NIST 800-171 Controls: All 110, by Family

The 14 families at a glance

NIST groups the 110 requirements of SP 800-171 Rev 2 into 14 families, numbered 3.1 to 3.14. CMMC keeps the same families and calls them domains, each with a two-letter code. Pick a family to jump to its requirements.

14 families, 110 requirements

Rev 2 family	CMMC	Total	Basic	Derived	Rev 3 family
3.1Access control	AC	22	2	20	03.01Access Control
3.2Awareness and training	AT	3	2	1	03.02Awareness and Training
3.3Audit and accountability	AU	9	2	7	03.03Audit and Accountability
3.4Configuration management	CM	9	2	7	03.04Configuration Management
3.5Identification and authentication	IA	11	2	9	03.05Identification and Authentication
3.6Incident response	IR	3	2	1	03.06Incident Response
3.7Maintenance	MA	6	2	4	03.07Maintenance
3.8Media protection	MP	9	3	6	03.08Media Protection
3.9Personnel security	PS	2	2	0	03.09Personnel Security
3.10Physical protection	PE	6	2	4	03.10Physical Protection
3.11Risk assessment	RA	3	1	2	03.11Risk Assessment
3.12Security assessment	CA	4	4	0	03.12Security Assessment and Monitoring
3.13System and communications protection	SC	16	2	14	03.13System and Communications Protection
3.14System and information integrity	SI	7	3	4	03.14System and Information Integrity
Total		110	31	79	17 families in Rev 3

Access control is the largest family by far, with 22 requirements; personnel security and security assessment have no derived ones at all. In Rev 3 every family keeps its number (3.1 becomes 03.01) and only security assessment changes its name, to Security Assessment and Monitoring. Rev 3 also adds 3 families that Rev 2 left out: 03.15 Planning, 03.16 System and Services Acquisition and 03.17 Supply Chain Risk Management. How the counts move between revisions is in What is NIST SP 800-171?

Mezzotint of fourteen blank tags hung in a row along a wire — A tag per family on one wire: NIST files every requirement under one family, and the number says which.

How to read a requirement line

Every row in the list below carries the same four things: the NIST number, the CMMC id, NIST's requirement text word for word, and whether NIST files it as basic or derived. Here is one row taken apart.

One line, taken apart

“Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.”

NIST number: 3.13.11; Family 3.13, requirement 11. The number is also this row's link.
CMMC id: SC.L2-3.13.11; The same requirement as CMMC Level 2 writes it.
Type: Derived; Basic or derived, as NIST marks it.

The basic and derived split is NIST's, and it says where a requirement came from, not how much it matters. Rev 2 has 31 basic and 79 derived requirements, and you need all 110. NIST puts it this way in chapter 2 of the publication:

The CMMC id is not a second numbering scheme. The CMMC rule builds it from the NIST number, so AC.L2-3.1.1 and 3.1.1 are the same requirement. Point values are not part of NIST's text either: they come from DoD's scoring method, and the SPRS score calculator applies them requirement by requirement.

Rows marked Level 1 too are the 17 requirements that CMMC Level 1 also covers. Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv). They map to 17 NIST requirements because FAR item ix splits into 3.10.3, 3.10.4 and 3.10.5. The CMMC Level 1 requirements guide reads them item by item.

Mezzotint of a wall parts organiser with rows of small drawers — One drawer per requirement: each line has its own number and its own place, so a plan can point at it exactly.

All 110 requirements, family by family

The full Rev 2 text, in NIST's order. Search by a word (“cryptograph”, “visitor”, “remote”) or a number, narrow to one family or type, and every row's number is a link you can paste into a system security plan or a POA&M line, for example #req-3-13-11.

To mark each requirement met or not and keep notes, use the NIST SP 800-171 checklist, which adds the 800-171A objectives an assessor tests. For what each family asks of a small shop under CMMC, read CMMC Level 2 requirements by family.

Search the 110

Words or a numberFamily

AllBasicDerived

Only rows marked Level 1 too

Showing 110 of 110 requirements.

Family 3.1

Access control

CMMC domain AC, 22 requirements (2 basic, 20 derived). Rev 3: 03.01 Access Control.

Family 3.2

Awareness and training

CMMC domain AT, 3 requirements (2 basic, 1 derived). Rev 3: 03.02 Awareness and Training.

3.2.1AT.L2-3.2.1
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Basic
3.2.2AT.L2-3.2.2
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
Basic
3.2.3AT.L2-3.2.3
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Derived

Family 3.3

Audit and accountability

CMMC domain AU, 9 requirements (2 basic, 7 derived). Rev 3: 03.03 Audit and Accountability.

3.3.1AU.L2-3.3.1
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Basic
3.3.2AU.L2-3.3.2
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
Basic
3.3.3AU.L2-3.3.3
Review and update logged events.
Derived
3.3.4AU.L2-3.3.4
Alert in the event of an audit logging process failure.
Derived
3.3.5AU.L2-3.3.5
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Derived
3.3.6AU.L2-3.3.6
Provide audit record reduction and report generation to support on-demand analysis and reporting.
Derived
3.3.7AU.L2-3.3.7
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
Derived
3.3.8AU.L2-3.3.8
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Derived
3.3.9AU.L2-3.3.9
Limit management of audit logging functionality to a subset of privileged users.
Derived

Family 3.4

Configuration management

CMMC domain CM, 9 requirements (2 basic, 7 derived). Rev 3: 03.04 Configuration Management.

3.4.1CM.L2-3.4.1
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Basic
3.4.2CM.L2-3.4.2
Establish and enforce security configuration settings for information technology products employed in organizational systems.
Basic
3.4.3CM.L2-3.4.3
Track, review, approve or disapprove, and log changes to organizational systems.
Derived
3.4.4CM.L2-3.4.4
Analyze the security impact of changes prior to implementation.
Derived
3.4.5CM.L2-3.4.5
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
Derived
3.4.6CM.L2-3.4.6
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
Derived
3.4.7CM.L2-3.4.7
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Derived
3.4.8CM.L2-3.4.8
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
Derived
3.4.9CM.L2-3.4.9
Control and monitor user-installed software.
Derived

Family 3.5

Identification and authentication

CMMC domain IA, 11 requirements (2 basic, 9 derived). Rev 3: 03.05 Identification and Authentication.

3.5.1IA.L2-3.5.1
Identify system users, processes acting on behalf of users, and devices.
Basic, Level 1 too
3.5.2IA.L2-3.5.2
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
Basic, Level 1 too
3.5.3IA.L2-3.5.3
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
Derived
3.5.4IA.L2-3.5.4
Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.
Derived
3.5.5IA.L2-3.5.5
Prevent reuse of identifiers for a defined period.
Derived
3.5.6IA.L2-3.5.6
Disable identifiers after a defined period of inactivity.
Derived
3.5.7IA.L2-3.5.7
Enforce a minimum password complexity and change of characters when new passwords are created.
Derived
3.5.8IA.L2-3.5.8
Prohibit password reuse for a specified number of generations.
Derived
3.5.9IA.L2-3.5.9
Allow temporary password use for system logons with an immediate change to a permanent password.
Derived
3.5.10IA.L2-3.5.10
Store and transmit only cryptographically-protected passwords.
Derived
3.5.11IA.L2-3.5.11
Obscure feedback of authentication information.
Derived

Family 3.6

Incident response

CMMC domain IR, 3 requirements (2 basic, 1 derived). Rev 3: 03.06 Incident Response.

3.6.1IR.L2-3.6.1
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Basic
3.6.2IR.L2-3.6.2
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Basic
3.6.3IR.L2-3.6.3
Test the organizational incident response capability.
Derived

Family 3.7

Maintenance

CMMC domain MA, 6 requirements (2 basic, 4 derived). Rev 3: 03.07 Maintenance.

3.7.1MA.L2-3.7.1
Perform maintenance on organizational systems.
Basic
3.7.2MA.L2-3.7.2
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Basic
3.7.3MA.L2-3.7.3
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Derived
3.7.4MA.L2-3.7.4
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
Derived
3.7.5MA.L2-3.7.5
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
Derived
3.7.6MA.L2-3.7.6
Supervise the maintenance activities of maintenance personnel without required access authorization.
Derived

Family 3.8

Media protection

CMMC domain MP, 9 requirements (3 basic, 6 derived). Rev 3: 03.08 Media Protection.

3.8.1MP.L2-3.8.1
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Basic
3.8.2MP.L2-3.8.2
Limit access to CUI on system media to authorized users.
Basic
3.8.3MP.L2-3.8.3
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Basic, Level 1 too
3.8.4MP.L2-3.8.4
Mark media with necessary CUI markings and distribution limitations.
Derived
3.8.5MP.L2-3.8.5
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Derived
3.8.6MP.L2-3.8.6
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
Derived
3.8.7MP.L2-3.8.7
Control the use of removable media on system components.
Derived
3.8.8MP.L2-3.8.8
Prohibit the use of portable storage devices when such devices have no identifiable owner.
Derived
3.8.9MP.L2-3.8.9
Protect the confidentiality of backup CUI at storage locations.
Derived

Family 3.9

Personnel security

CMMC domain PS, 2 requirements (2 basic, 0 derived). Rev 3: 03.09 Personnel Security.

3.9.1PS.L2-3.9.1
Screen individuals prior to authorizing access to organizational systems containing CUI.
Basic
3.9.2PS.L2-3.9.2
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
Basic

Family 3.10

Physical protection

CMMC domain PE, 6 requirements (2 basic, 4 derived). Rev 3: 03.10 Physical Protection.

3.10.1PE.L2-3.10.1
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Basic, Level 1 too
3.10.2PE.L2-3.10.2
Protect and monitor the physical facility and support infrastructure for organizational systems.
Basic
3.10.3PE.L2-3.10.3
Escort visitors and monitor visitor activity.
Derived, Level 1 too
3.10.4PE.L2-3.10.4
Maintain audit logs of physical access.
Derived, Level 1 too
3.10.5PE.L2-3.10.5
Control and manage physical access devices.
Derived, Level 1 too
3.10.6PE.L2-3.10.6
Enforce safeguarding measures for CUI at alternate work sites.
Derived

Family 3.11

Risk assessment

CMMC domain RA, 3 requirements (1 basic, 2 derived). Rev 3: 03.11 Risk Assessment.

3.11.1RA.L2-3.11.1
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Basic
3.11.2RA.L2-3.11.2
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Derived
3.11.3RA.L2-3.11.3
Remediate vulnerabilities in accordance with risk assessments.
Derived

Family 3.12

Security assessment

CMMC domain CA, 4 requirements (4 basic, 0 derived). Rev 3: 03.12 Security Assessment and Monitoring.

3.12.1CA.L2-3.12.1
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Basic
3.12.2CA.L2-3.12.2
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
Basic
3.12.3CA.L2-3.12.3
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Basic
3.12.4CA.L2-3.12.4
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
Basic

Family 3.13

System and communications protection

CMMC domain SC, 16 requirements (2 basic, 14 derived). Rev 3: 03.13 System and Communications Protection.

Family 3.14

System and information integrity

CMMC domain SI, 7 requirements (3 basic, 4 derived). Rev 3: 03.14 System and Information Integrity.

3.14.1SI.L2-3.14.1
Identify, report, and correct system flaws in a timely manner.
Basic, Level 1 too
3.14.2SI.L2-3.14.2
Provide protection from malicious code at designated locations within organizational systems.
Basic, Level 1 too
3.14.3SI.L2-3.14.3
Monitor system security alerts and advisories and take action in response.
Basic
3.14.4SI.L2-3.14.4
Update malicious code protection mechanisms when new releases are available.
Derived, Level 1 too
3.14.5SI.L2-3.14.5
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
Derived, Level 1 too
3.14.6SI.L2-3.14.6
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
Derived
3.14.7SI.L2-3.14.7
Identify unauthorized use of organizational systems.
Derived

Questions about the controls

Questions

Are NIST 800-171 controls and requirements the same thing?

Yes, in everyday use. NIST calls them security requirements, and “controls” is the word most people search for. The two are related: NIST SP 800-171 requirements are derived from FIPS 200 and the moderate security control baseline in NIST SP 800-53. CMMC also says requirements, and calls the families domains.

How many controls are in NIST 800-171?

Rev 2 has 110 requirements in 14 families: 31 basic and 79 derived. NIST SP 800-171 Rev 3 (May 2024) has 97 requirements in 17 families (130 numbers, 33 marked withdrawn). DoD binds NIST SP 800-171 Rev 2: Part 170 incorporates Rev 2, and the deviated 7012 names ‘Revision 2’. That is why this list stays on Rev 2; see CMMC vs NIST SP 800-171 for how the two fit together.

Do basic requirements count for more than derived ones?

No. The label records where NIST took the requirement from, and every one of the 110 is required. DoD's point values are set requirement by requirement and ignore the label: 3.1.1 (basic) and 3.1.12 (derived) are both worth 5 in the SPRS score calculator.

Which requirements does CMMC Level 1 share?

The 17 rows marked “Level 1 too”. Tick “Only rows marked Level 1 too” in the search box above to see them together, or read the Level 1 guide for the FAR wording.

Can I link to one requirement?

Yes. Every row has its own address: the requirement number with dots turned into dashes, such as #req-3-5-3 for multifactor authentication, and every family has one too, such as #family-sc. Our POA&M template and SSP template cite requirements by the same numbers.

How we read the sources

Every statement on this page is quoted or closely paraphrased from the sources below, read on 2026-10-23: rule text is the rule's, an agency's or a vendor's statements are given as theirs, and a FedRAMP status is the Marketplace's. Where we add advice or examples of our own, the page says so.

The requirement text on this page is NIST's, word for word, from the same data our SPRS calculator and POA&M template use; we checked all of it against NIST's export on 2026-10-23. The basic and derived labels are NIST's marks; the short explanations around the list are ours.

CuiDeck is not a C3PAO, an assessor or a law firm. This page explains what these sources say; your contract and your contracting officer decide what applies to you.