NIST 800-171, formally NIST SP 800-171, sets the security requirements for protecting Controlled Unclassified Information (CUI) on nonfederal systems, such as defense contractors’ networks. Revision 3 appeared in May 2024, but DoD’s CMMC rule still applies Revision 2.
What NIST 800-171 covers
The NIST publication page for Revision 3 describes the document as providing federal agencies with recommended security requirements for protecting the confidentiality of CUI when the information is resident in nonfederal systems. Agencies write those requirements into contracts and other agreements, which is how a company outside government ends up bound by them.
The publication is a subset of a larger catalogue. In Revision 3, NIST says the requirements are tailored from SP 800-53 controls, and certain families are left out because of tailoring criteria. Personally identifiable information handling, for example, is dropped because PII is already a category of CUI. A companion document, SP 800-171A, supplies assessment procedures that DoD’s safeguarding page describes as a methodology for assessing the CUI security requirements.
Why defense contractors care
For defense work, the link is contractual. DFARS clause 252.204-7012 states that a covered contractor information system “shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171” in effect when the solicitation is issued, or as the Contracting Officer authorizes. The clause also covers incident reporting, which the guide to defense industrial base cybersecurity walks through.
CMMC builds on the same list. The CMMC program rule says organizations meet Level 2 by meeting all 110 security requirements of NIST SP 800-171 R2. The levels, assessment types and rollout phases are covered in CMMC explained, so this guide stays on the standard itself.
The requirement families
Requirements are grouped into families by topic. Revision 2 uses fourteen families:
- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical Protection
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity
Revision 3 organizes the requirements into 17 families. It keeps the fourteen topics above, renaming Security Assessment as Security Assessment and Monitoring, and adds Planning, System and Services Acquisition, and Supply Chain Risk Management.
Revision 2 and Revision 3 compared
| Revision 2 | Revision 3 | |
|---|---|---|
| Published | February 2020, with updates as of January 28, 2021 | May 2024 |
| Status on NIST’s site | Withdrawn May 14, 2024, superseded by Revision 3 | Current; supersedes Revision 2 |
| Families | 14 | 17 |
| Structure | Basic and derived requirements | Distinction eliminated; organization-defined parameters added |
| Role in the CMMC program rule | Named; 110 requirements apply at Level 2 | “Not currently applicable” |
Source: NIST publication pages for Revision 2 and Revision 3, the change log and family tables in the Revision 3 text, and the CMMC program rule.
What changed in Revision 3
The Revision 3 change log lists the main changes: it eliminated the distinction between basic and derived security requirements, increased the specificity of requirements, grouped requirements where possible, removed outdated and redundant ones, added new ones, and added titles. It also introduced organization-defined parameters, or ODPs, in selected requirements.
ODPs let the agency or the contractor fill in a value, such as how often something is reviewed. NIST states that if a federal agency does not specify a value, the nonfederal organization must assign one to complete the requirement. Once set, the value becomes part of the requirement, which is why two contractors can face different specifics under the same revision.
Which revision applies to a contract
The DFARS clause points to the version in effect when the solicitation is issued, unless the Contracting Officer authorizes another. In the CMMC rulemaking, DoD answered commenters who were confused about the revision: the Office of the Federal Register’s regulations require a rule to specify a revision, and the rule says NIST SP 800-171 Revision 3 “is not currently applicable to this rule.” Contractors should read the clause in the solicitation rather than assume a revision.
System security plans and plans of action
Whatever the revision, documentation is central. The CMMC rule quotes Revision 2 requirement 3.12.4, which says organizations must “develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.” Requirements not yet met are tracked in a plan of action and milestones (POA&M). The same rule allows a Conditional CMMC status at a minimum passing score of 80 percent, and only for permitted requirements.
The SPRS score
DoD’s NIST SP 800-171 DoD Assessment Methodology turns the requirements into a number. A contractor with every requirement implemented scores 110, consistent with the total number of requirements. Each requirement not met subtracts its assigned value, so the score can go negative. Contractors can post a summary-level score and the date they expect to reach 110 in the Supplier Performance Risk System (SPRS).
The methodology has three assessment types: Basic, a contractor’s self-assessment; Medium; and High, the latter two carried out by DoD. It anticipates assessment once every three years for contracts with the 7012 clause, unless program risk or a security-relevant change calls for a different frequency.
Where to follow it in person
Government and industry IT and cybersecurity leaders also meet at the Department of the Air Force’s annual IT and cyberpower event in Montgomery, Alabama. The AFITC conference guide covers its history, audience and where to find official information. The defense cybersecurity guide shows where NIST SP 800-171 sits among the other rules, agencies and careers in the field.
Frequently asked questions
Is NIST 800-171 a law?
No. It is a NIST publication. It binds a contractor when a contract clause such as DFARS 252.204-7012 or a CMMC requirement incorporates it.
Is Revision 2 still in use?
Yes, for CMMC. NIST withdrew Revision 2 on May 14, 2024, but the CMMC program rule specifies Revision 2 and calls Revision 3 not currently applicable.
How many requirements are in Revision 2?
The CMMC rule and DoD’s assessment methodology both treat Revision 2 as 110 requirements, which is why the top SPRS score is 110.
What is the difference between NIST 800-171 and CMMC?
NIST 800-171 is the list of requirements. CMMC is the DoD program that verifies and records whether a contractor meets them. See CMMC explained for the levels.
Photo credits: Jakub Zerdzicki (Pexels License); Nathan Thomas (Pexels License).
