NIST 800-171 R3 03.15.01 Policy and Procedures at a Glance
- Family: 03.15 Planning (PL)
- Requirement ID: 03.15.01 Policy and Procedures
- Assessment Objectives (AOs): Seven (7) total, including the one (1) Organization-Defined Parameters (ODPs) below and six (6) determination statements
- Organization-Defined Parameters (ODPs): One (1), specified by the Department of Defense (DoD) for the Defense Industrial Base (DIB)
- Source NIST 800-53 R5 Controls: AC-01, AT-01, AU-01, CA-01, CM-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PS-01, RA-01, SA-01, SC-01, SI-01, SR-01
- NIST 800-171 R3 Kill Chain Phase: Phase 2a, Implement Governance Practices
Policy and Procedures is the first requirement in the Planning (03.15) family, and it is the documentation backbone that every other requirement leans on. It requires the written policies and procedures that make your security program real rather than improvised. Policy and Procedures (03.15.01) has two (2) parts: develop, document, and disseminate the policies and procedures needed to satisfy the security requirements for protecting Controlled Unclassified Information (CUI), and review and update them on a defined frequency. Per the NIST discussion, policies and procedures contribute to security assurance and should address each family of the CUI security requirements, and procedures describe how policies are implemented and can be directed at the individual or role that is the object of the procedure.
A common difficulty with this requirement is writing policies once, filing them, and never revisiting them. R3 makes review and update an explicit, assessable obligation tied to a frequency, and those objectives are new. Teams also miss that dissemination is separate from documentation: a policy that exists on a server nobody reads does not satisfy the objective that it be disseminated to organizational personnel or roles.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.15.01 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.15.01 Policy and Procedures. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:
- a. Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI.
- b. Review and update policies and procedures [Assignment: organization-defined frequency].
The source controls are AC-01, AT-01, AU-01, CA-01, CM-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PS-01, RA-01, SA-01, SC-01, SI-01, and SR-01 from NIST 800-53, which is the policy control from every family rolled into one requirement. The bracketed assignment in part b is the Organization-Defined Parameter (ODP): the review and update frequency. Per the NIST discussion, policies can be included as part of the organizational security policy or be represented by separate policies that address each family of security requirements, and procedures can be documented in system security plans or in one or more separate documents. You can read the requirement directly at NIST 800-171 R3, 03.15.01 (p. 68).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.15.01?
One (1) value sits inside this requirement. Depending on your contract, your organization may be permitted to define it. Organizations in the DIB subject to CMMC are not, because the DoD has defined it as policy.
The value below comes from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
- ODP[01] (DoD memo identifier 03.15.01.b). the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined. DoD Position: at least every 12 months, or when there are significant incidents or significant changes to risks.
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.15.01?
NIST 800-171A R3 breaks 03.15.01 into seven (7) assessment objectives: one (1) Organization-Defined Parameter (ODP) and six (6) determination statements. These AOs are:
- A.03.15.01.ODP[01]: the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined.
- A.03.15.01.a[01]: policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
- A.03.15.01.a[02]: policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
- A.03.15.01.a[03]: procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
- A.03.15.01.a[04]: procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
- A.03.15.01.b[01]: policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>.
- A.03.15.01.b[02]: policies and procedures are updated <A.03.15.01.ODP[01]: frequency>.
Policies and procedures are split into separate objectives, and each is split again into developing and documenting versus disseminating. If you are a DoD contractor, the ODP is specified. Per the DoD-specified ODP value in ComplianceForge's NIST 800-171 R3 Transition Guide, the review and update frequency (ODP[01]) is at least every twelve (12) months, or when there are significant incidents or significant changes to risks. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.15.01 (p. 89).
Assessment Methods and Objects for NIST 800-171 R3 03.15.01
Examine: security policies and procedures associated with the protection of CUI; audit findings; system security plan.
Interview: personnel with information security responsibilities.
How Does NIST 800-171 R3 03.15.01 Map From NIST 800-171 R2?
03.15.01 maps from elements of NIST 800-171 R2 requirement 3.2.1, the security awareness requirement, which included an objective covering the identification of security policies, standards, and procedures:
- A.03.15.01.a[01] and A.03.15.01.a[03] map directly to R2 3.2.1[b] (policies, standards, and procedures related to the security of the system are identified) and elements of R2 3.9.2[a].
- A.03.15.01.a[02] and A.03.15.01.a[04] map directly to R2 3.2.1[b].
- A.03.15.01.ODP[01], A.03.15.01.b[01], and A.03.15.01.b[02] are net new for R3.
Mapped against the seven (7) AOs, four (4) are direct (minimal effort) and three (3) are net new (significant effort). Developing, documenting, and disseminating policies and procedures carries forward, though it now lives in its own requirement rather than being folded into awareness training. The entirely new work is the review and update cycle: defining the frequency and proving the review and update actually happen. In R2 the family policy controls were assumed rather than directly assessed, so expect an assessor to look at your policy set far more closely under R3.
How Does NIST 800-171 R3 03.15.01 Map to NIST 800-53 R5 and the SCF?
Source Controls in NIST 800-53 R5:
- AC-01
- AT-01
- AU-01
- CA-01
- CM-01
- IA-01
- IR-01
- MA-01
- MP-01
- PE-01
- PL-01
- PS-01
- RA-01
- SA-01
- SC-01
- SI-01
- SR-01
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.15.01 through the following SCF controls:
- GOV-02 Security, Compliance & Resilience Program (SCRP)
- GOV-04 Publishing Security, Compliance & Resilience Documentation
- GOV-04.1 Periodic Review & Update of Security, Compliance & Resilience Program
- GOV-11 Operationalizing Security, Compliance & Resilience Capabilities
- GOV-11.1 Select Controls
- GOV-11.2 Implement Controls
- GOV-11.3 Assess Controls
- GOV-11.4 Authorize Technology Assets, Applications and/or Services (TAAS)
- GOV-11.5 Monitor Controls
- OPS-02 Operations Security
- OPS-04 Standardized Operating Procedures (SOP)
- OPS-05 Service Delivery
- (Business Process Support) Security Operations
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.15.01
The following are issues teams may encounter rather than certainties. They are about the review cycle and dissemination, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Review is now assessable. A.03.15.01.b[01] and b[02] are net new and require review and update at the defined frequency, at least every twelve months for DoD, so a policy set with no revision history leaves these objectives open.
- Dissemination is separate. A.03.15.01.a[02] and a[04] require policies and procedures to reach organizational personnel or roles, so document how and to whom they are distributed.
- Policies and procedures are both required. They are separate objectives, so a policy with no supporting procedure describing how it is implemented is incomplete.
- Cover every family. Per the NIST discussion, policies and procedures should address each family of the CUI security requirements, so a single thin policy will not carry all seventeen source controls.
What Is Reasonable Evidence For NIST 800-171 R3 03.15.01?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.15.01 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.15.01 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-GOV-01 Security, Compliance & Resilience Policies. An appropriately-scoped security, compliance and resilience-focused policies. policies are high-level statements of management intent from an organization's executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes. policies are enforced by standards and further implemented by procedures to establish actionable and accountable requirements.
- E-GOV-01.1 Security, Compliance & Resilience Governance Policy. A security, compliance and resilience governance policy.
- E-GOV-01.10 Continuous Monitoring Policy. A continuous monitoring policy.
- E-GOV-01.11 Cryptographic Protections Policy. A cryptographic protections policy.
- E-GOV-01.12 Data Classification & Handling Policy. A data classification and handling policy.
- E-GOV-01.13 Embedded Technology Policy. A embedded technology policy.
- E-GOV-01.14 Endpoint Security Policy. A endpoint security policy.
- E-GOV-01.15 Human Resources Security Policy. A human resources security policy.
- E-GOV-01.16 Identification & Authentication Policy. A identification and authentication policy.
- E-GOV-01.17 Incident Response Policy. A incident response policy.
- E-GOV-01.18 Information Assurance Policy. A information assurance policy.
- E-GOV-01.19 Maintenance Policy. A maintenance policy.
- E-GOV-01.2 Artificial Intelligence & Autonomous Technologies Policy. A artificial intelligence and autonomous technologies (aat) policy.
- E-GOV-01.20 Mobile Device Management Policy. A mobile device management policy.
- E-GOV-01.21 Network Security Policy. A network security policy.
- E-GOV-01.22 Physical & Environmental Security Policy. A physical and environmental security policy.
- E-GOV-01.23 Data Privacy Policy. A data privacy policy.
- E-GOV-01.24 Project & Resource Management Policy. A project and resource management policy.
- E-GOV-01.25 Quantum Security Policy. A quantum security policy.
- E-GOV-01.26 Risk Management Policy. A risk management policy.
- E-GOV-01.27 Secure Engineering & Architecture Policy. A secure engineering and architecture policy.
- E-GOV-01.28 Security Operations Policy. A security operations policy.
- E-GOV-01.29 Security Awareness & Training Policy. A security awareness and training policy.
- E-GOV-01.3 Asset Management Policy. A asset management policy.
- E-GOV-01.30 Technology Development & Acquisition Policy. A technology development and acquisition policy.
- E-GOV-01.31 Third-Party Management Policy. A third-party management policy.
- E-GOV-01.32 Threat Management Policy. A threat management policy.
- E-GOV-01.33 Vulnerability & Patch Management Policy. A vulnerability and patch management policy.
- E-GOV-01.34 Web Security Policy. A web security policy.
- E-GOV-01.4 Business Continuity & Disaster Recovery Policy. A business continuity and disaster recovery (bc/dr) policy.
- E-GOV-01.5 Capacity & Performance Planning Policy. A capacity and performance planning policy.
- E-GOV-01.6 Change Management Policy. A change management policy.
- E-GOV-01.7 Cloud Security Policy. A cloud security policy.
- E-GOV-01.8 Compliance Policy. A compliance policy.
- E-GOV-01.9 Configuration Management Policy. A configuration management policy.
- E-GOV-02 Cybersecurity & Data Protection Standards. An appropriately-scoped cybersecurity & data protection standards. standards are mandatory requirements regarding processes, actions and configurations. standards are intended to be granular and prescriptive to ensure technology assets, applications and/or services (taas) are designed and operated to include appropriate cybersecurity & data protection protections.
- E-GOV-04 Cybersecurity & Data Protection Procedures. An appropriate appropriately-scoped cybersecurity & data protection procedures. procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. procedures help address the question of how the organization actually operationalizes a policy, standard or control. the result of a procedure is intended to satisfy a specific control. procedures are also commonly referred to as “control activities.”.
- E-GOV-05 Cybersecurity & Data Protection Policies & Standards Reviews. A periodic review process for the organization's cybersecurity & data protection policies and standards to identify necessary updates.
- E-GOV-07 Charter - Cybersecurity Program. A charter to establish and resource the organization's cybersecurity program.
- E-GOV-19 Operationalizing Cybersecurity & Data Protection Practices. Personnel management actions to compel data and/or process owners to operationalize cybersecurity and data protection practices for each technology asset, application and/or service (taas) under their control.
- E-IAO-06 Security Authorization Records. Security authorization decisions (e.g., authorization to operate (ato)) for in-scope technology assets, applications and/or services (taas).
- E-OPS-02 Security Concept of Operations (CONOPS). A security concept of operations (conops) describing how security operations are performed.
- E-TPM-04 Service Level Agreements (SLAs). Third-party service level agreements (slas) to support business operations.
Alongside these, keep the System Security Plan (SSP) narrative for 03.15.01 recording the ODP values you adopted.
Timeline Considerations for NIST 800-171 R3 03.15.01
With four (4) AOs mapping directly and three net new, 03.15.01 is a moderate lift where the review cycle is the gap. A realistic sequence:
- Define the review and update frequency (A.03.15.01.ODP[01], at least every twelve months for DoD).
- Confirm policies exist, are documented, and address each family of security requirements (A.03.15.01.a[01]).
- Confirm procedures exist and describe how the policies are implemented (A.03.15.01.a[03]).
- Disseminate both to the appropriate personnel or roles and document that distribution (A.03.15.01.a[02] and a[04]).
- Establish and run the review and update cycle (A.03.15.01.b[01] and b[02]), the net-new objectives.
- Collect evidence for all seven (7) AOs, including the policy set, distribution records, and revision history.
Frequently Asked Questions About NIST 800-171 R3 03.15.01
What value does the DoD require for the organization-defined parameter in NIST 800-171 R3 03.15.01? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.15.01.b: at least every 12 months, or when there are significant incidents or significant changes to risks.
How many assessment objectives does NIST 800-171 R3 03.15.01 have? NIST 800-171A R3 breaks 03.15.01 into seven (7) assessment objectives: one (1) Organization-Defined Parameters (ODPs) and six (6) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.15.01 come from? AC-01, AT-01, AU-01, CA-01, CM-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PS-01, RA-01, SA-01, SC-01, SI-01, SR-01.
Where does NIST 800-171 R3 03.15.01 sit in the NIST 800-171 R3 Kill Chain? Phase 2a, Implement Governance Practices. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.15.01
03.15.01 Policy and Procedures develops, documents, and disseminates the policies and procedures needed to protect CUI, and reviews and updates them on a defined frequency. It maps from elements of R2 3.2.1 with the develop, document, and disseminate objectives transitioning directly, while the review and update cycle is net new. The recurring problem is a policy binder written once and never touched. Cover every requirement family, get the documents to the people who need them, set the cadence (for DoD, at least every twelve months), and keep a revision history that proves the reviews happened.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
