What is it?
NIST SP 800-171 defines 110 security requirements that non-federal organisations must implement to protect Controlled Unclassified Information (CUI) in their environments. It is contractually flowed down through DFARS 252.204-7012 (Department of Defense), FAR 52.204-21 (basic), and CMMC Level 2 requires it.
How it relates to NIST 800-53 and CMMC
- 800-171 is a distilled subset of 800-53 specifically scoped to CUI protection in non-federal systems.
- CMMC Level 2 ≈ NIST 800-171 + maturity assessment by a Certified Third-Party Assessment Organisation (C3PAO).
- CMMC Level 3 adds a subset of NIST 800-172 (advanced/APT protections).
The 14 control families
Access Control (AC), Awareness & Training (AT), Audit & Accountability (AU), Configuration Management (CM), Identification & Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System & Communications Protection (SC), and System & Information Integrity (SI).
Deliverables
- System Security Plan (SSP) describing how each of the 110 requirements is implemented.
- Plan of Action & Milestones (POA&M) for requirements not yet fully implemented.
- SPRS score reported via the DoD Supplier Performance Risk System (max 110, -1 per partial control, larger negatives for some).
Cloud considerations
If you process CUI in AWS/Azure/GCP, the underlying cloud region must be a FedRAMP Moderate (or higher) environment, and CUI may need to live in GovCloud (AWS) or Azure Government for ITAR data.
How iCompaas helps
iCompaas provides the SSP template, the 110-requirement evidence library, a built-in SPRS scoring calculator, and a POA&M tracker with auditable status changes.