released on 14 May of this year, and it contains significant changes from the NIST 800-171 Rev 2.

ComplianceForge has gone ahead updated its NIST Compliance Program (NCP) to include NIST 800-171 Rev 3. What makes the NCP great is that it makes it less painful to upgrade to the latest version of NIST 800-171 and also provides backwards compatibility with NIST 800-171 Rev 2. This is beneficial, since you can demonstrate coverage for the current version of NIST 800-171 Rev 2, while you implement the new controls from NIST 800-171 Rev 3.

https://complianceforge.com/product/nist-800-171-compliance-program/

ComplianceForge is focused on making the documentation side of the NIST SP 800-171 R3 upgrade as painless, as possible. We already have policies, standards and procedures to address all of the requirements for the initial public draft of NIST SP 800-171 R3, so our solutions will be available as soon as the final release of NIST 800-171 R3 is available.

Complying with NIST SP 800-171 & CMMC can be hard enough without arguing over terminology. Terminology pertaining to cybersecurity documentation is often abused, so a simplified concept of the hierarchical nature of cybersecurity documentation is needed to demonstrate the unique nature of these components, as well as the dependencies that exist.

ComplianceForge created a reference model that is designed to encourage clear communication by defining cybersecurity documentation components and how those are linked. This model is based on industry-recognized terminology from NIST, ISO, ISACA and AICPA to addresses the inter-connectivity of policies, control objectives, standards, guidelines, controls, assessment objectives, risks, threats, procedures & metrics. This also addresses what SSPs, POA&Ms and secure configurations are and how those integrate into an organization's existing cybersecurity documentation.

There is a lot of discussion on the initial public draft of NIST SP 800-171 R3 about operational impacts in a transition from -171 R2. Overall, the changes are positive, but there is still change that companies have to address. For those who want a head start, our NIST 800-171 Compliance Program (NCP) solution comes with a year of updates, so when NIST SP 800-171 R3 is released in its final version, those clients will get updated versions of the documentation (with errata as to what has changed). This process helps streamline the documentation management process, so it is clear what has changed and makes it easier to go through change control processes to update documentation.

• NIST 800-171 R3 policies, standards procedures
• NIST 800-161-based Supply Chain Risk Management Plan (SCRM Plan)
• SSP & POA&M Templates
• Risk Assessment Templates
• And More!