Compliance & ContractsFree referencePDF, Excel, Word exportDefense Electronics

NIST SP 800-171 Rev 2 Control Families and Key Requirements Reference

This is a lookup table of the 14 control families in NIST SP 800-171 Revision 2 plus the individual requirements that auditors ask about most. Use it to brief your IT team, map controls to your ERP, or sanity check a system security plan.

Download:

Reference	Type	Family or requirement	Requirements	Where it shows up for a manufacturer
3.1 (AC)	Family	Access Control	22	ERP roles and permissions, shop floor terminals, remote access, mobile devices, wireless
3.2 (AT)	Family	Awareness and Training	3	Security awareness and insider threat training records for ERP and engineering users
3.3 (AU)	Family	Audit and Accountability	9	ERP audit trails, log retention, time stamps, log review
3.4 (CM)	Family	Configuration Management	9	Baselines for servers and CNC controllers, change control, least functionality, software allow lists
3.5 (IA)	Family	Identification and Authentication	11	Unique user IDs, MFA for ERP and VPN, password rules, service accounts
3.6 (IR)	Family	Incident Response	3	Incident handling plan, reporting path, annual testing of the plan
3.7 (MA)	Family	Maintenance	6	Vendor remote support sessions on machines and servers, maintenance tool control
3.8 (MP)	Family	Media Protection	9	USB drives, CNC program transfer media, backup media, CUI marking, sanitization
3.9 (PS)	Family	Personnel Security	2	Screening before access to CUI, access changes at termination or transfer
3.10 (PE)	Family	Physical Protection	6	Badge access to the server room and CUI work areas, visitor escort, access logs
3.11 (RA)	Family	Risk Assessment	3	Periodic risk assessment, vulnerability scanning, remediation of findings
3.12 (CA)	Family	Security Assessment	4	Control assessments, plans of action and milestones, system security plan, continuous monitoring
3.13 (SC)	Family	System and Communications Protection	16	Network segmentation, boundary protection, FIPS-validated cryptography, encryption of CUI at rest
3.14 (SI)	Family	System and Information Integrity	7	Patching, malware protection, security alerts, monitoring of inbound and outbound traffic
3.1.1	Requirement	Limit system access to authorized users, processes and devices	1	Named ERP accounts only, no shared logins on terminals
3.1.2	Requirement	Limit access to the types of transactions and functions authorized users may execute	1	ERP role design, segregation of duties on part and drawing data
3.1.3	Requirement	Control the flow of CUI in accordance with approved authorizations	1	Who can export drawings, BOMs and specs out of the ERP or PLM
3.3.1	Requirement	Create and retain system audit logs to enable monitoring, analysis and reporting	1	ERP and operating system audit logging turned on and retained
3.4.1	Requirement	Establish and maintain baseline configurations and inventories of systems	1	Hardware and software inventory including shop floor PCs
3.5.3	Requirement	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts	1	MFA in front of ERP, VPN and email
3.6.1	Requirement	Establish an operational incident-handling capability	1	Documented preparation, detection, analysis, containment and recovery steps
3.8.3	Requirement	Sanitize or destroy system media containing CUI before disposal or reuse	1	Retired laptops, drives and copier storage
3.9.2	Requirement	Ensure CUI is protected during and after personnel actions such as terminations and transfers	1	Same-day ERP and file share deprovisioning
3.10.1	Requirement	Limit physical access to systems, equipment and operating environments to authorized individuals	1	Locked server room and controlled CUI areas
3.12.2	Requirement	Develop and implement plans of action to correct deficiencies and reduce or eliminate vulnerabilities	1	The POA&M document
3.12.4	Requirement	Develop, document and periodically update system security plans	1	The SSP that describes your CUI boundary and every control
3.13.11	Requirement	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI	1	Encryption modules in VPN, disk encryption and file transfer
3.13.16	Requirement	Protect the confidentiality of CUI at rest	1	Encrypted ERP database volumes and file shares holding drawings
3.14.1	Requirement	Identify, report and correct system flaws in a timely manner	1	Patch cycle for servers, ERP middleware and Windows clients

The 14 family counts add up to 110 requirements in NIST SP 800-171 Revision 2, which is the revision DoD contracts and CMMC Level 2 still use. Revision 3 restructured the catalog into 17 families and 97 requirements, but it is not what a Level 2 assessor scores unless DoD says so. Confirm the revision named in your contract.

Map 800-171 controls to your ERP

Optional: we review ERP roles, audit logging and export paths against the families above and send a short findings list.

Optional. The tool and every export work without this. No spam.

How to use the reference

Type a family name, an abbreviation such as AC or SC, or a requirement number such as 3.5.3 into the search box. Family rows tell you how many requirements sit in that family. Requirement rows give the plain-language intent and the place it usually lands in a manufacturing environment. Export the result to Excel to build a control-to-owner matrix, where each row gets a responsible person, an evidence location and an implementation status.

Why 110 requirements and what 800-171 actually protects

NIST SP 800-171 defines security requirements for protecting Controlled Unclassified Information on systems outside the federal government. DFARS 252.204-7012 requires covered defense contractors to implement it, and CMMC Level 2 assesses the same 110 requirements. The document is about the confidentiality of CUI, so the scope question comes first: which systems store, process or transmit CUI. For many manufacturers that means the ERP, PLM, file shares holding drawings, email and some CNC and inspection computers.

Scope the CUI boundary before scoring any control
Each requirement is assessed through objectives in NIST SP 800-171A
Controls inherited from a cloud provider still need your documentation

ERP angles that auditors probe

Access control and audit logging dominate ERP conversations. Expect questions on how roles are built, whether shared accounts exist on shop floor terminals, whether the ERP audit trail is enabled and retained, and how drawings or BOMs leave the system. Authentication findings are common: MFA gaps on remote access, service accounts with non-expiring passwords, and vendor support accounts. Configuration management also catches shops that run unsupported operating systems on machine-attached PCs.

Common mistakes

Teams copy a template SSP without editing it, treat the family list as the assessment itself, or forget that the plan of action and milestones is limited in what it may contain under CMMC. Another frequent error is scoring a control as implemented because a policy exists, when assessors want evidence that the control operates. Keep the reference as a map, then collect examples, screenshots and records per requirement.

Frequently Asked Questions

How many requirements are in NIST SP 800-171 Rev 2?

Revision 2 contains 110 security requirements across 14 families. The Access Control family is the largest with 22, followed by System and Communications Protection with 16. CMMC Level 2 uses the same 110 requirements.

Does DoD use Revision 2 or Revision 3?

As of this tool, DoD contracts and the CMMC Level 2 program are tied to Revision 2. Revision 3 exists and has 97 requirements in 17 families, but the revision that applies to you is the one named in your contract or in DoD guidance. Check before you re-baseline.

What does the family abbreviation mean?

The two-letter code is the NIST control family, for example AC for Access Control and SC for System and Communications Protection. The requirement numbers use section 3.x.y, where 3.1 is AC, 3.2 is AT, and so on in the order shown in the table.

Is this enough to complete an SSP?

No. It is a map, not the text of the standard. An SSP must describe how each of the 110 requirements is met in your own environment, name the system boundary and reference evidence. Use the official NIST publications for the requirement wording.

If you want these controls mapped against the live roles, logs and exports in your ERP, we can build a read-only review that runs on your own infrastructure. This reference works fully without it.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools