1. Home
  2. |Insights
  3. |DoD Specifies Implementation Requirements for NIST 800-171 Cyber Standard

DoD Specifies Implementation Requirements for NIST 800-171 Cyber Standard

Client Alert | 2 min read | 05.15.25

The Department of Defense (DoD) has released a memorandum establishing the DoD Organization-Defined Parameters (ODPs) for use in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision (Rev) 3. Currently, DoD’s cybersecurity regimes require government contractors to comply with NIST SP 800-171 Rev. 2. However, the release of this memorandum may indicate DoD’s intention to soon incorporate Rev. 3 into DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 7012) as well as the forthcoming Cybersecurity Maturity Model Certification (CMMC).

NIST SP 800-171 Rev. 3 was released in May 2024. Rev. 3 introduced new controls and control families, increased specificity for certain security requirements, and introduced Organization-Defined Parameters into 800-171. ODPs are “fill-in-the-blanks” to be filled by federal agencies to create tailored requirements for each agency’s specific needs.

DoD’s selected ODPs range from time-based requirements, such as requiring inactive user accounts to be terminated within 24 hours, to specific technical requirements, such as the use of Federal Information Processing Standard (FIPS) validated cryptography. The ODPs will also require flowing down certain protections to subcontracts, through requiring external service providers to meet NIST SP 800-171 Rev 2 and requiring integration of supply chain risk management into procurement policies.

The ODPs will not take immediate effect. Shortly after the release of NIST SP 800-171 Rev. 3, DoD issued a class deviation to clarify that NIST SP 800-171 Rev. 2 would continue to be used for the DFARS 7012 Safeguarding Clause. However, this new memorandum indicates that companies should begin preparing for Rev. 3, as it suggests that DoD is gearing up for Rev. 3 implementation in both the DFARS 7012 and CMMC requirements.

Recommendation

Companies should review the new security requirements and DoD-specific ODPs to determine what technical and administrative revisions would be required to meet these emerging requirements.

Contacts

Insights

Client Alert | 4 min read | 08.07.25

File First, Facts Later? Eleventh Circuit Says That Discovery Can Inform False Claims Act Allegations in Amended Complaints

On July 25, 2025, the Eleventh Circuit Court of Appeals issued its decision in United States ex. rel. Sedona Partners LLC v. Able Moving & Storage Inc. et al., holding that a district court cannot ignore new factual allegations included in an amended complaint filed by a False Claims Act qui tam relator based on the fact that those additional facts were learned in discovery, even while a motion to dismiss for failure to comply with the heightened pleading standard under Federal Rule of Civil Procedure 9(b) is pending.  Under Rule 9(b), allegations of fraud typically must include factual support showing the who, what, where, why, and how of the fraud to survive a defendant’s motion to dismiss.  And while that standard has not changed, Sedona gives room for a relator to file first and seek out discovery in order to amend an otherwise deficient complaint and survive a motion to dismiss, at least in the Eleventh Circuit.  Importantly, however, the Eleventh Circuit clarified that a district court retains the discretion to dismiss a relator’s complaint before or after discovery has begun, meaning that district courts are not required to permit discovery at the pleading stage.  Nevertheless, the Sedona decision is an about-face from precedent in the Eleventh Circuit, and many other circuits, where, historically, facts learned during discovery could not be used to circumvent Rule 9(b) by bolstering a relator’s factual allegations while a motion to dismiss was pending.  While the long-term effects of the decision remain to be seen, in the short term the decision may encourage relators to engage in early discovery in hopes of learning facts that they can use to survive otherwise meritorious motions to dismiss....

View All Insights