No one knows. If they say they do, they are lying to you.
The US Department of Defense (DoD) / Department of War (DoW)has not published a final mandatory effective date for contractor assessments against NIST SP 800-171Rev. 3. DoD/DoW's public CMMC alignment briefing states that Rev. 3 will be adopted through future rulemaking. Until that happens, contractors should maintain current Rev. 2 compliance while preparing their documentation, control implementation, SSPs and POA&Ms for Rev. 3. There will also be a transition period, so NIST SP 800-171 Rev 3 will not be immediately required once rulemaking is complete.
ComplianceForge NIST 800-171 & CMMC Compliance Documentation: https://complianceforge.com/cybersecurity-templates/nist-800-171-compliance
NIST 800-171 R2 to R3 Transition Guide: https://complianceforge.com/start-here/nist-800-171-cmmc---where-do-i-start/nist-800-171-r3-transition-guide
NIST 800-171 R3 Kill Chain: https://content.complianceforge.com/pdf/kill-chain-overview-nist-800-171-r3.pdf
NIST SP 800-171 Rev. 3: https://csrc.nist.gov/pubs/sp/800/171/r3/final
NIST SP 800-171A Rev. 3: https://csrc.nist.gov/pubs/sp/800/171/a/r3/final
DoD CMMC Alignment to NISTStandards: https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC-AlignmentNIST-Standards.pdf
32 CFR Part 170 — Cybersecurity Maturity Model Certification Program: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
