The Department of Defense (DoD) has released a new set of guidelines to help organizations prepare for the upcoming rollout of CMMC 3.0 — and now is the time to get familiar with what’s changing.
To begin with, this update introduces Organizational Defined Parameters (ODPs) under NIST SP 800-171 Revision 3. These new parameters signal a shift in how evaluators will assess certain technical and policy controls during your compliance efforts.
Although CMMC 3.0 hasn’t officially launched yet, Certified Third-Party Assessment Organizations (C3PAOs) may begin referencing this guidance at any time. As a result, organizations still operating under Rev 2 may find gaps if they’re not preparing now.
Specifically, here are a few of the more notable updates introduced in the new ODPs:
Identifier Reuse Restrictions: You must avoid reusing usernames and device names within a 10-year window.
Device Auto-Lock Requirements: Devices must lock automatically after a maximum of 15 minutes of inactivity.
At SOCSoter, we’re proactively reviewing all relevant policies and documentation and updating POAMs (Plans of Action & Milestones) to align with this guidance. For clients who haven’t completed domain reviews yet, we’ll incorporate the new ODP requirements into upcoming reviews and configuration updates.
If you’re a defense contractor, subcontractor, or part of the DoD supply chain, now is the time to:
✅ Review current technical policies and compare against Rev 3 controls
✅ Update your compliance roadmap with the new parameters
✅ Reach out to your compliance partner for a domain-specific impact assessment
Need help interpreting how this affects your organization or want to schedule a review? Contact us — our compliance experts are here to guide you through every step.