What Is NIST SP 800-171?

NIST SP 800-171 Explained

The publication exists to answer a narrow question: when the federal government hands sensitive but unclassified information to a private company, what must that company do to protect it? Rather than impose the full federal control catalog of NIST SP 800-53, 800-171 tailors it down to the requirements that address confidentiality of CUI in a nonfederal environment. Revision 2, published in early 2020, organizes 110 security requirements into 14 families including access control, audit and accountability, configuration management, identification and authentication, incident response, and system and communications protection.

Each requirement is written as a capability rather than a product. Requirement 3.5.3 calls for multifactor authentication for local and network access to privileged accounts and network access to nonprivileged accounts; it does not name a vendor. This flexibility is genuine but it shifts burden onto the contractor to document how a given implementation satisfies the intent. The System Security Plan is where that mapping lives, and assessors spend most of their time comparing SSP claims against configuration evidence and log output.

DoD scores implementation numerically. Starting from 110, each unimplemented requirement subtracts 1, 3, or 5 points depending on its assessed impact, producing a score that can fall as low as negative 203. That score is posted in the Supplier Performance Risk System under DFARS 252.204-7019 and 7020. Multifactor authentication, FIPS-validated cryptography, and audit logging carry 5-point weights, which is why a company can implement most requirements and still post a badly negative score.

Revision 3, released in May 2024, restructures the document: families expand to 17, some requirements are withdrawn or merged, organization-defined parameters appear throughout, and the total requirement count drops modestly while several requirements become more demanding. Adoption is not automatic - the contractual baseline follows what DFARS and the CMMC rule reference, and DoD has anchored to Revision 2 during the CMMC rollout. Contractors should track which revision their specific contract clause invokes rather than assuming the newest publication governs.

The companion assessment methodology in NIST SP 800-171A defines assessment objectives, and NIST SP 800-172 adds enhanced requirements for defending against advanced persistent threats, which feed CMMC Level 3. A persistent misconception is that 800-171 protects only IT systems. It applies to any system that processes, stores, or transmits CUI, which in a manufacturing environment reaches CNC controllers holding controlled programs, CMM inspection workstations, engineering file servers, and the ERP database itself.