Defense contractors navigating DFARS obligations face a critical reality: NIST SP 800-171 Revision 2 remains the binding standard for protecting Controlled Unclassified Information even after NIST withdrew the publication. Lazarus Alliance audit teams observe that DoD Class Deviation requirements lock in the original 110 controls for all DFARS 252.204-7012 contracts, creating both stability and strategic planning challenges for organizations preparing CMMC Level 2 self-assessments.
NIST 800-171 Rev 2 Retention: DFARS Compliance Audits by Lazarus
