DoD Releases ODPs for NIST SP 800-171 Rev 3: What Does It All Mean?

The DoD has released Organizational-Defined Parameters (ODPs) for NIST SP 800-171 Rev 3. While these updates won’t formally impact CMMC assessments until the next round of rulemaking adopts Rev 3 (CMMC is hard-coded to NIST SP 800-171 revision 2 for the foreseeable future), it’s important to start paying attention — these ODPs will define some of the compliance expectations once adoption occurs and potentially become a reference for CMMC Level 2 compliance.

• 

  John Elliott

  Compliance Solutions Architect

What is an ODP?

An ODP, or Organizational-Defined Parameter, is NIST’s way of allowing Federal agencies to specify their preferred requirements when tailoring NIST standards to their mission needs. They are historically more associated with NIST SP 800-53 r4 & r5. However, when looking at our current 800-171 revision 2 and CMMC Level 2, ODP’s are not explicitly listed. This was on purpose! But as time moved on, there was a realization that tighter alignment between 800-171 and 800-53 was warranted and so came along the third revision to 800-171 last May with 80 Organizational-Defined Parameters.  

And don’t get confused by the words “Organizationally Defined.” That’s not meant to indicate you as the Contractor are “doing the defining” anymore like it has been thus far. The Organization defining the parameters is meant to be the Federal agency defining their mission needs. “Organizationally Defined” has a cascading hierarchy of authority for who gets to define ODPs. If they are not defined by a relevant federal agency such as DoD (when 800-171r3 is specified in a contractual vehicle), then it is up to the nonfederal organization (i.e., the contractor) to define. That was the case for the DIB until this memo. 

This memo is the DoD’s official interpretation and clarification of how specific security requirements eventually need to be implemented and assessed. ODPs provide part of the baseline that assessors will look for during compliance evaluations, ensuring there’s consistency across assessments. In short: ODPs tell you exactly what “right” looks like in the eyes of the DoD. 

Highlights from the newly released ODPs

• AU 3.3.1 [a]: Systems must log a specified minimum set of audit event types. Prior to the DoD Release, Contractors were left with an undefined threshold for success. For example, do audit logs need to include authentication success and failure event types? With the publication of the ODP’s we know 800-171 Rev 3 requires both success and failure events to be logged.  

Let’s look at another example. 

• IA 3.5.1 [b]: Users must re-authenticate after session termination. (And when other certain events take place.) The open question in this requirement asks what conditions are considered a session termination? For example, is my session terminated if my screen locks or after I log off? With the DoD’s guidance we know the requirement is to terminate sessions when credentials change and following the execution of privileged function. 

Bottom line

While these changes don’t immediately impact CMMC 2.0 compliance efforts, organizations should begin familiarizing themselves with these new ODPs and security requirements. This publication should be considered a reference point for organizations planning for CMMC Level 2 compliance.  Stay tuned — we’ll keep you updated as the rulemaking process unfolds.