# NIST SP 800-171 Rev 2 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_nist800171-nist-sp-800-171-rev-2-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST SP 800-171 Readiness](https://support.icompaas.com/support/solutions/c_gen_nist800171) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_cgennist800171_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST SP 800-171 Rev 2 · 110 security requirements across 14 families

### What is it?

**NIST SP 800-171** defines **110 security requirements** that non-federal organisations must implement to protect **Controlled Unclassified Information (CUI)** in their environments. It is contractually flowed down through **DFARS 252.204-7012** (Department of Defense), **FAR 52.204-21** (basic), and **CMMC Level 2** requires it.

### How it relates to NIST 800-53 and CMMC

-   800-171 is a _distilled_ subset of 800-53 specifically scoped to CUI protection in non-federal systems.
-   **CMMC Level 2** ≈ NIST 800-171 + maturity assessment by a Certified Third-Party Assessment Organisation (C3PAO).
-   **CMMC Level 3** adds a subset of NIST 800-172 (advanced/APT protections).

### The 14 control families

Access Control (AC), Awareness & Training (AT), Audit & Accountability (AU), Configuration Management (CM), Identification & Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System & Communications Protection (SC), and System & Information Integrity (SI).

### Deliverables

-   **System Security Plan (SSP)** describing how each of the 110 requirements is implemented.
-   **Plan of Action & Milestones (POA&M)** for requirements not yet fully implemented.
-   **SPRS score** reported via the DoD Supplier Performance Risk System (max 110, -1 per partial control, larger negatives for some).

### Cloud considerations

If you process CUI in AWS/Azure/GCP, the underlying cloud region must be a **FedRAMP Moderate (or higher)** environment, and CUI may need to live in **GovCloud** (AWS) or **Azure Government** for ITAR data.

### How iCompaas helps

iCompaas provides the SSP template, the 110-requirement evidence library, a built-in SPRS scoring calculator, and a POA&M tracker with auditable status changes.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.