What It Is
800-171 is a focused set of security requirements derived from the NIST SP 800-53 catalog, tailored for one job: protecting Controlled Unclassified Information where it sits outside federal systems - on your network, your endpoints, your Microsoft 365 tenant, your cloud services.
Revision 3 organizes the requirements into 17 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, system and information integrity, and - new in Revision 3 - planning, system and services acquisition, and supply chain risk management.
The requirements are outcomes, not products. "Employ multifactor authentication" does not name a vendor. That makes 800-171 achievable with ordinary, well-run IT - and it means the work is configuration, process, and evidence, not a shopping list.
Who It Applies To
800-171 applies to nonfederal organizations when an agreement makes it apply. The mechanism is contract language, not the data itself:
- DoD prime contractors and their subcontractors and suppliers: DFARS 252.204-7012 requires adequate security per 800-171 on any covered contractor information system, and the clause flows down.
- Manufacturers and engineering firms in the defense supply chain: the largest population by count, because technical data flows down with the work.
- Other federal contractors and grantees: civilian agency contracts and grants increasingly incorporate 800-171 through their own clauses.
- IT providers, MSPs, and cloud services supporting these organizations: the requirements follow the CUI, whoever operates the system it lives on.
Size is not a factor. A five-person machine shop with CUI in email has the same obligations as a prime. If your contract cites 252.204-7012, or a prime flows it down to you, 800-171 is your working standard.
What Information Is Regulated
800-171 protects one thing: Controlled Unclassified Information on nonfederal systems. In a defense environment that typically means:
- Controlled technical information: drawings, specifications, CAD files, and engineering data.
- Export-controlled technical data: where it overlaps with ITAR or EAR scope.
- Covered defense information generally: the broader DFARS definition the clause protects.
- The systems that hold it: email, file shares, endpoints, ERP and PLM platforms, and the identity layer that gates them all.
The scoping decision that matters most is where CUI is allowed to exist. Every system inside that boundary inherits the full requirement set - which is why experienced contractors isolate CUI into a defined enclave instead of letting it sprawl across the whole environment.
Relation to Other Frameworks
800-171 sits in the middle of the defense chain:
- **CUI Program:** defines what CUI is, how it is marked, and how it must be handled - 800-171 is the protection standard the program points to for nonfederal systems.
- **NIST SP 800-53:** the federal control catalog 800-171 was tailored from. Federal systems use the parent catalog; you use the subset written for contractors.
- **DFARS:** clause 252.204-7012 makes 800-171 a contractual obligation and adds cyber incident reporting duties on top.
- **CMMC:** the verification layer. CMMC Level 2 is built on 800-171 - the assessment checks whether the requirements are actually implemented, not just claimed.
- NIST SP 800-171A: the companion assessment guide - the procedures an assessor (or you, in self-assessment) use to determine whether each requirement is met.
Read together: the CUI Program names the data, 800-171 names the controls, DFARS names the obligation, and CMMC names the proof.
IT Requirements
Translated from requirement language into operations, 800-171 expects a contractor environment to have:
- Identity control: multifactor authentication, unique accounts, least privilege, and disciplined account lifecycle - joiners, movers, leavers.
- Managed configuration: documented baselines, patch management, and change control on the systems in scope.
- Boundary and communications protection: firewalls, encrypted transmission, and controlled remote access.
- Logging and accountability: audit records that exist, are protected, and are actually reviewed.
- Incident response: a documented capability to detect, report, and handle incidents - DFARS adds a reporting clock on top.
- Media and physical protection: controlled handling of the drives, devices, and paper that hold CUI.
- Assessment and monitoring: periodic self-assessment against the requirements, with scores and gaps tracked.
- Supply chain awareness: knowing what your own vendors and cloud services touch.
None of this is exotic. It is disciplined IT, documented well enough to survive an assessment.
Why It Matters
For a defense contractor, 800-171 is not a best practice - it is a condition of doing business:
- Contract eligibility: inadequate 800-171 posture can cost you awards or get you removed from a supply chain.
- Self-assessment scores: DFARS 252.204-7019 and -7020 require a current assessment score posted to the Supplier Performance Risk System before award, and give DoD the right to verify it.
- False Claims Act exposure: attesting to security you do not have is a legal risk, not just a technical one - the Department of Justice has pursued contractors on exactly this theory under its Civil Cyber-Fraud Initiative.
- Incident consequences: a breach of covered defense information triggers mandatory reporting to DoD and invites scrutiny of the controls behind it.
The practical risk is the gap between what you attested and what is actually running. Closing that gap is the entire job.
How It Fits Into Cyber Risk Management
800-171 is a strong forcing function for general cyber hygiene. An organization that genuinely meets it has covered most of what cyber insurers ask, most of what enterprise security reviews probe, and the operational core of frameworks like SOC 2 and ISO 27001.
The reverse is also true: if you have already built disciplined identity, logging, and incident response for another framework, your 800-171 gap is usually scoping and evidence - deciding exactly where CUI lives and proving the controls around it.
The Reality
Reality check: the organizations that struggle with 800-171 are rarely missing sophisticated security. They are missing scoping and proof.
CUI has spread across email, personal drives, and unmanaged devices; nobody can say precisely where it is; and the controls that exist are undocumented, so a self-assessment score is a guess. The fix is unglamorous: draw a boundary around CUI, run the environment inside it properly, and write down what you do.
How We Help With NIST SP 800-171 Compliance
Our Cyber Risk & Compliance Gap Assessment helps organizations:
- Comprehensive Compliance & Security Review: evaluate your environment against the requirements that apply to you
- Plain-Language Gap Analysis & Roadmap: see exactly where you stand and what to fix first
- Corrective Action Plan & Progress Tracker (CART): turn findings into tracked, prioritized work
- POA&M (Plan of Action & Milestones): the documented remediation record auditors and contract officers expect
Our assessment scopes where CUI actually lives in your environment, measures you against each 800-171 requirement, and produces the corrective plan - and evidence trail - that an assessment score can stand on.
How to Prepare
Confirm what your contracts require
Read your clauses. DFARS 252.204-7012, flow-down language from primes, and CMMC Level 2 requirements all point at 800-171, but the specifics - self-assessment versus third-party assessment, and which version - come from the contract, not the internet.
Identify and scope your CUI
Work from the CUI Registry and your contract deliverables to decide what you actually hold, then define the boundary: which systems, accounts, and locations CUI is permitted to touch. A tight enclave shrinks everything that follows.
Assess against the requirements
Score your current state against every 800-171 requirement using NIST SP 800-171A as the yardstick. Be honest - the score you post to SPRS is a representation you are accountable for.
Write the SSP and POA&M
Document your System Security Plan describing how each requirement is met, and a Plan of Action & Milestones for every gap, with owners and dates. These two documents are the artifacts every downstream review asks for.
Close gaps by risk and build evidence
Remediate the highest-exposure gaps first - identity, email, endpoints, logging - and collect evidence as you go. Evidence is what turns a claim into a score that survives verification.
Frequently Asked Questions
What is the difference between NIST 800-171 and 800-53?
800-53 is the full federal control catalog, binding on federal agencies and their systems under FISMA. 800-171 is the tailored subset written for one job: protecting CUI on nonfederal systems - your systems. If you are a contractor, 800-171 is your working document; 800-53 is the source it was derived from.
Which version applies to us - Revision 2 or Revision 3?
Revision 3 is the current publication (May 2024). But your contract rules: CMMC Level 2, as codified at 32 CFR Part 170, is built on Revision 2, and DFARS clause language references the version current when it was written. When the publication and the contract differ, the contract wins - confirm which revision your clauses and assessment type actually reference.
Is self-attestation enough, or do we need a third-party assessment?
It depends on the solicitation and the CMMC level assigned to the work. DFARS 252.204-7019/-7020 already require a self-assessment score posted to SPRS before award, and CMMC Level 2 self-assessment is required in covered contracts - third-party certification for Level 2 is tied to CMMC Phase II, currently suspended. Either way, the underlying obligation is the same: implement 800-171 and be able to show it.
What is a System Security Plan and do we really need one?
The System Security Plan (SSP) is the document that describes your system boundary and how each 800-171 requirement is implemented. Yes, you need one - 800-171 expects it, DoD assessments ask for it, and a score without an SSP behind it cannot be substantiated. The companion document is the Plan of Action & Milestones (POA&M), which tracks the gaps you have not closed yet.
We are a small subcontractor. Does this really apply to us?
If CUI or covered defense information reaches your systems, yes. The DFARS clause flows down to subcontractors and suppliers without regard to size, and primes increasingly verify their suppliers' posture. The good news for small shops: a tightly scoped environment - a defined enclave for CUI rather than the whole network - makes compliance proportionate to what you actually handle.
How long does 800-171 compliance take?
The assessment itself typically runs 2 to 4 weeks. Remediation depends on your starting posture and scope - a disciplined environment with a sprawl problem fixes scoping and documentation; an undisciplined one rebuilds identity, patching, and logging. The gap picture tells you which situation you are in.
What does 800-171 compliance cost?
Cost is driven by scope and gaps, not by the publication - the standard itself is free. A tight CUI enclave costs far less to secure and evidence than an entire network. We publish no pricing; you get a firm quote after the assessment establishes your actual gap, and the assessment conversation costs nothing.
Where do we start?
Start with the boundary, not the controls: confirm what your contracts require, identify what CUI you actually hold, and decide where it is allowed to live. Then a gap assessment against the 800-171 requirements produces your SSP, your POA&M, and a prioritized remediation plan - in that order.
Official source
Official source: NIST Computer Security Resource Center
Secondary source: Acquisition.gov, DFARS 252.204-7012
Source verified 2026-09-18
By Joshua Nelson, CXO & Compliance Coach · Last reviewed 2026-09-18