What is NIST SP 800-171?
NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”, turns the federal government’s internal security controls into a shorter set that a private company can implement. Each requirement says what must be true, not which product to buy.
Its companion, NIST SP 800-171A, breaks the 110 requirements into 320 assessment objectives. Those objectives are what an assessor, or you in a self-assessment, actually test.
Who has to comply with NIST SP 800-171?
Any DoD contractor or subcontractor whose contract includes DFARS 252.204-7012 and who stores, processes or sends covered defense information. The clause also requires reporting cyber incidents to DoD within 72 hours and keeping images of affected systems for 90 days. DFARS 252.204-7019 and 7020 add the scored assessment posted in SPRS, and CMMC Level 2 adds the assessment cycle.
Other agencies apply it through their own contract terms, and universities that hold CUI for federal research are often covered too.
The 14 control families and 110 requirements
| Family | Section | Requirements |
|---|---|---|
| Access Control | 3.1 | 22 |
| Awareness and Training | 3.2 | 3 |
| Audit and Accountability | 3.3 | 9 |
| Configuration Management | 3.4 | 9 |
| Identification and Authentication | 3.5 | 11 |
| Incident Response | 3.6 | 3 |
| Maintenance | 3.7 | 6 |
| Media Protection | 3.8 | 9 |
| Personnel Security | 3.9 | 2 |
| Physical Protection | 3.10 | 6 |
| Risk Assessment | 3.11 | 3 |
| Security Assessment | 3.12 | 4 |
| System and Communications Protection | 3.13 | 16 |
| System and Information Integrity | 3.14 | 7 |
| Total | 110 |
Access control, identification and authentication, and system and communications protection hold 49 of the 110 between them. That is where multi-factor authentication, FIPS-validated encryption and network boundary protection sit, and where most of the remediation budget usually goes.
Rev 2 vs Rev 3: which one applies?
NIST published Revision 3 in May 2024. It reorganizes the requirements into 97 across 17 families, adding Planning, System and Services Acquisition, and Supply Chain Risk Management, and it lets agencies set some parameters, such as how often a review happens.
DoD has kept Revision 2 for DFARS 7012 through a class deviation, and the CMMC rule cites Revision 2 by name. So for a defense contract today, you implement and score the 110 requirements of Rev 2. Reading Rev 3 is still worthwhile: it shows where the next contract update is likely to go.
How to scope CUI
The requirements apply to every system component that processes, stores or transmits CUI, and to the components that protect them. Scoping decides how much of the company that is. The DoD Level 2 scoping guide sorts assets into five groups:
- CUI assets: anything that holds or moves CUI. Fully in scope.
- Security protection assets: the firewall, the identity provider, the logging tools that protect CUI assets. In scope.
- Contractor risk managed assets: can reach CUI but are not meant to, and are covered by policy. Documented in the SSP.
- Specialized assets: test equipment, operational technology, government-furnished equipment. Documented, with their own risk treatment.
- Out-of-scope assets: cannot reach CUI at all, separated physically or logically.
Two decisions move the scope more than anything else: whether CUI stays inside an enclave rather than spreading across the whole network, and where email and files live. A cloud service that stores CUI must meet the FedRAMP Moderate baseline or its equivalent under DFARS 7012, which is why many suppliers move CUI to Microsoft 365 GCC High or a dedicated enclave.
The documents you need
- System Security Plan (SSP): the boundary, the environment and how each requirement is met. Requirement 3.12.4.
- Plan of Action and Milestones (POA&M): each open requirement with its fix, owner and date. Requirement 3.12.2.
- Policies and procedures for each family, kept current.
- Evidence: configurations, logs, screenshots, training records and reviews that show each of the 320 objectives is met.
- The scored assessment posted in SPRS. See how the SPRS score works.
With AccuSights: we scope the CUI, recommend an enclave when it shrinks the work, write the SSP and POA&M, and keep the evidence for all 320 objectives current so the next assessment is a review, not a rebuild.