What Is NIST SP 800-171? Requirements and Who It Binds

The requirement rarely arrives with an explanation. It shows up as a clause number in a solicitation, or as one line in a purchase order from a prime contractor: 252.204-7012. Behind that line sit 110 security requirements, a score somebody expects you to have already submitted to a government database, and a growing list of companies that paid settlements for saying they had done work they had not done.

The publication itself is free, public and reasonably plain. What trips people up is that it binds nobody. A contract clause does, and the clause and the publication currently point at different versions of the same document.

What Is NIST SP 800-171?

The full title is Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and every part of it narrows the scope. It is about one property, confidentiality. It is about one kind of information, CUI. It is about systems that belong to somebody other than the federal government: your servers, your laptops, your cloud tenant.

The requirements were not invented from scratch. NIST built them by taking the controls in the SP 800-53B moderate baseline and stripping out anything that is primarily the federal government's job, anything not directly related to protecting the confidentiality of CUI, anything already covered by another control, and anything that does not apply. What survives that filter is the standard, and that derivation explains most of its odd edges.

One mix-up is worth clearing early. SP 800-171 is not the NIST Cybersecurity Framework, which is a voluntary structure for organizing a security program around outcomes. SP 800-171 is a list of specific requirements a federal contract can order you to implement and a government assessor can score you against.

What Is Controlled Unclassified Information?

CUI is the category the whole standard exists to protect, and it comes from the executive branch rather than from NIST. The National Archives, which runs the program, defines CUI as information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations and government-wide policies, but that is not classified. Executive Order 13556 created the program and named the National Archives and Records Administration as its executive agent, and the regulation at 32 CFR part 2002 sets the policy for designating, marking, safeguarding, disseminating, decontrolling and disposing of it.

In practice CUI reaches a company as engineering drawings, specifications, technical data, export controlled information or research data. The awkward part is identification: CUI is supposed to be marked, and often it is not, particularly once it has moved down two or three tiers of a supply chain into an email attachment from a prime contractor's engineer.

Do not confuse CUI with Federal Contract Information. FCI is the broader and blander category, defined at FAR 52.204-21 as information not intended for public release that is provided by or generated for the government under a contract, excluding what the government publishes and simple transactional information such as what is needed to process payments. FCI carries the 15 basic safeguarding requirements at paragraph (b)(1)(i) through (xv) of that clause. CUI is what pulls in the full weight of SP 800-171.

Who Has to Comply With NIST 800-171?

Nobody complies with a NIST publication because NIST says so. You comply because a contract says so, and for most companies reading this the contract is a Department of Defense one.

That flow-down paragraph is why the population covered by this standard is so much larger than the population that thinks of itself as a defense contractor. A machine shop that has never spoken to a contracting officer is inside the clause the moment a prime sends it a controlled drawing, which is why manufacturers in the defense supply chain feel this rule more than any other sector.

Outside the Department of Defense, coverage is patchier and changing. Other agencies reference SP 800-171 in their own contracts and grant terms, and there is a proposal to make it uniform: in January 2025 the Department of Defense, the General Services Administration and NASA published a proposed FAR rule under case 2017-016 to implement the CUI program across the Federal Acquisition Regulation, with comments due by March 17, 2025. Until a clause of that kind lands in a civilian agency contract, the practical answer stays simple: read your contract, find the clause, comply with what it names.

What Does NIST 800-171 Require?

Revision 2, the version DoD contracts currently name, contains 110 security requirements in 14 families. The counts below come from the requirement identifiers in the publication itself, not from a summary.

Four requirements do most of the work of turning that list into a program. Requirement 3.5.3 mandates multi-factor authentication for local and network access to privileged accounts and network access to non-privileged accounts. Requirement 3.13.11 requires FIPS-validated cryptography where encryption protects the confidentiality of CUI, which is narrower than "use encryption" and rules out otherwise reasonable tooling. Requirement 3.12.4 requires a system security plan describing system boundaries, environments of operation, how each requirement is implemented and connections to other systems. Requirement 3.12.2 requires plans of action to correct deficiencies.

Notice what is not in the list. The 72-hour reporting obligation is not an SP 800-171 requirement at all; it comes from the DFARS clause. The standard asks at 3.6.1 for an operational incident handling capability covering preparation, detection, analysis, containment, recovery and user response, which one incident response plan usually satisfies alongside the reporting deadline.

NIST 800-171 Rev 2 vs Rev 3

This is where most published guidance goes wrong, because two true statements sit uncomfortably together. NIST has retired Revision 2. Defense contracts still require it.

NIST published Revision 3 in May 2024, alongside the matching assessment procedures in SP 800-171A Revision 3, and withdrew Revision 2 on May 14, 2024. Revision 3 restructures the requirements to align directly with SP 800-53 Revision 5 controls, introduces organization-defined parameters so that an agency or a company can set specific values, and applies new tailoring criteria. Counting the requirement identifiers in chapter 3 and removing the 33 marked as withdrawn leaves 97 requirements across 17 families rather than 14, with Planning, System and Services Acquisition and Supply Chain Risk Management as the additions.

The substance moved as well as the numbering. Multi-factor authentication at 03.05.03 now covers privileged and non-privileged accounts without the "network access" qualifier Revision 2 used, which pulls local logons into scope. Cryptography at 03.13.11 became an organization-defined parameter, so the types are set by whoever sets the parameter rather than fixed in the text. None of that changes what a DoD contract asks for today.

How the NIST 800-171 SPRS Score Works

Defense contractors do not just implement the standard. They grade themselves against it and publish the grade, using the government's arithmetic rather than their own.

The score comes from the NIST SP 800-171 DoD Assessment Methodology. Implement every requirement and you score 110, matching the number of requirements. For each one not met, a weighted value is subtracted, and the methodology is explicit that the result may be negative.

There is no partial credit except where the methodology builds it in, and multi-factor authentication is the notable case. A control that is running on half your systems generally scores as though it were running on none of them.

NIST 800-171 vs CMMC

They are not competing standards. One is the requirement list, the other is the verification program built on top of it.

So the engineering work is the same work. What CMMC adds is proof: a status recorded against your company, a required assessment type that at Level 2 may be a certification assessment by an authorized third party, and an affirming official who signs. A company that genuinely implemented SP 800-171 has already done most of a Level 2 assessment's substance. A company that scored itself generously for five years finds out when somebody else does the scoring.

How to Comply With NIST 800-171

The sequence matters more than the tooling, because the single largest cost driver is how much of your business you drag into scope.

On cost, be skeptical of confident single figures. No published dataset supports them, and the variables that move the number are yours: how much CUI you hold, how many systems touch it, whether you can move to an enclave, and whether the assessment is your own or a third party's.

What Happens If You Are Not Compliant?

There is no fine schedule, no regulator issuing penalties and no inspection regime for this standard. The consequence is contractual and, increasingly, it is a fraud case, because signing a contract that requires SP 800-171 and then invoicing the government is a representation about your systems.

Two settlements published by the Department of Justice show the mechanism. In March 2025, defense contractor MORSECORP agreed to pay $4.6 million to resolve allegations that from January 2018 to February 2023 it had not fully implemented the required controls, that it lacked a consolidated written system security plan for years, and that in January 2021 it submitted a score of 104 when, a consultant later told the company, the real score was negative 142. A whistleblower received $851,000 of the settlement.

In June 2026, an Alabama contractor agreed to pay $507,144 over cybersecurity controls that were not implemented on two Navy contracts between May 2021 and March 2025. The government's assessment scored the company at negative 170, against a possible range that the department describes as negative 203 to 110.

Both cases were brought under the False Claims Act, which carries treble damages and per-claim penalties, and both were resolved without any finding that data had been stolen. The exposure is the claim itself, not the breach.

What NIST 800-171 Does Not Require

Half of a good scoping conversation is knowing where the standard stops.

It does not cover availability. NIST tailored contingency planning out of Revision 3 because that family addresses availability rather than confidentiality, so a program built only to this standard can be fully compliant and still lose a week to ransomware. It does not apply to federal systems, or to systems a contractor operates on the government's behalf. It does not apply to components that never touch CUI, which is the whole argument for a small enclave. And it does not come with a certificate. That last point separates it from a commercial framework such as SOC 2, where an independent firm examines your controls and issues a report you can hand a customer. Here the nearest artifact is a score you calculated about yourself.