NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud

SP 800-171 is a NIST catalogue that becomes binding through contracts. For defence work the trigger is DFARS 252.204-7012, prescribed for DoD solicitations and contracts except those solely for commercially available off-the-shelf items. It requires "adequate security" — the 800-171 requirements — on every contractor system that processes, stores or transmits covered defence information, plus incident reporting within 72 hours, and it flows down to any subcontractor whose work touches that information. The CMMC Program rule (32 CFR Part 170, effective 16 December 2024) and the DFARS acquisition rule (clause 252.204-7021, effective 10 November 2025) add the check: where a solicitation names a CMMC level, the contracting officer must find a current status in SPRS before award.

Controlled Unclassified Information (CUI) is government information — or information you create for the government — that law, regulation or government-wide policy says must be safeguarded. The NARA CUI Registry lists the categories; in defence work the usual ones are Controlled Technical Information (drawings, specifications, delivered source code) and export-controlled data. If you only hold Federal Contract Information — contract data not meant for public release — you are on the lighter FAR 52.204-21 track: CMMC Level 1, 15 requirements.

SaaS companies meet it in two ways: as a prime or subcontractor, or because defence customers want to put CUI into the product. The second is the trap: 7012 makes your customer ensure your service meets FedRAMP Moderate-equivalent security and the clause's reporting terms, a far bigger project than 800-171. Vendors without a FedRAMP authorisation usually prohibit CUI contractually and enforce that technically.

Ignoring it costs awards and invites False Claims Act cases. In June 2026 the Justice Department settled with LOGZONE for $507,144 after a DCMA assessment scored it -170 on a range of -203 to 110; Honeywell Aerospace agreed in September 2026 to pay $2.04 million to resolve allegations that a network fell short of 800-171.

• SP 800-171 Rev 3 (May 2024) is NIST's current edition: 97 requirements in 17 families, tailored from the SP 800-53 Rev 5 moderate baseline. It drops the basic/derived split, adds Planning (3.15), System and Services Acquisition (3.16) and Supply Chain Risk Management (3.17), and introduces organisation-defined parameters (ODPs) — blanks such as scan frequency that the organisation or agency fills in. SP 800-171A Rev 3 holds the matching assessment procedures. NIST now lists Rev 2 as withdrawn.
• SP 800-171 Rev 2 (2020): 110 requirements in 14 families. It remains the DoD baseline: 32 CFR Part 170 incorporates Rev 2, and the 7012 clause text DoD uses in new contracts names Revision 2 explicitly.
• CMMC wraps this in assessment. Level 1: the 15 FAR requirements, self-assessed annually. Level 2: the 110 Rev 2 requirements, self-assessed or assessed by an accredited third-party organisation (C3PAO) every three years, with annual affirmation. Level 3: a final Level 2 (C3PAO) plus 24 requirements from SP 800-172 (February 2021 edition, even though NIST finalised 800-172 Rev 3 in May 2026), assessed by DCMA's DIBCAC.

Where things stand on 8 October 2026. Phase 1 began on 10 November 2025, with Level 1 (Self) and Level 2 (Self) as award conditions where solicitations specify them. Phase 2, which would have made Level 2 (C3PAO) the norm from 10 November 2026, was suspended with immediate effect on 13 July 2026 by the DoD CIO's memo ordering a 60-day reform review; later milestones are held in abeyance. Meanwhile solicitations may require only Level 1 (Self) or Level 2 (Self), C3PAO and Level 3 requirements are being removed from active ones, and the Department enforces 800-171 Rev 2 through self-assessments and selected government-led assessments. 7012 still applies. No reform report had been published when this guide was reviewed.

The clauses were also renumbered. Under the Revolutionary FAR Overhaul deviation for DFARS Part 240 (2026-O0025, Revision 3, 3 September 2026), new solicitations omit 252.204-7019 and 252.204-7020 and use 252.240-7997, which covers DCMA-led Medium and High assessments. Existing contracts keep their clauses unless modified.

Why the library below has 100 articles. It follows Rev 3: 97 active requirements plus three withdrawn numbers kept so existing links resolve — 3.7.1 and 3.13.2 (recategorised as not directly about CUI confidentiality) and 3.13.14 (withdrawn as technology-specific). Score against Rev 2 for DoD today; most Rev 3 additions are cheap to adopt while you build.

Scope follows the data. Find every place CUI enters — deliverable lists, drawings from the prime, a customer's file share, tickets, email — and record each category and the systems it touches (3.4.11). Ask the contracting officer or prime when markings are missing; do not guess.

Then classify assets the way 32 CFR 170.19 does, because that is how an assessor will read your inventory:

• CUI assets process, store or transmit CUI. Fully in scope.
• Security Protection Assets provide security for the scope: identity provider, SIEM, EDR, MDM, vulnerability scanner, backup system, a managed service provider. Assessed against the requirements relevant to what they do.
• Contractor Risk Managed Assets can touch CUI but are kept from it by policy and procedure. Documented in the inventory, SSP and diagram.
• Specialized Assets: IoT, operational technology, test equipment, government-furnished equipment.
• Out of scope only with physical or logical separation from CUI assets.

You then choose between bringing the whole company into scope and building an enclave: a separate cloud tenant, accounts and managed devices used only by the people who handle CUI. Enclaves suit companies where a few people handle CUI; whole-company scope suits engineering firms where it is everywhere. Any cloud service that holds CUI must be FedRAMP Moderate authorised or equivalent — the DoD CIO's December 2023 memo defines equivalent as 100 per cent of the Moderate baseline assessed by a FedRAMP-recognised 3PAO (3.16.3).

The costly mistakes: an enclave that shares a mail tenant with the rest of the company; CUI in ticketing, chat or AI tools nobody listed; and ITAR data treated as ordinary CUI when it also needs US-person access controls.

The plan assumes a 20–200 person company building a Level 2 programme on one or two cloud providers. Shift the weeks, not the order.

Weeks 0–3: confirm obligations and find the CUI

• Read every contract and subcontract for 7012, 7021 (and the level named), 252.240-7997 or the older 7019/7020.
• Map CUI flows, choose enclave or enterprise scope, and pick providers with FedRAMP Moderate or higher authorisations. Order the DoD-approved medium assurance (ECA) certificate that DIBNet reporting requires.
• Deliverables: CUI inventory, data-flow diagram, asset inventory by CMMC category, scope decision, gap assessment against the 110 requirements.

Weeks 3–10: build the boundary and identity

• Stand up the CUI tenant, accounts or projects; enforce phishing-resistant MFA; enrol every in-scope device in MDM and EDR; block removable media; switch to FIPS-validated cryptography; centralise logs.
• Apply hardened baselines (CIS or DISA STIG) and a component inventory (3.4.1, 3.4.10).
• Deliverables: configuration exports per requirement and each provider's customer responsibility matrix mapped to your controls.

Weeks 8–16: document and operate

• Write the SSP for each system in scope (Rev 2 3.12.4; Rev 3 3.15.2) and the policies and procedures per family (3.15.1).
• Run the recurring controls at least once: vulnerability scans with remediation tickets (3.11.2), access reviews, log reviews, CUI and insider-threat training, an incident tabletop that ends in a mock DIBNet report, and a risk assessment (3.11.1).
• Deliverables: approved SSP, policy set, first operating records.

Weeks 14–20: self-assess, score, affirm

• Test every requirement against the 800-171A objectives with final, dated evidence; drafts do not count. Score with the 32 CFR 170.24 methodology and open POA&M items only for eligible gaps (3.12.2).
• Post the score in SPRS — level, status date, scope, CAGE codes, score and POA&M use — and have a senior affirming official affirm it.

Ongoing

• Close any POA&M within 180 days, affirm annually, reassess within three years and on major change (3.12.3). Watch the CMMC reform outcome and any move to Rev 3.

Rev 2 uses the same numbers for these, except that its 3.13.5 is folded into Rev 3's 3.13.1. "Done" means a configuration export and a sampled record that agree with the SSP.

3.13.1 and 3.1.20 — the CUI boundary

• AWS: GovCloud (US) accounts for ITAR data, or FedRAMP-authorised services in US East/West for other CUI; service control policies restricting regions and unapproved services; CUI VPCs without internet gateways, reached through VPC endpoints and Network Firewall.
• Azure: Azure Government subscriptions or FedRAMP High services in commercial Azure; Microsoft 365 GCC High where CUI lives in mail and files; Azure Policy allowed locations; Private Endpoints behind Azure Firewall.
• GCP: an Assured Workloads folder with the FedRAMP Moderate, IL4 or ITAR data-boundary package; the gcp.resourceLocations organisation policy; a VPC Service Controls perimeter around CUI projects.
• Done: a diagram that shows every CUI ingress and egress, matched by firewall and endpoint configuration.

3.5.3 and 3.5.4 — MFA

• One identity provider for the scope with phishing-resistant MFA (FIDO2 keys, passkeys or PIV) for every user; partial MFA scores only partial credit. Entra ID: a Conditional Access policy requiring an authentication strength. AWS: IAM Identity Center federated to it, no IAM users with console passwords, hardware MFA on root. Google Cloud: enforced 2-Step Verification with security keys.
• Done: an IdP report showing 100 per cent enrolment, the policy export, and monitored break-glass accounts.

3.13.11, 3.13.8 and 3.8.9 — FIPS-validated cryptography

• Rev 2 requires FIPS-validated cryptography for CUI; Rev 3 turns the type into a parameter. Unvalidated encryption costs 3 points, none costs 5. The CMVP schedule allowed FIPS 140-2 modules in new systems through 21 September 2026; they then move to the Historical list for existing systems only, so new builds need FIPS 140-3 modules.
• AWS: FIPS endpoints (use_fips_endpoint in SDK and CLI configuration); KMS customer-managed keys on storage, databases and backup vaults; FIPS TLS policies on load balancers; FIPS mode on instance operating systems. Azure: Key Vault Premium or Managed HSM keys; the Windows FIPS policy and BitLocker on endpoints. GCP: Cloud KMS keys at HSM protection level; FIPS-mode images for workloads that terminate TLS.
• Done: a cryptography inventory listing each module and its CMVP certificate number and status.

3.3.1, 3.3.5 and 3.3.8 — audit logging

• AWS: an organisation CloudTrail trail with S3 data events for CUI buckets, log file validation, delivery to a log-archive account with Object Lock; alerts on StopLogging. Azure: Activity Log, Entra sign-in and audit logs and resource diagnostics to Log Analytics and Sentinel, with immutable archive storage. GCP: Data Access audit logs switched on (most are off by default), an aggregated organisation sink to a bucket with a locked retention policy.
• Keep at least 90 days of monitoring data: after a reported incident 7012 requires preserving it, with system images, for 90 days.
• Done: a dated review record and a sampled event traced from source to SIEM to ticket.

3.6.1–3.6.3 — incident reporting to DIBNet

• A runbook that gets from discovery to a DIBNet report within 72 hours using the ECA certificate; malware submitted to DC3; subcontractors pass the report number up the chain.
• Forensic readiness: snapshots copied to a forensics account and VPC Traffic Mirroring (AWS); snapshots to immutable storage and Network Watcher packet capture (Azure); snapshots to a forensics project and Packet Mirroring (GCP).
• Done: a tabletop record with the time to report measured.

3.8.7, 3.8.4 and 3.1.18 — media and mobile

• Block removable storage by default with Defender for Endpoint device control or your MDM; allow encrypted, owned devices by exception. Mark CUI with Microsoft Purview sensitivity labels in GCC High, or banner markings. Phones stay out of scope or run MDM with container encryption and app protection that blocks copying to unmanaged apps.
• Sanitise laptops to NIST SP 800-88 with certificates (3.8.3); in the cloud, inherit physical media destruction from the provider's authorisation and crypto-shred by deleting keys.

Assessors examine documents, interview people and test mechanisms against each assessment objective. Evidence must be final and dated; a draft policy scores as NOT MET.

• Core documents: the SSP for each system, with boundary, network and data-flow diagrams; the asset inventory with CMMC categories; the POA&M; policies and procedures per family; the incident response plan; each provider's customer responsibility matrix; the FedRAMP Marketplace listing or body of evidence for every cloud service holding CUI; the SPRS submission and affirmation.
• Records: training completions; account requests, removals and access reviews (3.1.1); screening and termination records; physical access and visitor logs (3.10.7); media sanitisation certificates; change tickets with security impact analysis; vulnerability scans and remediation tickets; tabletop and incident reports with DIBNet confirmation numbers.
• Technical exports: IdP MFA and Conditional Access reports; service control policies, Azure Policy assignments or organisation policies; logging and retention settings with sample reviews; the cryptography inventory with CMVP certificates; MDM, EDR and firewall exports; baseline scan results.

Retention. 32 CFR Part 170 requires assessment evidence to be kept for six years from the CMMC status date; for a C3PAO assessment the files are also hashed with a NIST-approved algorithm and the hash list given to the assessor. Keep incident images and monitoring data for at least 90 days after a DIBNet report; set log retention in your audit policy.

Three routes exist; your contract and the suspension decide which applies.

1. Level 2 (Self). You test all 110 requirements against the 800-171A objectives and score them under 32 CFR 170.24: start at 110 and subtract 5, 3 or 1 point for each requirement not met, down to a possible -203. A requirement is met only when every objective is met. A score of at least 88 (80 per cent) gives Conditional status with a POA&M, but only for 1-point requirements — plus 3.13.11 where encryption exists but is not validated — and never for 3.1.20, 3.1.22, the SSP or the physical access requirements now merged into 3.10.7. A closeout self-assessment within 180 days makes it Final. Repeat every three years; an affirming official reaffirms annually in SPRS.
2. Government-led Medium and High assessments. DCMA's DIBCAC reviews your documents (Medium) or also verifies and demonstrates the SSP's implementation (High) under 252.240-7997 or 7020. You get 14 business days to rebut findings before the score is posted, and DCMA results take precedence over other assessments.
3. Level 2 (C3PAO). An accredited C3PAO assesses the scope, issues a certificate valid for three years and uploads the results. The rule still provides for it, but DoD solicitations cannot require it during the suspension, and the memos are silent on certificates already issued. Primes may still ask for one; check your subcontracts.

Duration and cost drivers. In practice a self-assessment takes two to four weeks once evidence exists. Cost rises with scope (the count of CUI assets and Security Protection Assets), sites, managed service providers, remediation such as GCC High licensing or replacing non-validated cryptography, and evidence that must be rebuilt. Aim for a first assessment with no POA&M: Conditional status starts a 180-day clock.

1. Writing the SSP against Rev 3 for a DoD contract. The contract and SPRS use Rev 2 numbering and scoring. Fix: SSP and score on Rev 2, with a cross-reference column for Rev 3.
2. Pausing because Phase 2 was suspended. 7012, self-assessments and affirmations remain, and so does False Claims Act exposure. Fix: keep building to Level 2.
3. An optimistic SPRS score. Counting partly implemented requirements as met is how settlements start. Fix: score only what final evidence supports and have the affirming official review the workpapers.
4. "FedRAMP equivalent" based on a SOC 2 report. The DoD CIO memo requires 100 per cent of the Moderate baseline assessed by a 3PAO. Fix: Marketplace-listed services, or a full body of evidence from the provider.
5. Forgotten Security Protection Assets. The IdP, SIEM, EDR, MDM and MSP are assessed too. Fix: list them in the inventory and SSP, with their customer responsibility matrices.
6. CUI leaking out of the enclave. Drawings forwarded to a commercial mailbox, specifications pasted into tickets or AI tools. Fix: labels and data loss prevention, other tenants blocked on enclave devices, and training on what CUI looks like.
7. Non-validated cryptography. TLS libraries, VPN clients or disk encryption outside FIPS mode, and FIPS 140-2 modules on new builds after September 2026. Fix: a cryptography inventory with certificate numbers.
8. Ineligible items on the POA&M. A missing SSP or any 5-point requirement blocks Conditional status. Fix: close those before you assess.
9. No DIBNet path. Discovering during an incident that nobody holds an ECA certificate. Fix: buy it in week one and rehearse the report.

iCompaas is not a C3PAO and does not assess or certify; it is the readiness and evidence layer for your own Level 2 programme. It provides a system security plan template, a built-in SPRS scoring calculator and a POA&M tracker with auditable status changes, so a Conditional status and its 180-day closeout stay visible to the affirming official. Continuous checks across your connected cloud accounts (AWS, Azure, GCP and other providers) flag configuration drift — MFA, encryption, logging, network exposure — between assessments rather than at the next one. Policy templates come with owners and review cadences for the per-family policies and procedures assessors sample. Evidence is collected as it is generated and exported per requirement for a self-assessment or a DCMA review. The control library on this page gives engineers requirement-by-requirement detail. Scoping, CUI identification and the affirmation itself remain yours.