What is NIST SP 800-171?
NIST SP 800-171 is the US publication that sets 110 security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems. It is the control set behind CMMC Level 2, so most defence contractors that handle CUI have to meet it.
What it covers
Revision 2 groups its 110 requirements into 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
The requirements are short statements, such as limiting system access to authorised users or using multifactor authentication for privileged accounts. NIST publishes a companion, SP 800-171A, with the assessment procedures and objectives an assessor uses to decide whether each requirement is met.
Who has to meet it
Any contractor whose contract includes DFARS clause 252.204-7012 and who handles CUI on its own systems must implement the requirements. Related clauses require a self-assessment score, calculated with the DoD Assessment Methodology, to be posted in the Supplier Performance Risk System (SPRS). Each requirement is weighted at one, three or five points, and a fully compliant system scores 110.
CMMC is how the DoD checks that it has been done. At Level 2, the contractor must meet all 110 requirements, and for most contracts that handle CUI a C3PAO assesses them. CMMC requirements are being phased into DoD contracts from November 2025.
- System Security Plan. Describes the boundary of the CUI environment and how each requirement is met.
- POA&M. Lists requirements not yet met, with the planned fix and date.
- Evidence. Shows each requirement operating, ready for an assessor to examine.
Revision 2 and Revision 3
NIST published Revision 3 in May 2024. It restructures the requirements to align more closely with SP 800-53, adds families for planning, system and services acquisition, and supply chain risk management, and introduces organisation-defined parameters. Revision 3 counts 97 requirements in 17 families, because several Revision 2 requirements were merged or withdrawn.
CMMC Level 2 is still assessed against Revision 2 and its 110 requirements. Contractors should build to Revision 2 for assessment while watching for DoD guidance on when Revision 3 will apply.
Questions
NIST SP 800-171, answered
Is NIST SP 800-171 a certification?
No. It is a set of requirements. CMMC is the programme that verifies a contractor meets them, through self-assessment or a third-party assessment depending on the level and contract.
Which revision applies for CMMC?
Revision 2, with 110 requirements. Revision 3 was published in May 2024, but CMMC Level 2 assessments still use Revision 2.
Does ISO 27001 or SOC 2 cover NIST SP 800-171?
Partly. Many requirements overlap with ISO 27001 Annex A and the SOC 2 Security criteria, such as access control and logging. CUI-specific requirements, including FIPS-validated encryption and CUI media marking, still need separate work.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them