NIST SP 800-171 Rev. 2

Why does it matter?

For DoD suppliers the withdrawn edition is the operative one. DFARS 252.204-7012 required NIST SP 800-171 to be implemented not later than December 31, 2017, and its paragraph (b)(2)(i) ties each contract to the edition in effect at solicitation. DFARS 252.204-7020 asks for a Basic Assessment, a contractor self-assessment under the NIST SP 800-171 DoD Assessment Methodology, or a High Assessment by Government personnel using SP 800-171A, with scores posted in SPRS against the version assessed. CMMC adds certification: 32 CFR 170.14 sets Level 2 as SP 800-171 R2, DFARS 252.204-7021 defines the Conditional and Final Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC) statuses, and the DFARS CMMC rule took effect on November 10, 2025 with a three-year phase-in.

Key benefits include:

• A defined scope

Sec. 1.1 limits the requirements to system components that process, store or transmit CUI or protect such components, and lets an organization isolate those components in a separate CUI security domain by physical or logical separation.

• A fixed, numbered set

110 requirements numbered 3.1.1 to 3.14.7 across 14 families, each with an informative discussion section drawn from SP 800-53 that does not extend the requirement (Chapter 2).

• Traceable origins

Basic requirements come from FIPS 200 and derived requirements from the SP 800-53 moderate baseline; Appendix D maps every requirement to SP 800-53 and ISO/IEC 27001 controls and Appendix E records each tailoring decision (Sec. 2.2).

• Two documents that decide contracts

The system security plan (3.12.4) and the plan of action (3.12.2); Sec. 3.12.2 notes that agencies may treat both as critical inputs to the decision to process CUI on a nonfederal system or to award a contract.

• An assessment method

SP 800-171A of June 2018 is the publication's assessment part, and DoD's assessment methodology and SPRS scoring are built on this edition (DFARS 252.204-7020).

How does it work?

Chapter 3 organizes the requirements into Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity (Table 1). Requirement 3.1.1, for example, reads: limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). The contingency planning, system and services acquisition and planning families are out of scope, with three exceptions carried into other families: protecting backup confidentiality (from CP-9), the system security plan (from PL-2) and security engineering principles (from SA-8) (footnote 18).

Sec. 2.2 explains the tailoring. Starting from the FIPS 200 requirements and the SP 800-53 moderate baseline, the minimum protection for CUI in federal systems, NIST removed requirements and controls that are uniquely federal, not directly related to protecting the confidentiality of CUI, or expected to be routinely satisfied by nonfederal organizations without specification. Appendix E lists the whole moderate baseline with the symbols NCO, FED, NFO and CUI against each control, and Appendix D maps the basic and derived requirements to SP 800-53 Rev. 4 controls and to ISO/IEC 27001 controls, marking with an asterisk the ISO controls that do not fully satisfy the NIST control; the mappings are informational and impose no extra requirements.

In operation the Security Assessment family drives the program. Organizations periodically assess their controls (3.12.1), develop and implement plans of action to correct deficiencies (3.12.2), monitor controls on an ongoing basis (3.12.3) and develop, document and periodically update system security plans describing system boundaries, environments of operation, how requirements are implemented and connections to other systems (3.12.4). NIST publishes CUI system security plan and plan of action templates with the publication, and the January 28, 2021 errata update is editorial: it moved an existing applicability paragraph earlier in Chapter One and introduced no new technical content or requirements.

Key Elements

• 14 requirement families

Table 1 lists the families, closely aligned with the FIPS 200 minimum security requirements (Sec. 2.2).

• Basic and derived requirements

Basic requirements from FIPS 200; derived requirements from the SP 800-53 moderate baseline; illustrated by Media Protection 3.8.1 to 3.8.9 (Sec. 2.2).

• System security plan

Requirement 3.12.4: boundaries, environments of operation, how requirements are implemented and relationships with other systems; no prescribed format (footnote 28).

• Plan of action

Requirement 3.12.2: how unimplemented requirements will be met and planned mitigations implemented; may be combined with the system security plan in any format.

• Assessment and continuous monitoring

Requirements 3.12.1 and 3.12.3; SP 800-53A for assessment plans and SP 800-137 for continuous monitoring are referenced in the discussions.

• CUI security domain

Sec. 1.1 allows designated components to be isolated by subnetworks, firewalls and information flow control so the requirements apply only where CUI is.

• Appendix D mapping tables

Tables D-1 to D-14 map requirements to SP 800-53 Rev. 4 and ISO/IEC 27001 controls and can be read against the NIST CSF functions.

• Appendix E tailoring criteria

Tables E-1 to E-17 show every moderate baseline control with its tailoring action: NCO, FED, NFO or CUI.

What does it cover?

Rev. 2 applies to components of nonfederal systems that process, store or transmit CUI or provide protection for them, when the nonfederal organization is not acting on behalf of an agency and when no law, regulation or governmentwide policy prescribes specific safeguards for the CUI category in the CUI Registry (Sec. 1.1). Its objective is confidentiality; the CUI regulation does not directly address integrity and availability (Chapter 1). Federal agencies use it in contractual vehicles. For DoD contractors with covered contractor information systems it remains binding through DFARS 252.204-7012, assessed under 252.204-7020 and, as CMMC Level 2 under 32 CFR 170.14, certified under 252.204-7021. Organizations outside the DoD supply chain should expect agencies to cite the current edition, Rev. 3.

What are its objectives?

Sec. 1.1 and Sec. 2.1 give the publication these objectives:

Provide federal agencies with recommended requirements for protecting the confidentiality of CUI resident in nonfederal systems and organizations (Sec. 1.1).

Keep protection consistent whether CUI resides in a federal or a nonfederal system, since the information has the same value in either (Sec. 2.1).

Express the FIPS 200 and SP 800-53 moderate baseline protections in a form nonfederal organizations can implement, without reducing the federal requirements (Chapter 1 and Sec. 2.2).

Let organizations limit scope to the components that handle CUI and use alternative but equally effective measures where a requirement cannot be met (Sec. 1.1 and 2.1).

Give agencies the system security plan and plan of action as inputs to their risk decisions about contracting (3.12.2 discussion).

Support assessment through SP 800-171A and informal mappings to SP 800-53, ISO/IEC 27001 and the NIST CSF (Appendix D).

Framework in Context

The current edition is NIST SP 800-171 Rev. 3 of May 14, 2024, which restructured the requirements into 97 in 17 families with organization-defined parameters. SP 800-171A (June 2018) supplies the assessment procedures for Rev. 2 and is named in 32 CFR 170.14(d) as the CMMC assessment method; SP 800-172 of February 2021 holds the enhanced requirements from which CMMC Level 3 selects 24. The basic requirements trace to FIPS 200 and the derived ones to the SP 800-53 moderate baseline, with Appendix D built on Rev. 4 of that catalog. DFARS 252.204-7012, 7020 and 7021 and 32 CFR 170 make this edition contractual for the defense industrial base.

Common Framework Mappings

Because Rev. 2 is derived from FIPS 200 and the SP 800-53 moderate baseline and ships with mappings to ISO/IEC 27001 and the NIST CSF, the frameworks below are the ones its evidence most often serves.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2