NIST SP 800-171 (Revision 3) is the federal baseline of security requirements for protecting Controlled Unclassified Information in nonfederal systems. If you handle CUI, the move now is simple: run a gap assessment, document your System Security Plan and Plan of Action and Milestones, and make sure your Basic Assessment score is current in SPRS if you want DoD contracts.
TL;DR:
- Organizations must document tailored controls and justify each decision, especially for new control families like Planning, System Acquisition, and Supply Chain Risk Management introduced in Revision 3.
- Subcontractors handling Controlled Unclassified Information also require current assessments, making supply chain management critical for compliance.
- Maintaining an active, up-to-date System Security Plan and Plan of Action with regular reviews is essential to avoid gaps that could delay contract awards or lead to non-compliance penalties.
- The assessment process involves starting with a comprehensive gap analysis, prioritizing high-risk controls, and continuously updating documentation to reflect environment changes over time.
- Compliance requires ongoing effort, with organizations encouraged to treat assessment scores as part of a continuous cycle rather than a one-time event, especially regarding supply chain and environmental updates.
Table of Contents
- How many controls and the 17 control families
- What changed in Revision 3 and what it means for your team
- Who has to comply, and what DoD assessments require
- Assessment procedures and the artifacts you need on hand
- A roadmap from gap assessment to a current SPRS score
- Showing contracting officers you have adequate security
- How Total Cyber Solutions supports NIST 800-171 compliance
- Detailed explanation of each control family and examples of specific controls
- Where NIST 800-171 fits with CMMC and ISO 27001
- Waivers and exceptions: what the rules actually allow
- Keeping compliance current after implementation
- Common pitfalls that slow down 800-171 programs
- What actually matters most in this process
- Get help implementing your NIST 800-171 controls
- Sources
- FAQ
How many controls and the 17 control families
SP 800-171 Rev. 3 organizes security requirements into 17 control families, up from 14 in the prior revision, and aligns them to the SP 800-53B moderate baseline. That alignment matters because it pulls 800-171 closer to the language and structure federal agencies already use, which makes cross-mapping easier but adds a few new documentation habits for contractors who never had to think in those terms before.
The families are:
- Access Control
- Awareness and Training
- Audit and Accountability
- Assessment, Authorization, and Monitoring
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical and Environmental Protection
- Planning
- Risk Assessment
- System and Services Acquisition
- System and Communications Protection
- System and Information Integrity
- Supply Chain Risk Management
NIST also publishes spreadsheet and JSON versions of the control catalog alongside SP 800-171r3, which is worth knowing if your team wants to pull the requirements straight into a GRC tool instead of copying them by hand.
What changed in Revision 3 and what it means for your team
Three families are new: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR). The old “Security Assessment” family was renamed and reworked into Assessment, Authorization, and Monitoring, reflecting a broader view of how ongoing oversight should work.
Revision 3 also drops the old basic versus derived requirement split. In its place, NIST introduced Organization-Defined Parameters (ODP), Organizationally Required Controls (ORC), and Not Applicable (NA) designations, which give you more room to tailor requirements to your environment but also put more of the tailoring decision, and its justification, on you.
- New families: Planning, System and Services Acquisition, Supply Chain Risk Management.
- Retired distinction: basic versus derived requirements no longer exists.
- New concepts: ODP, ORC, and NA replace the old binary structure.
For a small or mid-sized contractor, this shows up as more paperwork before anything else changes technically. Someone has to decide, in writing, why a control is not applicable or how a parameter was set, and an assessor will expect that reasoning to hold up.
Pro Tip: Assign one owner per control family early. Splitting Revision 3’s expanded scope across too many hands is how documentation gaps happen.
Who has to comply, and what DoD assessments require
If your business processes, stores, or transmits CUI for a federal contract, and especially one that includes DFARS 252.204-7012, you’re on the hook for 800-171. That clause requires contractors to provide adequate security for covered systems and to report cyber incidents to the Department of Defense, and it flows down to subcontractors who touch the same information.
DoD assessments come in three levels:
- Basic: a contractor self-assessment scored against the requirements, submitted by the company itself.
- Medium: conducted by government personnel, reviewing evidence beyond the self-score.
- High: the most rigorous government-led review, involving deeper technical verification.
Under DFARS 204.7302, contractors need at least a current Basic Assessment posted to SPRS at time of award, and that score is generally treated as valid within a typical currency period defined by regulations, commonly around three years. Miss that window and you risk losing eligibility for new awards, regardless of how strong your actual security posture is.
Assessment procedures and the artifacts you need on hand
SP 800-171A Rev. 3 gives you flexible procedures for testing whether each requirement is actually met, and you can apply them through a self-assessment or bring in a third party. Either way, the procedures tell you what an assessor is going to look for and how deep they’re expected to dig.
- Build your System Security Plan first. It describes your environment, boundaries, and how each control is implemented.
- Maintain a Plan of Action and Milestones for anything not yet fully in place, with realistic dates.
- Map each control to specific evidence: configuration screenshots, policy documents, training logs, log exports.
- Document every ODP decision and the reasoning behind it, since assessors will ask why a parameter was set the way it was.
Pro Tip: Keep your SSP and evidence folder in sync as a living pair. An SSP that describes a control your evidence doesn’t support is worse than no SSP at all.
A roadmap from gap assessment to a current SPRS score
Start with a gap assessment mapped directly to the 17 families and the specific Revision 3 controls inside each one. This tells you where you stand before you commit resources anywhere.
- Run the gap assessment against all 17 families.
- Prioritize fixes: start with access control and incident response since they carry the most exposure, then knock out quick wins, then tackle supply chain risk management tasks that involve vendors.
- Draft the SSP and POA&M with realistic timelines instead of aspirational ones.
- Submit your Basic Assessment score to SPRS once you’re confident in it.
- Set a recurring review cycle so the assessment doesn’t quietly expire.
Common pitfalls worth avoiding:
- Forgetting that subcontractors need current assessments too, not just the prime contractor.
- Under-documenting ODP and tailoring decisions, which leaves assessors guessing.
- Treating the Basic Assessment as a one-time task instead of something that needs refreshing before it ages out.
If your organization also pursues CMMC certification, this same roadmap becomes your foundation, since CMMC’s assessment levels build directly on the 800-171 control set. For contractors specifically navigating the government space, our guidance for government contractor cybersecurity covers practical managed-service options that fit around this roadmap.
Showing contracting officers you have adequate security
When a contracting officer reviews your posture, whether at award time or after an incident, they typically want to see three things: your SSP, a summary of your latest assessment, and your POA&M. Together these tell a story about where you are and what you’re actively fixing.
A reported cyber incident does not automatically disqualify you from future work if you can show documented adequate security under DFARS 252.204-7012. Contracting officers distinguish between a company that had reasonable controls and got hit anyway, and one that never had controls in place at all.
- Keep SSP and POA&M versions dated and archived, not overwritten.
- Store evidence in a format you can hand over quickly, such as exportable logs and signed policy documents.
- Retain records at least through your assessment’s currency window so nothing goes missing before it’s needed again.
How Total Cyber Solutions supports NIST 800-171 compliance
Compliance work is integrated into managed services rather than treated as a separate add-on. That matters for 800-171 because the controls touch nearly every part of your IT environment at once.
- Policy Compliance services help you build the SSP, POA&M, and supporting documentation an assessor expects to see.
- Managed Cybersecurity Services keep monitoring and evidence collection running continuously instead of only before an audit.
- Penetration Testing and Vulnerability Analysis give you documented proof that controls are actually working, not just written down.
If you want a hands-on partner for this work, reach out through our contact form and we’ll walk through where your current setup stands.
Detailed explanation of each control family and examples of specific controls
Each of the 17 families groups related requirements, and a few examples make the structure concrete. Access Control governs who can reach CUI and under what conditions, covering things like limiting system access to authorized users and enforcing least privilege. Audit and Accountability requires you to generate and retain audit logs that let you reconstruct what happened after an event.
Configuration Management requires baseline configurations for systems handling CUI and a documented process for approving changes to them. Identification and Authentication covers how users and devices prove who they are, including multifactor authentication for network access. Incident Response requires an established capability for detecting, reporting, and recovering from security incidents, tied back to the reporting obligations in DFARS 252.204-7012.
The newer families carry their own weight. Planning requires documented rules of behavior and a System Security Plan that ties the whole program together. System and Services Acquisition asks you to build security requirements into how you buy and develop systems, not bolt them on afterward. Supply Chain Risk Management requires identifying and managing risks introduced by vendors and suppliers who touch your CUI environment, a family that barely existed in this form before Revision 3.
Media Protection covers how you handle, store, and eventually destroy media containing CUI, while Physical and Environmental Protection covers who can physically access facilities where CUI lives. Each family reads like its own small program, and together they form the full 800-171 baseline.
Where NIST 800-171 fits with CMMC and ISO 27001
NIST SP 800-171 is the technical backbone that CMMC builds on for DoD contractors. CMMC Level 2 maps directly to the 800-171 control set, meaning the work you do to satisfy 800-171 is largely the same work CMMC certification will require, just verified through a different assessment path depending on the level involved.
ISO 27001 sits in a different relationship. It’s an internationally recognized information security management system standard rather than a CUI-specific control list, so it overlaps with 800-171 in spirit, risk management, access control, incident response, but the two aren’t a one-to-one match. An organization certified to ISO 27001 still needs to walk through 800-171’s specific requirements separately, since ISO’s certification doesn’t substitute for a DoD Basic Assessment or SPRS posting.
For contractors juggling both, the practical approach is to build your management system once, under whichever framework drives your business, and then map 800-171’s 17 families onto it as a compliance layer rather than duplicating the work twice. The overlap saves effort but doesn’t eliminate the need to satisfy each framework’s own documentation and assessment requirements on its own terms.
Waivers and exceptions: what the rules actually allow
Formal waivers from 800-171 requirements are narrow and controlled at the contract or agency level, not something a contractor grants itself. The ODP, ORC, and NA framework introduced in Revision 3 is often mistaken for a waiver system, but it isn’t one. It’s a structured way to document that a control doesn’t apply to your environment or that a parameter has been tailored, and that documentation still has to hold up to assessor scrutiny.
If a contract specifies a shorter assessment currency window than the standard period, that requirement in the solicitation overrides the general rule, which functions less like an exception and more like a contract-specific condition you need to catch when reviewing solicitation language. Outside of contract-specific terms like that, there’s no general mechanism for skipping a required control simply because implementation is difficult or costly. The expectation is that you either implement the control, document why it’s not applicable through the NA designation, or track remediation through your POA&M until it’s addressed.
Keeping compliance current after implementation
Treat your Basic Assessment as the start of a cycle, not the finish line. Organizations that build monitoring into daily operations tend to move through reassessments with far less scrambling than those that let compliance work lapse between audits.
A few habits keep the program alive:
- Review your POA&M monthly and close items on the timeline you committed to, not whenever convenient.
- Re-run configuration and vulnerability checks on a set schedule rather than only before a known audit.
- Update the SSP whenever your environment changes, such as new systems, new vendors, or new remote access paths, instead of waiting for the next full review.
- Refresh your Basic Assessment well before the three-year currency window closes so a lapse never blocks a new award.
Our managed cybersecurity services exist largely because this ongoing piece is where most contractors lose momentum. It’s easier to pass an assessment once than to keep every control functioning the same way six months later without anyone watching.
Common pitfalls that slow down 800-171 programs
The most common failure point isn’t a missing technical control, it’s a documentation gap that makes a working control look unverified. Teams implement multifactor authentication or encrypt data at rest, then never write down how or why, and an assessor has nothing to check against.
Subcontractor flow-down is another frequent miss. Prime contractors sometimes assume their own compliance covers the whole supply chain, but DFARS requirements flow to any subcontractor touching CUI, and a weak link there can jeopardize the prime’s own award eligibility.
Scope creep causes trouble too. Some organizations try to apply 800-171 controls to their entire network when only a defined enclave actually touches CUI, which multiplies the documentation burden for no real security gain. Narrowing the CUI boundary first, then applying full rigor inside it, is usually the faster and cheaper path.
Finally, many teams treat the SSP as a one-time deliverable instead of a living document, which quietly drifts out of sync with reality until an assessment exposes the gap all at once.
What actually matters most in this process
The conventional advice treats 800-171 like a checklist you complete once and file away. That’s the wrong mental model, and Revision 3 makes the gap between checklist thinking and reality more obvious than ever, because the ODP and tailoring framework demands ongoing judgment calls, not a single pass through a form.
The most overrated part of compliance work is the initial gap assessment itself. It matters, but it’s the easy part. The harder, more valuable work is building a habit of keeping the SSP accurate and the POA&M honest month over month, because that’s what actually holds up when a contracting officer or assessor starts asking questions.
If you take one thing from this: prioritize your Supply Chain Risk Management family early, even though it’s new and unfamiliar. Vendors and subcontractors are where flow-down failures quietly sink otherwise solid compliance programs, and Revision 3 finally gives that risk its own formal home in the control set.
— Alden
Get help implementing your NIST 800-171 controls
Building an SSP, closing POA&M items, and keeping a Basic Assessment current takes steady attention most internal IT teams can’t spare on top of daily operations. Total Cyber Solutions offers managed cybersecurity, vCSO guidance, policy compliance support, and vulnerability assessments built around frameworks like NIST 800-171 and CMMC.
Reach out through our contact form to talk through your current gaps and next steps.
Sources
- SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- eCFR :: 48 CFR 204.7302 – Policy. (DFARS 204.7302)
FAQ
How many controls are in NIST 800-171?
Revision 3 organizes security requirements into 17 control families, up from 14 in the previous version. The exact number of individual requirements varies by family, and NIST publishes the full list in spreadsheet and JSON formats alongside the publication.
Who is required to comply with NIST 800-171?
Any contractor or subcontractor that processes, stores, or transmits Controlled Unclassified Information under a federal contract, particularly one invoking DFARS 252.204-7012, must comply. This obligation flows down to subcontractors handling the same information, not just the prime contractor.
Why does the United States need NIST?
NIST develops technical standards, including cybersecurity frameworks like 800-171, that give federal agencies and contractors a consistent way to protect sensitive information across different organizations and systems. Without a shared baseline, each contractor would define “adequate security” differently, making it far harder for agencies to verify protection of Controlled Unclassified Information.
What is NIST 800-171 used for?
NIST SP 800-171 is used to protect Controlled Unclassified Information when it lives in nonfederal systems, such as those run by contractors and subcontractors. It sets the specific security requirements that must be implemented, documented, and assessed, often as a condition of winning or keeping a federal contract.
How do Basic, Medium, and High assessments differ?
A Basic Assessment is a contractor’s own self-assessment score submitted to SPRS, while Medium and High assessments are conducted by government personnel who review deeper evidence. Under DFARS 204.7302, at least a current Basic Assessment is required at time of award, typically valid for up to three years.