# NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud > NIST SP 800-171 is the security baseline for Controlled Unclassified Information held on contractor systems, and CMMC is the Department of Defense scheme that checks it. This guide covers who is bound and by which clause, why DoD still assesses against Rev 2 while NIST has moved to Rev 3, how to draw a CUI boundary, a phased plan, the controls that take real engineering on AWS, Azure and GCP, the evidence to keep and how assessments run after the July 2026 suspension of CMMC Phase 2. - Source: https://support.icompaas.com/compliance/nist-sp-800-171-rev-3 - Reviewed: 2026-10-08 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## At a glance - **Issuing bodies:** NIST publishes SP 800-171 and SP 800-171A; the Department of Defense (styling itself the Department of War) runs CMMC under 32 CFR Part 170 and the DFARS clauses - **Current versions:** SP 800-171 Rev 3 (May 2024): 97 requirements in 17 families. DoD contracts and CMMC Level 2 still use Rev 2 (110 requirements, 14 families) - **Applies to:** Contractors and subcontractors that process, store or transmit CUI on their own systems — in practice, the defence supply chain via DFARS 252.204-7012 - **Assessment today:** CMMC Level 2 self-assessment scored from 110 down to -203 and posted in SPRS with an annual affirmation; DCMA-led Medium and High assessments; since 13 July 2026 DoD may not designate C3PAO certification in solicitations - **CMMC phase on 8 October 2026:** Phase 1 self-assessment requirements (since 10 November 2025) remain in place. Phase 2, due 10 November 2026, is suspended pending a reform review; no new date announced - **Typical first-time timeline:** In practice 6–12 months from scoping to a defensible SPRS score for a 20–200 person company - **Cycle:** Level 2 assessment at least every three years, affirmation annually, any POA&M closed within 180 days; evidence kept six years - **Consequences:** Ineligibility for award where a CMMC level is required; False Claims Act liability for misstated compliance ## Who needs NIST SP 800-171, and what triggers it SP 800-171 is a NIST catalogue that becomes binding through contracts. For defence work the trigger is DFARS 252.204-7012, prescribed for DoD solicitations and contracts except those solely for commercially available off-the-shelf items. It requires "adequate security" — the 800-171 requirements — on every contractor system that processes, stores or transmits covered defence information, plus incident reporting within 72 hours, and it flows down to any subcontractor whose work touches that information. The [CMMC Program rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program) (32 CFR Part 170, effective 16 December 2024) and the [DFARS acquisition rule](https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of) (clause 252.204-7021, effective 10 November 2025) add the check: where a solicitation names a CMMC level, the contracting officer must find a current status in SPRS before award. Controlled Unclassified Information (CUI) is government information — or information you create for the government — that law, regulation or government-wide policy says must be safeguarded. The [NARA CUI Registry](https://www.archives.gov/cui/registry/category-list) lists the categories; in defence work the usual ones are Controlled Technical Information (drawings, specifications, delivered source code) and export-controlled data. If you only hold Federal Contract Information — contract data not meant for public release — you are on the lighter FAR 52.204-21 track: CMMC Level 1, 15 requirements. SaaS companies meet it in two ways: as a prime or subcontractor, or because defence customers want to put CUI into the product. The second is the trap: 7012 makes your customer ensure your service meets FedRAMP Moderate-equivalent security and the clause's reporting terms, a far bigger project than 800-171. Vendors without a FedRAMP authorisation usually prohibit CUI contractually and enforce that technically. Ignoring it costs awards and invites False Claims Act cases. In June 2026 the Justice Department [settled with LOGZONE for $507,144](https://www.justice.gov/opa/pr/alabama-defense-contractor-agrees-pay-507144-resolve-false-claims-act-liability-relating) after a DCMA assessment scored it -170 on a range of -203 to 110; Honeywell Aerospace [agreed in September 2026](https://www.justice.gov/opa/pr/honeywell-aerospace-inc-agrees-pay-over-2m-settle-false-claims-act-allegations-failing) to pay $2.04 million to resolve allegations that a network fell short of 800-171. ## How 800-171 and CMMC fit together: Rev 3, Rev 2 and the levels - **[SP 800-171 Rev 3](https://csrc.nist.gov/pubs/sp/800/171/r3/final)** (May 2024) is NIST's current edition: 97 requirements in 17 families, tailored from the SP 800-53 Rev 5 moderate baseline. It drops the basic/derived split, adds Planning (3.15), System and Services Acquisition (3.16) and Supply Chain Risk Management (3.17), and introduces organisation-defined parameters (ODPs) — blanks such as scan frequency that the organisation or agency fills in. SP 800-171A Rev 3 holds the matching assessment procedures. NIST now lists Rev 2 as withdrawn. - **SP 800-171 Rev 2** (2020): 110 requirements in 14 families. It remains the DoD baseline: 32 CFR Part 170 incorporates Rev 2, and the 7012 clause text DoD uses in new contracts names Revision 2 explicitly. - **CMMC** wraps this in assessment. Level 1: the 15 FAR requirements, self-assessed annually. Level 2: the 110 Rev 2 requirements, self-assessed or assessed by an accredited third-party organisation (C3PAO) every three years, with annual affirmation. Level 3: a final Level 2 (C3PAO) plus 24 requirements from SP 800-172 (February 2021 edition, even though NIST finalised 800-172 Rev 3 in May 2026), assessed by DCMA's DIBCAC. **Where things stand on 8 October 2026.** Phase 1 began on 10 November 2025, with Level 1 (Self) and Level 2 (Self) as award conditions where solicitations specify them. Phase 2, which would have made Level 2 (C3PAO) the norm from 10 November 2026, was suspended with immediate effect on 13 July 2026 by the [DoD CIO's memo](https://dodcio.defense.gov/Portals/0/Documents/Library/CMMC-ReformMemo.pdf) ordering a 60-day reform review; later milestones are held in abeyance. Meanwhile solicitations may require only Level 1 (Self) or Level 2 (Self), C3PAO and Level 3 requirements are being removed from active ones, and the Department enforces 800-171 Rev 2 through self-assessments and selected government-led assessments. 7012 still applies. No reform report had been published when this guide was reviewed. The clauses were also renumbered. Under the [Revolutionary FAR Overhaul deviation for DFARS Part 240](https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf) (2026-O0025, Revision 3, 3 September 2026), new solicitations omit 252.204-7019 and 252.204-7020 and use 252.240-7997, which covers DCMA-led Medium and High assessments. Existing contracts keep their clauses unless modified. **Why the library below has 100 articles.** It follows Rev 3: 97 active requirements plus three withdrawn numbers kept so existing links resolve — 3.7.1 and 3.13.2 (recategorised as not directly about CUI confidentiality) and 3.13.14 (withdrawn as technology-specific). Score against Rev 2 for DoD today; most Rev 3 additions are cheap to adopt while you build. ## Scoping: find the CUI, then draw the smallest defensible boundary Scope follows the data. Find every place CUI enters — deliverable lists, drawings from the prime, a customer's file share, tickets, email — and record each category and the systems it touches ([3.4.11](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-11-information-location)). Ask the contracting officer or prime when markings are missing; do not guess. Then classify assets the way 32 CFR 170.19 does, because that is how an assessor will read your inventory: - **CUI assets** process, store or transmit CUI. Fully in scope. - **Security Protection Assets** provide security for the scope: identity provider, SIEM, EDR, MDM, vulnerability scanner, backup system, a managed service provider. Assessed against the requirements relevant to what they do. - **Contractor Risk Managed Assets** can touch CUI but are kept from it by policy and procedure. Documented in the inventory, SSP and diagram. - **Specialized Assets**: IoT, operational technology, test equipment, government-furnished equipment. - **Out of scope** only with physical or logical separation from CUI assets. You then choose between bringing the whole company into scope and building an **enclave**: a separate cloud tenant, accounts and managed devices used only by the people who handle CUI. Enclaves suit companies where a few people handle CUI; whole-company scope suits engineering firms where it is everywhere. Any cloud service that holds CUI must be [FedRAMP Moderate authorised or equivalent](https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf) — the DoD CIO's December 2023 memo defines equivalent as 100 per cent of the Moderate baseline assessed by a FedRAMP-recognised 3PAO ([3.16.3](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-16-3-external-system-services)). The costly mistakes: an enclave that shares a mail tenant with the rest of the company; CUI in ticketing, chat or AI tools nobody listed; and ITAR data treated as ordinary CUI when it also needs US-person access controls. ## Implementation roadmap The plan assumes a 20–200 person company building a Level 2 programme on one or two cloud providers. Shift the weeks, not the order. ### Weeks 0–3: confirm obligations and find the CUI - Read every contract and subcontract for 7012, 7021 (and the level named), 252.240-7997 or the older 7019/7020. - Map CUI flows, choose enclave or enterprise scope, and pick providers with FedRAMP Moderate or higher authorisations. Order the DoD-approved medium assurance (ECA) certificate that DIBNet reporting requires. - **Deliverables:** CUI inventory, data-flow diagram, asset inventory by CMMC category, scope decision, gap assessment against the 110 requirements. ### Weeks 3–10: build the boundary and identity - Stand up the CUI tenant, accounts or projects; enforce phishing-resistant MFA; enrol every in-scope device in MDM and EDR; block removable media; switch to FIPS-validated cryptography; centralise logs. - Apply hardened baselines (CIS or DISA STIG) and a component inventory ([3.4.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-1-baseline-configuration), [3.4.10](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-10-system-component-inventory)). - **Deliverables:** configuration exports per requirement and each provider's customer responsibility matrix mapped to your controls. ### Weeks 8–16: document and operate - Write the SSP for each system in scope (Rev 2 3.12.4; Rev 3 [3.15.2](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-15-2-system-security-plan)) and the policies and procedures per family ([3.15.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-15-1-policy-and-procedures)). - Run the recurring controls at least once: vulnerability scans with remediation tickets ([3.11.2](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-2-vulnerability-monitoring-and-scanning)), access reviews, log reviews, CUI and insider-threat training, an incident tabletop that ends in a mock DIBNet report, and a risk assessment ([3.11.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-1-risk-assessment)). - **Deliverables:** approved SSP, policy set, first operating records. ### Weeks 14–20: self-assess, score, affirm - Test every requirement against the 800-171A objectives with final, dated evidence; drafts do not count. Score with the 32 CFR 170.24 methodology and open POA&M items only for eligible gaps ([3.12.2](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-2-plan-of-action-and-milestones)). - Post the score in SPRS — level, status date, scope, CAGE codes, score and POA&M use — and have a senior affirming official affirm it. ### Ongoing - Close any POA&M within 180 days, affirm annually, reassess within three years and on major change ([3.12.3](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-3-continuous-monitoring)). Watch the CMMC reform outcome and any move to Rev 3. ## The hardest requirements, with AWS, Azure and GCP notes Rev 2 uses the same numbers for these, except that its 3.13.5 is folded into Rev 3's 3.13.1. "Done" means a configuration export and a sampled record that agree with the SSP. ### [3.13.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-1-boundary-protection) and [3.1.20](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-20-use-of-external-systems) — the CUI boundary - **AWS:** GovCloud (US) accounts for ITAR data, or FedRAMP-authorised services in US East/West for other CUI; service control policies restricting regions and unapproved services; CUI VPCs without internet gateways, reached through VPC endpoints and Network Firewall. - **Azure:** Azure Government subscriptions or FedRAMP High services in commercial Azure; Microsoft 365 GCC High where CUI lives in mail and files; Azure Policy allowed locations; Private Endpoints behind Azure Firewall. - **GCP:** an Assured Workloads folder with the FedRAMP Moderate, IL4 or ITAR data-boundary package; the `gcp.resourceLocations` organisation policy; a VPC Service Controls perimeter around CUI projects. - **Done:** a diagram that shows every CUI ingress and egress, matched by firewall and endpoint configuration. ### [3.5.3](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-3-multi-factor-authentication) and [3.5.4](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-4-replay-resistant-authentication) — MFA - One identity provider for the scope with phishing-resistant MFA (FIDO2 keys, passkeys or PIV) for every user; partial MFA scores only partial credit. Entra ID: a Conditional Access policy requiring an authentication strength. AWS: IAM Identity Center federated to it, no IAM users with console passwords, hardware MFA on root. Google Cloud: enforced 2-Step Verification with security keys. - **Done:** an IdP report showing 100 per cent enrolment, the policy export, and monitored break-glass accounts. ### [3.13.11](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-11-cryptographic-protection), [3.13.8](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-8-transmission-and-storage-confidentiality) and [3.8.9](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-9-system-backup-cryptographic-protection) — FIPS-validated cryptography - Rev 2 requires FIPS-validated cryptography for CUI; Rev 3 turns the type into a parameter. Unvalidated encryption costs 3 points, none costs 5. The [CMVP](https://csrc.nist.gov/projects/cryptographic-module-validation-program) schedule allowed FIPS 140-2 modules in new systems through 21 September 2026; they then move to the Historical list for existing systems only, so new builds need FIPS 140-3 modules. - **AWS:** FIPS endpoints (`use_fips_endpoint` in SDK and CLI configuration); KMS customer-managed keys on storage, databases and backup vaults; FIPS TLS policies on load balancers; FIPS mode on instance operating systems. **Azure:** Key Vault Premium or Managed HSM keys; the Windows FIPS policy and BitLocker on endpoints. **GCP:** Cloud KMS keys at HSM protection level; FIPS-mode images for workloads that terminate TLS. - **Done:** a cryptography inventory listing each module and its CMVP certificate number and status. ### [3.3.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-1-event-logging), [3.3.5](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-5-audit-record-review-analysis-and-reporting) and [3.3.8](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-8-protection-of-audit-information) — audit logging - **AWS:** an organisation CloudTrail trail with S3 data events for CUI buckets, log file validation, delivery to a log-archive account with Object Lock; alerts on `StopLogging`. **Azure:** Activity Log, Entra sign-in and audit logs and resource diagnostics to Log Analytics and Sentinel, with immutable archive storage. **GCP:** Data Access audit logs switched on (most are off by default), an aggregated organisation sink to a bucket with a locked retention policy. - Keep at least 90 days of monitoring data: after a reported incident 7012 requires preserving it, with system images, for 90 days. - **Done:** a dated review record and a sampled event traced from source to SIEM to ticket. ### [3.6.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-1-incident-handling)–[3.6.3](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-3-incident-response-testing) — incident reporting to DIBNet - A runbook that gets from discovery to a DIBNet report within 72 hours using the ECA certificate; malware submitted to DC3; subcontractors pass the report number up the chain. - Forensic readiness: snapshots copied to a forensics account and VPC Traffic Mirroring (AWS); snapshots to immutable storage and Network Watcher packet capture (Azure); snapshots to a forensics project and Packet Mirroring (GCP). - **Done:** a tabletop record with the time to report measured. ### [3.8.7](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-7-media-use), [3.8.4](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-4-media-marking) and [3.1.18](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-18-access-control-for-mobile-devices) — media and mobile - Block removable storage by default with Defender for Endpoint device control or your MDM; allow encrypted, owned devices by exception. Mark CUI with Microsoft Purview sensitivity labels in GCC High, or banner markings. Phones stay out of scope or run MDM with container encryption and app protection that blocks copying to unmanaged apps. - Sanitise laptops to NIST SP 800-88 with certificates ([3.8.3](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-3-media-sanitization)); in the cloud, inherit physical media destruction from the provider's authorisation and crypto-shred by deleting keys. ## Evidence an assessor will ask for Assessors examine documents, interview people and test mechanisms against each assessment objective. Evidence must be final and dated; a draft policy scores as NOT MET. - **Core documents:** the SSP for each system, with boundary, network and data-flow diagrams; the asset inventory with CMMC categories; the POA&M; policies and procedures per family; the incident response plan; each provider's customer responsibility matrix; the FedRAMP Marketplace listing or body of evidence for every cloud service holding CUI; the SPRS submission and affirmation. - **Records:** training completions; account requests, removals and access reviews ([3.1.1](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-1-account-management)); screening and termination records; physical access and visitor logs ([3.10.7](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-7-physical-access-control)); media sanitisation certificates; change tickets with security impact analysis; vulnerability scans and remediation tickets; tabletop and incident reports with DIBNet confirmation numbers. - **Technical exports:** IdP MFA and Conditional Access reports; service control policies, Azure Policy assignments or organisation policies; logging and retention settings with sample reviews; the cryptography inventory with CMVP certificates; MDM, EDR and firewall exports; baseline scan results. **Retention.** 32 CFR Part 170 requires assessment evidence to be kept for six years from the CMMC status date; for a C3PAO assessment the files are also hashed with a NIST-approved algorithm and the hash list given to the assessor. Keep incident images and monitoring data for at least 90 days after a DIBNet report; set log retention in your audit policy. ## How assessment works in October 2026 Three routes exist; your contract and the suspension decide which applies. 1. **Level 2 (Self).** You test all 110 requirements against the 800-171A objectives and score them under 32 CFR 170.24: start at 110 and subtract 5, 3 or 1 point for each requirement not met, down to a possible -203. A requirement is met only when every objective is met. A score of at least 88 (80 per cent) gives Conditional status with a POA&M, but only for 1-point requirements — plus 3.13.11 where encryption exists but is not validated — and never for 3.1.20, 3.1.22, the SSP or the physical access requirements now merged into [3.10.7](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-7-physical-access-control). A closeout self-assessment within 180 days makes it Final. Repeat every three years; an affirming official reaffirms annually in SPRS. 2. **Government-led Medium and High assessments.** DCMA's DIBCAC reviews your documents (Medium) or also verifies and demonstrates the SSP's implementation (High) under 252.240-7997 or 7020. You get 14 business days to rebut findings before the score is posted, and DCMA results take precedence over other assessments. 3. **Level 2 (C3PAO).** An accredited C3PAO assesses the scope, issues a certificate valid for three years and uploads the results. The rule still provides for it, but DoD solicitations cannot require it during the suspension, and the memos are silent on certificates already issued. Primes may still ask for one; check your subcontracts. **Duration and cost drivers.** In practice a self-assessment takes two to four weeks once evidence exists. Cost rises with scope (the count of CUI assets and Security Protection Assets), sites, managed service providers, remediation such as GCC High licensing or replacing non-validated cryptography, and evidence that must be rebuilt. Aim for a first assessment with no POA&M: Conditional status starts a 180-day clock. ## Common mistakes in readiness reviews 1. **Writing the SSP against Rev 3 for a DoD contract.** The contract and SPRS use Rev 2 numbering and scoring. Fix: SSP and score on Rev 2, with a cross-reference column for Rev 3. 2. **Pausing because Phase 2 was suspended.** 7012, self-assessments and affirmations remain, and so does False Claims Act exposure. Fix: keep building to Level 2. 3. **An optimistic SPRS score.** Counting partly implemented requirements as met is how settlements start. Fix: score only what final evidence supports and have the affirming official review the workpapers. 4. **"FedRAMP equivalent" based on a SOC 2 report.** The DoD CIO memo requires 100 per cent of the Moderate baseline assessed by a 3PAO. Fix: Marketplace-listed services, or a full body of evidence from the provider. 5. **Forgotten Security Protection Assets.** The IdP, SIEM, EDR, MDM and MSP are assessed too. Fix: list them in the inventory and SSP, with their customer responsibility matrices. 6. **CUI leaking out of the enclave.** Drawings forwarded to a commercial mailbox, specifications pasted into tickets or AI tools. Fix: labels and data loss prevention, other tenants blocked on enclave devices, and training on what CUI looks like. 7. **Non-validated cryptography.** TLS libraries, VPN clients or disk encryption outside FIPS mode, and FIPS 140-2 modules on new builds after September 2026. Fix: a cryptography inventory with certificate numbers. 8. **Ineligible items on the POA&M.** A missing SSP or any 5-point requirement blocks Conditional status. Fix: close those before you assess. 9. **No DIBNet path.** Discovering during an incident that nobody holds an ECA certificate. Fix: buy it in week one and rehearse the report. ## How iCompaas helps iCompaas is not a C3PAO and does not assess or certify; it is the readiness and evidence layer for your own Level 2 programme. It provides a system security plan template, a built-in SPRS scoring calculator and a POA&M tracker with auditable status changes, so a Conditional status and its 180-day closeout stay visible to the affirming official. Continuous checks across your connected cloud accounts (AWS, Azure, GCP and other providers) flag configuration drift — MFA, encryption, logging, network exposure — between assessments rather than at the next one. Policy templates come with owners and review cadences for the per-family policies and procedures assessors sample. Evidence is collected as it is generated and exported per requirement for a self-assessment or a DCMA review. The control library on this page gives engineers requirement-by-requirement detail. Scoping, CUI identification and the affirmation itself remain yours. ## Frequently asked questions ### Is NIST SP 800-171 Rev 3 required for DoD contracts? Not yet. NIST published Rev 3 in May 2024 and lists Rev 2 as withdrawn, but DoD still points contractors at Rev 2. The DFARS 252.204-7012 text DoD uses in new contracts names Revision 2, 32 CFR Part 170 incorporates Rev 2 for CMMC Level 2, and the July 2026 CMMC suspension memo enforces Rev 2 in the interim. No date has been announced for moving to Rev 3. Score and write your SSP against Rev 2; adopting Rev 3 additions now will shorten the later move. ### Is CMMC Level 2 certification required in 2026? Not by new DoD solicitations at the moment. Phase 1 (from 10 November 2025) uses Level 1 and Level 2 self-assessments. Phase 2, which would have required C3PAO certification from 10 November 2026, was suspended on 13 July 2026 pending a reform review, and contracting officers are removing C3PAO and Level 3 requirements from active solicitations. You still need a Level 2 self-assessment score in SPRS where a contract requires it, annual affirmation, and full DFARS 252.204-7012 compliance. ### How long does NIST 800-171 compliance take? In practice six to twelve months for a 20–200 person company starting with basic cloud hygiene: about three weeks to find the CUI and set scope, two months to build the boundary, identity, logging and cryptography, a further two months to document and operate the recurring controls, then a month to self-assess and post the SPRS score. A small, well-isolated enclave is faster; bringing an entire engineering organisation into scope is slower. Remediation such as replacing non-validated cryptography often sets the pace. ### How is the SPRS score calculated? Under 32 CFR 170.24 you start at 110, one point per Rev 2 requirement, and subtract the value of each requirement not fully met: 5 points for those whose absence could lead to exploitation or exfiltration, 3 for those with a confined effect and 1 for the rest. MFA and FIPS cryptography can earn partial credit. The lowest possible score is -203. A score of at least 88 with an eligible POA&M gives Conditional status, which must be closed within 180 days. ### Can we store CUI in AWS, Azure, Google Cloud or Microsoft 365? Yes, if the specific services are FedRAMP Moderate authorised or meet the DoD CIO definition of equivalence, and the provider accepts the DFARS 7012 incident-reporting obligations. AWS GovCloud (US), Azure Government with Microsoft 365 GCC High, and Google Cloud Assured Workloads are the usual choices when the data is also ITAR-controlled, because they restrict support access to US persons. Commercial regions with FedRAMP-authorised services can hold other CUI. You remain responsible for configuration, identity, encryption choices and logging. ### How does ITAR interact with NIST SP 800-171? ITAR technical data is usually CUI as well, so 800-171 applies, but ITAR adds its own rule: no release to foreign persons without authorisation. 800-171 does not cover that, so you need US-person access controls on the systems and the provider's support staff. The ITAR [22 CFR 120.54](https://www.ecfr.gov/current/title-22/section-120.54) carve-out treats end-to-end encrypted storage with FIPS 140-2 or successor modules, outside proscribed countries, as not an export — useful, but keys and decryption must stay with authorised people. ### Do subcontractors need to comply with NIST 800-171? Yes, when their work involves covered defence information. DFARS 252.204-7012 must be flowed down without alteration to subcontracts for operationally critical support or involving that information, and CMMC requirements apply to subcontractors that handle FCI or CUI. Subcontractors report incidents to DIBNet themselves and pass the report number to the next tier. Primes increasingly ask for the SPRS score and the SSP during supplier onboarding, so expect the request even for small orders. ## Automate NIST SP 800-171 with iCompaas iCompaas connects to your cloud accounts, identity provider and version control, maps the evidence to every NIST SP 800-171 requirement, runs the technical checks continuously, and keeps policies and reviews on schedule. - [Get started](https://app.icompaas.com/signin?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=nist-sp-800-171-rev-3&utm_term=get-started) - [Book a product tour](https://calendly.com/icompaas/product-tour?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=nist-sp-800-171-rev-3&utm_term=product-tour) ## Related compliance guides - [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The catalogue 800-171 is tailored from, and the basis of the FedRAMP Moderate baseline your cloud providers must meet for CUI. - [CIS Critical Security Controls v8 — control library](https://support.icompaas.com/compliance/cis-controls-v8): Prescriptive configuration and hardening guidance that fills in the baseline, logging and vulnerability work behind 3.4, 3.3 and 3.11. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): If commercial customers ask for a certificate as well, most 800-171 controls can be evidenced once and mapped to Annex A. ## NIST SP 800-171 Rev. 3 Requirements: control library 100 controls in 17 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Access Control — §3.1 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.1.1 — Account Management](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-1-account-management) - [NIST SP 800-171 Rev. 3 3.1.2 — Access Enforcement](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-2-access-enforcement) - [NIST SP 800-171 Rev. 3 3.1.3 — Information Flow Enforcement](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-3-information-flow-enforcement) - [NIST SP 800-171 Rev. 3 3.1.4 — Separation of Duties](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-4-separation-of-duties) - [NIST SP 800-171 Rev. 3 3.1.5 — Least Privilege](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-5-least-privilege) - [NIST SP 800-171 Rev. 3 3.1.6 — Least Privilege - Privileged Accounts](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-6-least-privilege-privileged-accounts) - [NIST SP 800-171 Rev. 3 3.1.7 — Least Privilege - Privileged Functions](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-7-least-privilege-privileged-functions) - [NIST SP 800-171 Rev. 3 3.1.8 — Unsuccessful Logon Attempts](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-8-unsuccessful-logon-attempts) - [NIST SP 800-171 Rev. 3 3.1.9 — System Use Notification](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-9-system-use-notification) - [NIST SP 800-171 Rev. 3 3.1.10 — Device Lock](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-10-device-lock) - [NIST SP 800-171 Rev. 3 3.1.11 — Session Termination](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-11-session-termination) - [NIST SP 800-171 Rev. 3 3.1.12 — Remote Access](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-12-remote-access) - [NIST SP 800-171 Rev. 3 3.1.16 — Wireless Access](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-16-wireless-access) - [NIST SP 800-171 Rev. 3 3.1.18 — Access Control for Mobile Devices](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-18-access-control-for-mobile-devices) - [NIST SP 800-171 Rev. 3 3.1.20 — Use of External Systems](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-20-use-of-external-systems) - [NIST SP 800-171 Rev. 3 3.1.22 — Publicly Accessible Content](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-1-22-publicly-accessible-content) ### Awareness and Training — §3.2 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.2.1 — Literacy Training and Awareness](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-2-1-literacy-training-and-awareness) - [NIST SP 800-171 Rev. 3 3.2.2 — Role-Based Training](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-2-2-role-based-training) ### Audit and Accountability — §3.3 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.3.1 — Event Logging](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-1-event-logging) - [NIST SP 800-171 Rev. 3 3.3.2 — Audit Record Content](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-2-audit-record-content) - [NIST SP 800-171 Rev. 3 3.3.3 — Audit Record Generation](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-3-audit-record-generation) - [NIST SP 800-171 Rev. 3 3.3.4 — Response to Audit Logging Process Failures](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-4-response-to-audit-logging-process-failures) - [NIST SP 800-171 Rev. 3 3.3.5 — Audit Record Review, Analysis, and Reporting](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-5-audit-record-review-analysis-and-reporting) - [NIST SP 800-171 Rev. 3 3.3.6 — Audit Record Reduction and Report Generation](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-6-audit-record-reduction-and-report-generation) - [NIST SP 800-171 Rev. 3 3.3.7 — Time Stamps](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-7-time-stamps) - [NIST SP 800-171 Rev. 3 3.3.8 — Protection of Audit Information](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-3-8-protection-of-audit-information) ### Configuration Management — §3.4 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.4.1 — Baseline Configuration](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-1-baseline-configuration) - [NIST SP 800-171 Rev. 3 3.4.2 — Configuration Settings](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-2-configuration-settings) - [NIST SP 800-171 Rev. 3 3.4.3 — Configuration Change Control](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-3-configuration-change-control) - [NIST SP 800-171 Rev. 3 3.4.4 — Impact Analyses](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-4-impact-analyses) - [NIST SP 800-171 Rev. 3 3.4.5 — Access Restrictions for Change](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-5-access-restrictions-for-change) - [NIST SP 800-171 Rev. 3 3.4.6 — Least Functionality](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-6-least-functionality) - [NIST SP 800-171 Rev. 3 3.4.8 — Authorized Software - Allow by Exception](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-8-authorized-software-allow-by-exception) - [NIST SP 800-171 Rev. 3 3.4.10 — System Component Inventory](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-10-system-component-inventory) - [NIST SP 800-171 Rev. 3 3.4.11 — Information Location](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-11-information-location) - [NIST SP 800-171 Rev. 3 3.4.12 — System and Component Configuration for High-Risk Areas](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-12-system-and-component-configuration-for-high-risk-areas) ### Identification and Authentication — §3.5 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.5.1 — User Identification and Authentication](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-1-user-identification-and-authentication) - [NIST SP 800-171 Rev. 3 3.5.2 — Device Identification and Authentication](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-2-device-identification-and-authentication) - [NIST SP 800-171 Rev. 3 3.5.3 — Multi-Factor Authentication](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-3-multi-factor-authentication) - [NIST SP 800-171 Rev. 3 3.5.4 — Replay-Resistant Authentication](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-4-replay-resistant-authentication) - [NIST SP 800-171 Rev. 3 3.5.5 — Identifier Management](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-5-identifier-management) - [NIST SP 800-171 Rev. 3 3.5.7 — Password Management](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-7-password-management) - [NIST SP 800-171 Rev. 3 3.5.11 — Authentication Feedback](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-11-authentication-feedback) - [NIST SP 800-171 Rev. 3 3.5.12 — Authenticator Management](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-5-12-authenticator-management) ### Incident Response — §3.6 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.6.1 — Incident Handling](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-1-incident-handling) - [NIST SP 800-171 Rev. 3 3.6.2 — Incident Monitoring, Reporting, and Response Assistance](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-2-incident-monitoring-reporting-and-response-assistance) - [NIST SP 800-171 Rev. 3 3.6.3 — Incident Response Testing](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-3-incident-response-testing) - [NIST SP 800-171 Rev. 3 3.6.4 — Incident Response Training](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-4-incident-response-training) - [NIST SP 800-171 Rev. 3 3.6.5 — Incident Response Plan](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-5-incident-response-plan) ### Maintenance — §3.7 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.7.1 — Recategorized as NCO.](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-7-1-recategorized-as-nco) - [NIST SP 800-171 Rev. 3 3.7.4 — Maintenance Tools](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-7-4-maintenance-tools) - [NIST SP 800-171 Rev. 3 3.7.5 — Nonlocal Maintenance](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-7-5-nonlocal-maintenance) - [NIST SP 800-171 Rev. 3 3.7.6 — Maintenance Personnel](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-7-6-maintenance-personnel) ### Media Protection — §3.8 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.8.1 — Media Storage](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-1-media-storage) - [NIST SP 800-171 Rev. 3 3.8.2 — Media Access](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-2-media-access) - [NIST SP 800-171 Rev. 3 3.8.3 — Media Sanitization](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-3-media-sanitization) - [NIST SP 800-171 Rev. 3 3.8.4 — Media Marking](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-4-media-marking) - [NIST SP 800-171 Rev. 3 3.8.5 — Media Transport](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-5-media-transport) - [NIST SP 800-171 Rev. 3 3.8.7 — Media Use](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-7-media-use) - [NIST SP 800-171 Rev. 3 3.8.9 — System Backup - Cryptographic Protection](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-8-9-system-backup-cryptographic-protection) ### Personnel Security — §3.9 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.9.1 — Personnel Screening](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-9-1-personnel-screening) - [NIST SP 800-171 Rev. 3 3.9.2 — Personnel Termination and Transfer](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-9-2-personnel-termination-and-transfer) ### Physical Protection — §3.10 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.10.1 — Physical Access Authorizations](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-1-physical-access-authorizations) - [NIST SP 800-171 Rev. 3 3.10.2 — Monitoring Physical Access](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-2-monitoring-physical-access) - [NIST SP 800-171 Rev. 3 3.10.6 — Alternate Work Site](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-6-alternate-work-site) - [NIST SP 800-171 Rev. 3 3.10.7 — Physical Access Control](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-7-physical-access-control) - [NIST SP 800-171 Rev. 3 3.10.8 — Access Control for Transmission](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-10-8-access-control-for-transmission) ### Risk Assessment — §3.11 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.11.1 — Risk Assessment](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-1-risk-assessment) - [NIST SP 800-171 Rev. 3 3.11.2 — Vulnerability Monitoring and Scanning](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-2-vulnerability-monitoring-and-scanning) - [NIST SP 800-171 Rev. 3 3.11.4 — Risk Response](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-4-risk-response) ### Security Assessment and Monitoring — §3.12 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.12.1 — Security Assessment](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-1-security-assessment) - [NIST SP 800-171 Rev. 3 3.12.2 — Plan of Action and Milestones](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-2-plan-of-action-and-milestones) - [NIST SP 800-171 Rev. 3 3.12.3 — Continuous Monitoring](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-3-continuous-monitoring) - [NIST SP 800-171 Rev. 3 3.12.5 — Information Exchange](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-12-5-information-exchange) ### System and Communications Protection — §3.13 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.13.1 — Boundary Protection](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-1-boundary-protection) - [NIST SP 800-171 Rev. 3 3.13.2 — Recategorized as NCO](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-2-recategorized-as-nco) - [NIST SP 800-171 Rev. 3 3.13.4 — Information in Shared System Resources](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-4-information-in-shared-system-resources) - [NIST SP 800-171 Rev. 3 3.13.6 — Network Communications - Deny by Default - Allow by Exception](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-6-network-communications-deny-by-default-allow-by-exception) - [NIST SP 800-171 Rev. 3 3.13.8 — Transmission and Storage Confidentiality](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-8-transmission-and-storage-confidentiality) - [NIST SP 800-171 Rev. 3 3.13.9 — Network Disconnect](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-9-network-disconnect) - [NIST SP 800-171 Rev. 3 3.13.10 — Cryptographic Key Establishment and Management](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-10-cryptographic-key-establishment-and-management) - [NIST SP 800-171 Rev. 3 3.13.11 — Cryptographic Protection](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-11-cryptographic-protection) - [NIST SP 800-171 Rev. 3 3.13.12 — Collaborative Computing Devices and Applications](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-12-collaborative-computing-devices-and-applications) - [NIST SP 800-171 Rev. 3 3.13.13 — Mobile Code](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-13-mobile-code) - [NIST SP 800-171 Rev. 3 3.13.14 — Technology-specific.](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-14-technology-specific) - [NIST SP 800-171 Rev. 3 3.13.15 — Session Authenticity](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-15-session-authenticity) ### System and Information Integrity — §3.14 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.14.1 — Flaw Remediation](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-14-1-flaw-remediation) - [NIST SP 800-171 Rev. 3 3.14.2 — Malicious Code Protection](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-14-2-malicious-code-protection) - [NIST SP 800-171 Rev. 3 3.14.3 — Security Alerts, Advisories, and Directives](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-14-3-security-alerts-advisories-and-directives) - [NIST SP 800-171 Rev. 3 3.14.6 — System Monitoring](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-14-6-system-monitoring) - [NIST SP 800-171 Rev. 3 3.14.8 — Information Management and Retention](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-14-8-information-management-and-retention) ### Planning — §3.15 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.15.1 — Policy and Procedures](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-15-1-policy-and-procedures) - [NIST SP 800-171 Rev. 3 3.15.2 — System Security Plan](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-15-2-system-security-plan) - [NIST SP 800-171 Rev. 3 3.15.3 — Rules of Behavior](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-15-3-rules-of-behavior) ### System and Services Acquisition — §3.16 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.16.1 — Security Engineering Principles](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-16-1-security-engineering-principles) - [NIST SP 800-171 Rev. 3 3.16.2 — Unsupported System Components](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-16-2-unsupported-system-components) - [NIST SP 800-171 Rev. 3 3.16.3 — External System Services](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-16-3-external-system-services) ### Supply Chain Risk Management — §3.17 NIST SP 800-171 Rev. 3 Requirements - [NIST SP 800-171 Rev. 3 3.17.1 — Supply Chain Risk Management Plan](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-17-1-supply-chain-risk-management-plan) - [NIST SP 800-171 Rev. 3 3.17.2 — Acquisition Strategies, Tools, and Methods](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-17-2-acquisition-strategies-tools-and-methods) - [NIST SP 800-171 Rev. 3 3.17.3 — Supply Chain Requirements and Processes](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-17-3-supply-chain-requirements-and-processes)