NIST 800-171
NIST SP 800-171 is the US standard for protecting Controlled Unclassified Information (CUI) on non-federal systems. It defines 110 security requirements across 14 families and is required of Department of Defense contractors under DFARS 252.204-7012. It is also the basis of CMMC Level 2.
- Author
- NIST
- Protects
- CUI
- Requirements
- 110 (Rev 2)
- Families
- 14
What is NIST 800-171?
NIST SP 800-171 is a publication from the US National Institute of Standards and Technology titled "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." It defines the security requirements a contractor or other non-federal organisation must meet when Controlled Unclassified Information lives on its systems.
The need is simple: a great deal of sensitive government information sits on systems the government does not own, the laptops, servers, and cloud tenants of its contractors. NIST 800-171 sets a consistent bar for protecting that information wherever it goes. Revision 2 organises 110 requirements into 14 families; Revision 3, published in 2024, updated and restructured them.
"The requirements protect the confidentiality of CUI in nonfederal systems and organizations."
Why it exists and who must comply
NIST 800-171 became a compliance obligation primarily through the defense supply chain, but its reach is widening across the federal government.
The anchor is the DFARS clause 252.204-7012, which requires Department of Defense contractors to safeguard CUI by implementing NIST 800-171 and to report cyber incidents. If your DoD contract involves CUI, this clause flows down to you and your subcontractors.
Compliance therefore reaches far beyond traditional defense primes: manufacturers, IT and managed-service providers, engineering firms, and universities all fall in scope when they handle CUI. Other federal agencies increasingly reference 800-171 as well, so the standard is becoming a baseline for working with the US government, not just the DoD.
The 14 families of requirements
Revision 2 groups its 110 requirements into 14 families. Each family covers a domain of security, and together they describe a baseline for protecting CUI.
The SPRS score
For DoD work, compliance is measured by a number. Using the DoD Assessment Methodology, a contractor scores its implementation of the 110 requirements and posts the result to the Supplier Performance Risk System (SPRS).
You start at 110, meaning every requirement is met, and subtract weighted points for each requirement that is not, so the score can fall well below 110 and even go negative. Because contracting officers check the SPRS score, it has become the de facto headline metric of 800-171 compliance, and improving it is the practical goal of most remediation plans.
A perfect implementation scores 110; each unmet requirement deducts weighted points.
Revision 2, Revision 3, and 800-172
Revision 2 (2020) is the version most contracts and CMMC Level 2 have referenced, with its 110 requirements across 14 families. Revision 3, published by NIST in 2024, updated and restructured the requirements, refined the tailoring, and aligned more closely with the latest 800-53 controls.
Because the transition between revisions takes time to flow into contracts and the DoD program, always confirm which revision your specific contract requires. Separately, NIST SP 800-172 adds enhanced requirements for defending CUI against advanced persistent threats; those enhanced requirements underpin CMMC Level 3.
Check your contract.The revision and the required CMMC level are specified in the contract language, so treat any general statement about "110 requirements" as the Rev 2 baseline and verify against your actual obligation.
How NIST 800-171 relates to CMMC
The two are tightly linked but distinct. NIST 800-171 is the standard, the requirements themselves. CMMC is the certification program that verifies a contractor actually meets them. CMMC Level 2 is built directly on the 110 requirements of 800-171.
For years, DFARS required contractors to implement 800-171 and to self-attest. CMMC adds assessment and, for most CUI contracts, independent third-party certification, closing the verification gap. So the work you do to satisfy 800-171 is the same work that gets you through a CMMC Level 2 assessment. For the certification side, see our guide to CMMC.
How to comply with NIST 800-171
Six steps from CUI discovery to a maintained posture. Scoping the CUI boundary (step 2) is the biggest lever on effort and on your SPRS score.
- 1
Find your CUI
Identify where Controlled Unclassified Information enters, lives, and flows in your environment. The CUI boundary defines the scope of everything that follows.
- 2
Scope the system
Define the in-scope assets and, where possible, segment CUI into an enclave. A tight boundary dramatically reduces the number of systems that must meet all the requirements.
- 3
Assess against the requirements
Evaluate your environment against each of the 110 requirements, mark them met or not met, and identify the gaps. This is also how you calculate your SPRS score.
- 4
Write the System Security Plan
Document how each requirement is met in a System Security Plan (SSP). A current SSP is mandatory and is the reference an assessor or auditor works from.
- 5
Remediate and track a POA&M
Close gaps, and for the ones you cannot close immediately, record a Plan of Action and Milestones with owners and target dates, then drive them to completion.
- 6
Score, report, and maintain
Post your assessment score to SPRS as required, keep the SSP and evidence current, and re-assess after material changes. Compliance is a posture to maintain, not a one-time project.
RiskWatch ships a pre-built NIST 800-171 assessment that calculates your SPRS-aligned score, generates the System Security Plan, tracks POA&M items to closure, and cross-maps to CMMC and the other frameworks you run.
NIST 800-171, answered
The questions contractors ask most when CUI lands in a contract.
What is NIST 800-171?
Who has to comply with NIST 800-171?
How many requirements are in NIST 800-171?
What are the 14 families of NIST 800-171?
What is CUI?
What is an SPRS score?
What is the difference between NIST 800-171 and CMMC?
What is the difference between NIST 800-171 and 800-53?
Turn NIST 800-171 into a scored, tracked plan.
A pre-built 800-171 assessment with SPRS-aligned scoring, a generated System Security Plan, POA&M tracking, and cross-mapping to CMMC. 30-day free trial, no credit card.
No credit card required · 30-day free trial · Cancel anytime