NIST SP 800-171: Protecting Controlled Unclassified Information
NIST SP 800-171 specifies security requirements for protecting Controlled Unclassified Information (CUI) when it resides in nonfederal systems and organizations. It is the foundational standard for any company that handles CUI as part of government contracts, particularly within the Department of Defense supply chain.
What NIST 800-171 Covers
The standard defines 110 security requirements derived from NIST SP 800-53 Moderate baseline controls, organized into 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.
Revision 3 aligned the requirements more closely with NIST SP 800-53 Rev 5 and introduced organization-defined parameters that allow tailoring to specific contexts.
Who Needs NIST 800-171
Any organization that processes, stores, or transmits CUI under a federal contract must comply with NIST 800-171. This affects hundreds of thousands of companies in the defense industrial base, including small machine shops, software developers, engineering firms, and research institutions.
DFARS clause 252.204-7012 makes compliance a contractual requirement for defense contractors. Non-defense agencies are increasingly including similar requirements in their contracts as well.
Relationship to CMMC
The Cybersecurity Maturity Model Certification (CMMC) program uses NIST 800-171 as its foundation. CMMC Level 2 directly maps to all 110 NIST 800-171 requirements. The key difference is verification — while NIST 800-171 historically relied on self-assessment, CMMC introduces third-party certification for certain contract levels.
Implementation Approach
- Identify CUI — Determine what CUI you handle and where it flows in your environment
- Scope your boundary — Define the systems and networks that process CUI
- Gap assessment — Compare current controls against all 110 requirements
- Create a System Security Plan (SSP) — Document how each requirement is met
- Develop a Plan of Action and Milestones (POA&M) — Address gaps with timelines
- Implement controls — Deploy technical and procedural safeguards
- Conduct self-assessment — Score your implementation using the NIST 800-171 DoD Assessment Methodology
- Submit score to SPRS — Report your score to the Supplier Performance Risk System