NIST 800-171: Protecting CUI, Rev 2 vs Rev 3 and DFARS Requirements

NIST 800-171 (NIST Special Publication 800-171) is the security standard US defence contractors must meet to protect Controlled Unclassified Information, or CUI: sensitive government information such as technical drawings, specifications, export-controlled data and contract information that is not classified but still requires protection. If your company builds software, provides IT services or hosts systems for a defence contractor, and CUI flows through your systems, the requirements reach you as a subcontractor.

The standard is also in transition. NIST published Revision 3 in May 2024, but the Department of Defense has kept Revision 2 in force for its contracts through a class deviation, and its CMMC certification program assesses against Revision 2. This guide explains what CUI is, who must comply, the requirement families, Rev 2 versus Rev 3, the DFARS clauses and SPRS scores, how to implement and document the requirements, and how NIST SP 800-171 relates to CMMC, FedRAMP and SP 800-53.

What is NIST SP 800-171?

SP 800-171 provides recommended security requirements for protecting the confidentiality of CUI when it resides in nonfederal systems and organisations. It was derived from the moderate baseline of NIST SP 800-53, removing controls that are uniquely federal and tailoring the rest for contractors. A companion, SP 800-171A, gives assessment procedures, and SP 800-172 adds enhanced requirements for CUI associated with critical programmes or high-value assets.

What is CUI?

CUI is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. The executive branch CUI programme is governed by 32 CFR Part 2002 and the CUI Registry maintained by the National Archives, which lists categories such as controlled technical information, export controlled information, privacy information and procurement information. In DoD contracts, "covered defense information" includes CUI provided to or developed by the contractor in support of the contract.

History and why it was introduced

Before 2015, protections for sensitive unclassified information in contractor systems were inconsistent, while adversaries targeted defence supply chains to steal technical data. Executive Order 13556 (2010) established the CUI programme to standardise handling across agencies. NIST published SP 800-171 in June 2015 to give contractors a single set of requirements. The Department of Defense (also styled the Department of War since 2025) required it through DFARS 252.204-7012 with a compliance date of 31 December 2017. Revision 2 (2020) made editorial updates. Revision 3, published on 14 May 2024, restructured the requirements to align more closely with SP 800-53 Revision 5.

Because self-attestation proved unreliable, the DoD added assessment scoring in 2020 and later the CMMC programme to verify implementation.

Who must comply?

• DoD contractors and subcontractors whose contracts include DFARS 252.204-7012 and who process, store or transmit covered defence information on their information systems.
• Subcontractors at every tier, because the clause must be flowed down when subcontract performance involves covered defence information.
• Contractors of other federal agencies whose contracts require SP 800-171 for CUI. A proposed FAR rule on CUI would extend standard requirements across civilian agencies; check its status.
• IT and software providers to defence contractors, such as managed service providers, software developers with access to CUI, and cloud services storing CUI. Cloud services used to store, process or transmit covered defence information must meet security requirements equivalent to the FedRAMP Moderate baseline under DFARS 7012.

Companies outside the United States can be in scope as subcontractors in the DoD supply chain.

Rev 2 vs Rev 3

	Revision 2	Revision 3
Published	February 2020 (with updates)	May 2024
Structure	110 requirements in 14 families	97 requirements in 17 families
New families		Planning, System and Services Acquisition, Supply Chain Risk Management
Parameters	Fixed wording	Organisation-defined parameters (ODPs), some of which agencies may set
Status for DoD	Required under DFARS through a class deviation; basis of CMMC Level 2	Not yet required for DoD contracts or CMMC assessments at our last review

In May 2024, the DoD issued a class deviation directing contracting officers to require Revision 2 rather than the latest version until further notice, and the CMMC rules reference Revision 2. Contractors should implement Revision 2 for DoD compliance and can use Revision 3 to plan ahead. Check the current DFARS deviation before relying on this, because DoD has signalled an eventual move to Revision 3.

The requirement families

Revision 2's 14 families are: Access Control (22 requirements), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16) and System and Information Integrity (7). Revision 3 adds Planning, System and Services Acquisition and Supply Chain Risk Management.

Requirements contractors find hardest

• Multi-factor authentication for local and network access to privileged accounts and network access to non-privileged accounts (3.5.3).
• FIPS-validated cryptography when cryptography protects the confidentiality of CUI (3.13.11).
• Audit logging: creating and retaining logs, reviewing and correlating them, and protecting them (3.3.x).
• Configuration baselines and least functionality (3.4.x), including controlling software that runs.
• Incident response capability including tracking, documenting and reporting (3.6.x).
• Boundary protection and network segmentation (3.13.1, 3.13.5).
• Media protection and sanitisation (3.8.x), including mobile devices and removable media.
• Security assessments and a system security plan (3.12.x).

DFARS clauses, incident reporting and SPRS

• DFARS 252.204-7012 requires adequate security (implementing SP 800-171), rapid reporting of cyber incidents affecting covered defence information to the DoD within 72 hours of discovery through the DoD's reporting portal, preservation of images of affected systems for 90 days, submission of malicious software, and flow-down to subcontractors. It also sets the FedRAMP Moderate equivalency requirement for cloud services.
• DFARS 252.204-7019 and 7020 require contractors to have a current NIST SP 800-171 DoD Assessment, with the summary score posted in the Supplier Performance Risk System (SPRS), and to allow DoD to perform assessments. The DoD Assessment Methodology scores from a maximum of 110, subtracting weighted points for each unmet requirement.
• DFARS 252.204-7021 implements CMMC requirements in contracts as the programme phases in.

How to implement NIST SP 800-171 step by step

1. Find your CUI: which contracts involve CUI, what information, where it enters, where it is stored and processed, and who uses it.
2. Scope the environment: an enclave or segregated environment for CUI often reduces cost compared with applying all requirements across the company.
3. Choose compliant cloud services: FedRAMP Moderate authorised or equivalent services for CUI, and government-community cloud offerings where needed.
4. Assess against Revision 2 using SP 800-171A procedures and the DoD Assessment Methodology.
5. Write the system security plan describing the boundary and how each requirement is met.
6. Write a plan of action for unmet requirements, with dates.
7. Implement MFA, FIPS-validated encryption, logging, configuration baselines, access controls, incident response and media protection.
8. Post your SPRS score and keep it current.
9. Track CMMC: Phase 1 self-assessments apply, and Phase 2 third-party certification is suspended pending review, so keep evidence ready for whichever verification the department settles on.
10. Flow down requirements to your own subcontractors who will handle CUI.

When your software product handles CUI

Software vendors meet SP 800-171 in two different ways, and it is worth being clear which applies:

• Your company handles CUI, for example because developers receive CUI specifications or support staff access customer systems containing CUI. Then your own environment, or an enclave within it, must meet the requirements, and the DFARS clause will be flowed down to you.
• Your product is used by contractors to handle CUI, but you never see the data. Then your customers must ensure the product can be operated in a compliant way. If it is a cloud service storing their CUI, it must meet FedRAMP Moderate or equivalent requirements. If it is installed in their environment, they will ask whether it supports MFA, FIPS-validated encryption, audit logging, session controls and secure configuration.

For vendors in the second group, the practical work is product capability: integration with customers' identity providers and MFA, configurable session timeouts and lockout, detailed audit logs that can be exported to a SIEM, encryption using validated modules, role-based access with least privilege, and documentation that maps product features to SP 800-171 requirements. A clear mapping document saves every customer from working it out themselves and shortens defence sector sales.

Documentation required

• System security plan (3.12.4 in Rev 2).
• Plan of action for deficiencies (3.12.2).
• Policies and procedures covering each family.
• CUI data flow diagrams and asset inventory for the boundary.
• Configuration baselines and change records.
• Audit log retention and review records.
• Incident response plan, tests and incident reports.
• Training records.
• Self-assessment results and SPRS submission records.
• Cloud provider FedRAMP documentation or equivalency evidence.

Assessment and verification

NIST does not certify compliance. DoD contractors complete a Basic (self) Assessment and post the score in SPRS; DoD may conduct Medium or High assessments. CMMC was designed to add verification through Level 2 self-assessments or certification by an authorised third-party assessment organisation (C3PAO). Phase 1 (self-assessments) has applied since November 2025, but the department suspended Phase 2 in July 2026 pending a programme review, and a September 2026 class deviation removed third-party assessment requirements from solicitations while keeping the baseline DFARS obligations, including SP 800-171 and SPRS scores. See the CMMC guide for the current status.

Timeline and cost considerations

The time to implement depends on scope, starting maturity and whether an enclave can limit the boundary. Common cost drivers are compliant cloud services (often government-community offerings), MFA and identity tooling, FIPS-validated encryption, logging and SIEM, endpoint management, documentation, consultants, and assessments. Small subcontractors often find that a well-designed enclave with a managed service provider is more affordable than company-wide implementation.

Benefits and consequences of non-compliance

Compliance keeps contractors eligible for DoD work, protects valuable technical data, and positions them for CMMC. The controls also reduce general cyber risk.

Consequences include losing contract eligibility, contract remedies, and liability under the False Claims Act for misrepresenting compliance. The Department of Justice's Civil Cyber-Fraud Initiative has produced settlements with contractors over alleged failures to meet DFARS cybersecurity requirements, and inaccurate SPRS scores are a common theme.

Common mistakes and challenges for IT companies

• Not knowing where CUI is, so scope keeps expanding.
• Using commercial cloud services that are not FedRAMP Moderate equivalent for CUI, including email and file sharing.
• Non-validated encryption modules.
• Inflated SPRS scores not supported by the system security plan.
• Missing flow-down to subcontractors and IT providers.
• Implementing Revision 3 wording while DoD contracts still assess Revision 2.

Best practices, tools and technologies

• Build a CUI enclave with dedicated identity, devices and cloud tenancy.
• Use FedRAMP Moderate (or High) authorised cloud services and keep evidence.
• Enforce phishing-resistant MFA and conditional access.
• Centralise logs with alerting and retention, and review them on a schedule.
• Manage endpoints and configurations with baselines and drift detection.
• Label CUI and train staff on handling and marking.

We help clients build and maintain applications and hosting within defined security boundaries through our support plans and migrations.

How NIST SP 800-171 relates to other frameworks

Framework	Relationship
CMMC	Verifies SP 800-171; Level 2 equals the 110 Revision 2 requirements.
NIST SP 800-53	Source catalogue from which SP 800-171 is derived.
FedRAMP	Cloud services storing CUI must meet FedRAMP Moderate or equivalent under DFARS 7012.
FISMA	Covers federal systems; SP 800-171 covers contractors' own systems.
ISO/IEC 27001	Useful management system, but does not satisfy SP 800-171 on its own.

Real-world implementation examples

Public settlements announced by the Department of Justice under its Civil Cyber-Fraud Initiative have involved contractors accused of misrepresenting their implementation of SP 800-171 or using non-compliant cloud services for covered defence information. These cases show that documentation and honest scoring matter as much as technology.

An illustrative case for a small software subcontractor: it receives technical drawings marked as CUI from a prime contractor. Instead of securing its entire company, it creates an enclave on a government-community cloud tenant with dedicated laptops, MFA and logging, writes a system security plan, honestly scores itself in SPRS with a plan of action, and closes the remaining gaps on the dates in its plan, so it is ready whatever form CMMC verification takes after the department's review.

Next steps

1. Identify CUI in your contracts and systems.
2. Decide on an enclave or company-wide scope.
3. Self-assess against Revision 2 and post an accurate SPRS score.
4. Close gaps in MFA, encryption, logging and configuration.
5. Keep CMMC evidence ready while the department completes its review of the programme.

Frequently asked questions

Is NIST 800-171 mandatory?

When a federal contract requires it, yes. DoD contracts with DFARS 252.204-7012 require it for contractors handling covered defence information.

Which revision of NIST 800-171 applies to DoD contracts?

Revision 2, under a DoD class deviation, and CMMC Level 2 is based on Revision 2. Revision 3 is current at NIST but not yet required by DoD at our last review.

How many requirements are in NIST 800-171?

Revision 2 has 110 requirements in 14 families. Revision 3 has 97 requirements in 17 families.

What is an SPRS score?

The summary score from a NIST SP 800-171 DoD Assessment, posted in the Supplier Performance Risk System, ranging up to a maximum of 110.

Can we use commercial cloud services for CUI?

Only services that meet FedRAMP Moderate baseline or equivalent requirements, as DFARS 7012 requires for covered defence information.

Does NIST 800-171 require MFA?

Yes, for privileged accounts and for network access to non-privileged accounts.

What is the difference between NIST 800-171 and CMMC?

SP 800-171 is the set of security requirements. CMMC is the DoD programme that verifies contractors have implemented them, through self-assessments or third-party certification.

How quickly must incidents be reported?

DFARS 252.204-7012 requires reporting cyber incidents affecting covered defence information to DoD within 72 hours of discovery.

Does NIST 800-171 apply to non-US companies?

It can, when they are subcontractors in the DoD supply chain handling covered defence information.

What is a CUI enclave?

A segregated environment, with its own identities, devices, network and cloud services, where all CUI work happens. It limits the systems that must meet the requirements and is often the most cost-effective approach for small and mid-sized contractors.

What is a system security plan?

A document describing the system boundary, environment and how each requirement is implemented, required by SP 800-171 and central to any assessment.