NIST/800-171
Overview
- NIST/800-171 is a NIST Special Publication that defines security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations.
- Federal agencies flow these requirements to contractors and other nonfederal organizations through contracts and agreements.
Scope
- Focuses on confidentiality of CUI in nonfederal environments.
- Applies to systems that process, store, or transmit CUI, and to security components that protect those systems.
- Does not replace agency-specific terms in contracts; contract language governs what is required for a given program.
Requirement Families
- Requirements are organized into control families, including:
- Access Control (AC)
- Awareness and Training (AT)
- Audit and Accountability (AU)
- Configuration Management (CM)
- Identification and Authentication (IA)
- Incident Response (IR)
- Media Protection (MP)
- Physical Protection (PE)
- Personnel Security (PS)
- Risk Assessment (RA)
- Security Assessment (CA)
- System and Communications Protection (SC)
- System and Information Integrity (SI)
Typical Implementation Artifacts
- Organizations commonly maintain evidence such as:
- System Security Plan (SSP)
- Plan of Action and Milestones (POA&M)
- policy and procedure documents
- technical configurations and logs
- training and incident-response records
Relationship to CMMC
- The DoD uses CMMC to verify contractor cybersecurity posture for contracts involving federal contract information (FCI) and/or CUI.
- For CUI-focused requirements, CMMC assessments are built around conformance to the NIST 800-171 requirement set specified in DoD rules and contract clauses.
Revisions
- NIST published SP 800-171 Revision 3 in May 2024 (superseding Revision 2).
- Program adoption timing can vary by agency and contract vehicle, so the applicable revision should be confirmed from the actual solicitation and clause set.
Related