SecurityUSA

NIST SP 800-171

Build a clear record of how you protect CUI

Connect scoped CUI requirements with owners, implementation evidence and remediation work.

Full title
NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
Issued by
National Institute of Standards and Technology (NIST)
Published
May 2024, superseding Revision 2. Assessment procedures in SP 800-171A Revision 3, also May 2024.
Applies to
Nonfederal organisations that process, store or transmit US federal Controlled Unclassified Information, when required by contract or agreement
Nature
Mandatory only where a US federal contract or agreement requires it. NIST does not certify or assess organisations.
Structure
97 security requirements in 17 families, with organisation-defined parameters

Overview

What SP 800-171 is

NIST SP 800-171 sets security requirements for protecting the confidentiality of Controlled Unclassified Information, or CUI, when it sits in systems run by organisations outside the US federal government. CUI is information the government creates or owns that needs safeguarding under law, regulation or government-wide policy but is not classified. Typical holders are defence and civilian agency contractors, universities and research bodies.

The requirements are derived from the moderate baseline of NIST SP 800-53 Revision 5, tailored to remove controls that are mainly the government’s responsibility, not directly about confidentiality, covered elsewhere, or not applicable. Revision 3 assumes that the confidentiality impact of CUI is at least moderate. Families such as Contingency Planning, Program Management and PII Processing and Transparency are not included.

Revision 3 restructured the publication. It merged the old basic and derived requirements into one set, aligned the wording with SP 800-53 Revision 5, and added three families: Planning, System and Services Acquisition, and Supply Chain Risk Management. Security Assessment became Security Assessment and Monitoring. The result is 97 requirements in 17 families. Many requirements now include organisation-defined parameters, values such as review frequencies that the federal agency, or failing that the organisation, must set.

Which revision an organisation must meet depends on its contract or agreement, not on what NIST has most recently published. US Department of Defense contract clauses and the CMMC programme set their own version references, which have not moved automatically to Revision 3. Contractors should check the revision named in their contract and the current rules of the agency concerned.

Who it applies to

SP 800-171 applies when a US federal agency requires it through a contract, grant or other agreement. This commonly affects:

  • Defence industrial base contractors and their subcontractors handling CUI
  • Civilian agency contractors that receive or generate CUI
  • Universities and research institutions working under federal agreements
  • Managed service and cloud providers whose systems store or process a contractor’s CUI
  • Non-US suppliers in a US federal supply chain that handle CUI

Requirements apply only to the system components that process, store or transmit CUI, or that protect those components. Defining that boundary carefully is one of the most important decisions in the programme.

Structure

How the requirements are organised

Seventeen families numbered 03.01 to 03.17, grouped here by theme. Withdrawn requirement numbers are kept in the document so that references remain stable.

03.01, 03.05

Access and identity

03.01 Access Control
Account management, access enforcement, information flow, separation of duties, least privilege, unsuccessful logon attempts, session lock and termination, remote and wireless access, mobile devices and publicly accessible content.
03.05 Identification and Authentication
Identifying and authenticating users and devices, multi-factor authentication, replay-resistant authentication, identifier and password management, and re-authentication.
03.02, 03.09

People

03.02 Awareness and Training
Security literacy training and awareness, and role-based training, at a frequency the organisation defines.
03.09 Personnel Security
Screening individuals before access to CUI, and protecting CUI when people leave or move.
03.03, 03.06

Logging and incident response

03.03 Audit and Accountability
Event logging, content of audit records, response to logging failures, review, analysis and reporting, time stamps, and protection of audit information.
03.06 Incident Response
Incident handling, monitoring and reporting, testing of the capability, training, and an incident response plan.
03.04, 03.07, 03.08

Configuration, maintenance and media

03.04 Configuration Management
Baseline configuration, configuration settings, change control and impact analysis, least functionality, authorised software, component inventory and information location.
03.07 Maintenance
Maintenance tools, nonlocal maintenance and maintenance personnel.
03.08 Media Protection
Media storage, access, sanitisation, marking, transport, use, and protection of system backups.
03.10, 03.13, 03.14

Physical, communications and system integrity

03.10 Physical Protection
Physical access authorisations and control, monitoring of physical access, alternate work sites and physical protection of transmission lines.
03.13 System and Communications Protection
Boundary protection, separation of user and system functions, transmission confidentiality, network disconnect, cryptographic key management, cryptography and collaborative devices.
03.14 System and Information Integrity
Flaw remediation, malicious code protection, security alerts and advisories, system monitoring and information management and retention.
03.11, 03.12

Risk and assessment

03.11 Risk Assessment
Assessing risk, vulnerability monitoring and scanning, and risk response.
03.12 Security Assessment and Monitoring
Assessing the requirements, plans of action and milestones, continuous monitoring and controlled information exchange.
03.15 to 03.17

New families in Revision 3

03.15 Planning
Policy and procedures, a system security plan describing the boundary and how requirements are met, and rules of behaviour.
03.16 System and Services Acquisition
Security engineering principles, unsupported system components and external system services.
03.17 Supply Chain Risk Management
A supply chain risk management plan, acquisition strategies, tools and methods, and supply chain requirements and processes.
Companions

Parameters, assessment and related publications

Organisation-defined parameters
Assignment and selection values within requirements. NIST does not set them. The agency may specify them, otherwise the organisation must.
SP 800-171A Revision 3
Assessment procedures using examine, interview and test methods, with determination statements for each requirement.
SP 800-172
Enhanced requirements for CUI associated with critical programmes or high value assets, applied when an agency specifies them.

Implementation roadmap

How to implement it, step by step

A practical route to implementing Revision 3, or preparing for an agency’s chosen revision.

  1. 1

    Confirm the obligation and revision

    Read the contract or agreement to confirm that SP 800-171 applies and which revision is named. Note any parameter values the agency has specified.

    OutputsObligation noteRevision and parameter list
  2. 2

    Find the CUI and define the boundary

    Identify what CUI is received or created, where it flows and which system components process, store, transmit or protect it.

    OutputsCUI inventorySystem boundary diagram
  3. 3

    Set the organisation-defined parameters

    Assign values for every parameter not set by the agency, such as review frequencies and time periods, and record them.

    OutputsParameter register
  4. 4

    Write the system security plan

    Describe the boundary, the environment and how each of the 97 requirements is met, including those inherited from cloud or managed service providers.

    OutputsSystem security plan
  5. 5

    Assess against SP 800-171A

    Test each determination statement using examine, interview and test methods, and record what is met and not met.

    OutputsSelf-assessment results
  6. 6

    Plan and close gaps

    Record unmet requirements in a plan of action with owners and dates, and close them in order of risk.

    OutputsPlan of action and milestones
  7. 7

    Bring suppliers into scope

    Flow requirements to subcontractors and external service providers that handle CUI, and keep evidence of their protections.

    OutputsSupplier requirementsProvider evidence
  8. 8

    Monitor and reassess

    Run continuous monitoring, reassess at the defined frequency and update the plan when the system or obligations change.

    OutputsMonitoring recordsUpdated plan

Audit and evidence guide

What auditors look for, and the evidence to keep

NIST publishes the requirements and assessment procedures but does not assess or certify anyone. Assessments are carried out by the organisation itself, by the federal agency, or by third parties under whatever programme the agency’s contract specifies, using SP 800-171A procedures.

What reviewers look for

  • A clear CUI boundary and data flows
  • A system security plan that matches the real environment
  • Parameter values that are set and consistently applied
  • Multi-factor authentication and replay-resistant authentication
  • Audit logging, review and protection of logs
  • Configuration baselines, authorised software and component inventory
  • Cryptographic protection of CUI in transit, on media and in backups, using the types of cryptography the organisation defines
  • Incident handling and reporting, with tested capability
  • External service providers and the evidence for inherited requirements
  • Plans of action tracked to closure

Key dates and cycles

Revision 2 publishedFebruary 2020
Revision 3 and 800-171A Rev 3May 2024
Security assessment (03.12.01)At a defined frequency
Risk assessment update (03.11.01)At a defined frequency
Policy and procedure reviewAt a defined frequency
Applicable revisionAs the contract states

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Scope and planning

  • CUI inventory
  • Boundary diagram
  • System security plan
  • Parameter register

Access and identity

  • Account reviews
  • MFA configuration
  • Privileged access records
  • Remote access controls

Configuration and integrity

  • Baseline configurations
  • Change records
  • Patch and flaw remediation records
  • Malware protection status

Logging and response

  • Log configuration and review
  • Incident response plan
  • Incident records
  • Response tests

Media and physical

  • Media sanitisation records
  • Encryption settings
  • Physical access logs
  • Visitor records

People and suppliers

  • Screening records
  • Training completion
  • Supplier requirements
  • Supply chain risk management plan

Assessment

  • 800-171A assessment results
  • Plan of action and milestones
  • Monitoring records

Areas that often need attention

  • CUI boundary drawn too widely, or too narrowly to be credible
  • Organisation-defined parameters never assigned
  • System security plan out of date or generic
  • Requirements claimed as inherited from a cloud provider without evidence
  • MFA missing for some access paths
  • Log collection without regular review
  • New Revision 3 families (Planning, Acquisition, Supply Chain) not addressed
  • Confusion between the revision published by NIST and the revision required by contract

How Netra helps

Where each part of the work lives in Netra

Netra loads SP 800-171 Revision 3 as requirements, tasks and policies, and keeps the contractual revision visible alongside the work.

Each requirement owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates, and recurring tasks run at the frequencies set in your parameter values.

Status for each family and requirement

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, and one task can count towards SP 800-53 or ISO 27001 where the work is the same.

Policies and the security plan inputs (03.15)

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Risk assessment (03.11)

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as linked tasks complete.

CUI boundary and component inventory

Asset Management

Assets linked to tasks, supporting the boundary discussion and showing which requirements apply where.

External services and supply chain (03.16, 03.17)

Third-Party Risk

Finds vendors from what Accounts and Purchase pay, assesses them through a vendor portal and records decisions with ratings.

Self-assessment and findings

Audit Centre

Run internal or external assessments end to end, with findings and corrective actions, using evidence in a tamper-evident vault.

Netra organises work and evidence. It does not determine which revision applies, does not issue CMMC or any other certification, is not an assessor and does not submit scores to any government system. Compliance is established through the assessment your contract specifies.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIST SP 800-53

Organise a tailored security and privacy control programme

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

See NIST SP 800-171 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.