Yes. Defense contractors should absolutely prepare for NIST SP 800-171 Rev. 3 now.
NIST SP 800-171 Rev 3 was released in 2024 and the US Federal government is already using that version, not Rev 2. Contractors should prepare now, but not at the expense of current CMMC or DFARS obligations. The US Department of Defense (DoD) / Department of War (DoW) has stated that organization scan proactively implement Rev.3, provided they still meet Rev.2requirements for current compliance and assessments. From a GRC perspective, the practical approach is to maintain a Rev.2 baseline while building aRev.3 transition plan.
ComplianceForge NIST 800-171 & CMMCCompliance Documentation: https://complianceforge.com/cybersecurity-templates/nist-800-171-compliance
NIST 800-171 R2 to R3 Transition Guide: https://complianceforge.com/start-here/nist-800-171-cmmc---where-do-i-start/nist-800-171-r3-transition-guide
NIST 800-171 R3 Kill Chain: https://content.complianceforge.com/pdf/kill-chain-overview-nist-800-171-r3.pdf
NIST SP 800-171 Rev. 3: https://csrc.nist.gov/pubs/sp/800/171/r3/final
NIST SP 800-171A Rev. 3: https://csrc.nist.gov/pubs/sp/800/171/a/r3/final
DoD CMMC Alignment to NIST Standards: https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC-AlignmentNIST-Standards.pdf
