What is NIST SP 800-171?
NIST SP 800-171 sets the security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) when it sits in systems that don’t belong to the US federal government. CUI is government information that needs safeguarding but isn’t classified: technical drawings, export-controlled data and some contract information, for example. The requirements apply to the parts of a system that process, store or transmit CUI, and to the components that protect them.
Revision 3, published on 14 May 2024, superseded Revision 2 (January 2021). It has 97 security requirements in 17 families, drawn from the moderate baseline of NIST SP 800-53 Revision 5. Revision 3 added three families (planning, system and services acquisition, and supply chain risk management) and lets agencies set some parameters, such as how often a review happens. Its companion, SP 800-171A Revision 3, gives the procedures for assessing each requirement.
Who does it apply to?
The publication itself isn’t a law. It becomes binding through contracts and agreements. The best-known route is the US Department of Defense: the DFARS clause 252.204-7012 requires contractors that handle covered defence information to implement SP 800-171, and the Cybersecurity Maturity Model Certification (CMMC) checks it at Level 2. Other agencies use it through their own contract terms.
Which revision applies?
This is the most common point of confusion. NIST’s current version is Revision 3, but defence contracts and CMMC Level 2 are still assessed against Revision 2, with its 110 requirements. Read the clause in your contract and follow the revision it names. Planning the move to Revision 3 is still worthwhile, because most of the work carries over.
How does it relate to other frameworks?
SP 800-171 is a tailored subset of SP 800-53, so organisations already using SP 800-53 or FedRAMP controls will recognise most of it. ISO/IEC 27001 covers similar ground but doesn’t on its own show compliance: assessors look for the specific requirements.
Sources and official references
- SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations — NIST Computer Security Resource Center (official source)
- SP 800-171 Rev. 3 (PDF) — NIST (official source)
- SP 800-171A Rev. 3, Assessing Security Requirements for Controlled Unclassified Information — NIST Computer Security Resource Center (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National Institute of Standards and Technology (NIST).