Compliance / NIST SP 800-171
Protect Controlled Unclassified Information the way federal agencies expect.
NIST SP 800-171 sets the security requirements for protecting Controlled Unclassified Information (CUI) on systems outside the federal government. It applies to contractors, universities, research organizations and other nonfederal entities that receive CUI from federal agencies, civilian agencies as well as the Department of Defense.
Defense contractors usually meet it through CMMC. For everyone else, we help you scope the systems that hold CUI, close gaps and document compliance in a System Security Plan.
At a glance
- Current version
- Revision 3, published May 2024, with 97 security requirements
- Previous version
- Revision 2, with 110 requirements, still used for CMMC Level 2
- Assessment procedures
- NIST SP 800-171A
- Applies to
- Nonfederal systems that process, store or transmit CUI
NIST SP 800-171
Revision 2 or Revision 3?
Revision 3 reorganized the requirements, withdrew some, combined others and added organization-defined parameters that let agencies set specific values. The count dropped from 110 to 97, but the work did not get smaller.
Which revision applies depends on your contract. The Department of Defense continues to assess CMMC Level 2 against Revision 2, while other agencies may reference Revision 3. We help you read the clause in your agreement and build a program that can move from one to the other without starting over.
How we help
Scoping
Find where CUI lives and keep the boundary tight.
- CUI identification and data flow mapping
- System boundary definition
- Enclave options to reduce scope
- Review of cloud services that handle CUI
Gap assessment
Measure where you stand against the revision that applies to you.
- Assessment using NIST SP 800-171A procedures
- Revision 2 to Revision 3 mapping
- Prioritized remediation roadmap
SSP and POA&M
The two documents every assessment starts with.
- System Security Plan development
- Plan of Action and Milestones
- Policies and procedures
Remediation
Practical fixes that fit your budget.
- Multi-factor authentication and access control
- Logging, monitoring and incident reporting
- Encryption of CUI at rest and in transit
- Configuration and vulnerability management
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
FAQ
Frequently asked questions
We are a defense contractor. Which page should we read?
Start with our CMMC page. CMMC Level 2 is built on NIST SP 800-171 Revision 2 and adds the assessment and affirmation requirements the Department of Defense uses.
Do universities need to comply?
Often, yes. Research agreements that involve CUI commonly require NIST SP 800-171, and the requirements apply to the specific systems and labs that handle that information.
Find out where you stand on NIST SP 800-171.
A readiness review shows what an assessor would find today and what it will take to close the gaps.