NIST SP 800-171 Rev. 2
110 Rev. 2 security requirements and 320 assessment objectives. Rev. 3 remains a separate program; conclusions are not copied across revisions.
Assessment preparation in Professional and MSP
Create a scoped program, review requirement descriptions and evidence guidance, link evidence, record workpaper conclusions, assess readiness and export reports. Incident workflows use the selected framework. Free retains its existing ISO assessment limits.
What still requires review
Only explicitly mapped technical checks provide supporting observations. Missing data never means passed. Applicability, scope, parameters, governance evidence and final conclusions require human review. There is no automatic certification or authorization.
C12 is the owner-confirmed working baseline. C31-R1 installation acceptance and signing remain pending; other framework packs remain in development.