What is NIST SP 800-171? The CUI standard, Rev 2 and Rev 3

What the standard is for

Federal agencies must protect controlled unclassified information on their own systems to NIST's standards. When they hand that information to a contractor, NIST's view is that the duty does not change, so the contractor's systems need a similar level of protection. NIST SP 800-171 is that level, written down for systems the government does not own. NIST calls them nonfederal systems: anything that is not a federal system, which includes every laptop and server in a private shop. If the information itself is new to you, what is CUI covers it.

NIST did not invent the requirements from scratch. It started from the moderate baseline of SP 800-53, the control catalog federal systems use, and cut what does not fit a contractor: controls that are the government's own job, controls that do not protect confidentiality, and controls already covered by another one. The starting point matters: NIST treats CUI as no less than moderate impact, so the list is sized for that. The first edition, in June 2015, was written by NIST staff with co-authors from the National Archives; Rev 3 is by two NIST authors, Ron Ross and Victoria Pillitteri.

That separate security domain is the idea behind every CUI enclave: put the CUI on a few machines behind their own boundary and the requirements stop at that line. CMMC turns it into formal asset categories, which the CMMC scoping worksheet walks through.

Read that twice, because it settles most arguments about the standard. NIST writes the requirements and calls them recommended; it does not enforce them, certify anyone or decide which revision you follow. The agency does that, through the contract. The same FAQ adds that the protection is needed “irrespective of the organization's size”, so a ten-person machine shop gets no shorter list than a prime.

Four editions, and what DoD did with each

The standard has had four editions in nine years. Which one binds you is set by DoD's rules, not by NIST's publication date, and today the two point at different editions. That gap explains the most common confusion about 800-171: which version is “the” standard depends on whether you ask NIST or read your contract.

For a DoD contract today, the clause and the CMMC rule name the revision, and the revision they name is Rev 2. A newer NIST text is a preview of where the rule may go, not a change to what you owe today.

Rev 2 vs Rev 3: what actually changed

Rev 3 has fewer requirements and asks for more. NIST folded many short Rev 2 requirements into longer, multi-part ones, rewrote them in the language of SP 800-53, added three families and left blanks for the values each organization must set. NIST's own change analysis marks 19 requirements as new and only 18 as carried over with no significant change. Fewer numbers, more to show an assessor.

The family counts show where the folding happened. Access Control lost 6 requirements and System and Communications Protection 6; Configuration Management and Incident Response gained. The requirement-by-requirement list for Rev 2, the one you are assessed on, is in the 110 controls by family.

Fig. 02

Counts hide the real change, which is in the wording. Pick a requirement below to read it both ways: the purple blocks in the Rev 3 text are the parameters an organization fills in.

Organization-defined parameters: the blanks in Rev 3

The biggest new idea in Rev 3 is the organization-defined parameter, or ODP. Where a Rev 2 requirement said “limit unsuccessful logon attempts”, Rev 3 leaves a blank for the number, a blank for the time window and a menu for what happens next. Whoever fills the blanks turns a general requirement into a specific one, and the value becomes part of the requirement an assessor checks.

Who fills them in is the question every shop asks, and NIST answers it plainly: not NIST. An agency, or a group of agencies, can set the values; if none does, the contractor must set them itself to complete the requirement. NIST's FAQ adds a middle road, where the agency gives guidance and leaves the choice to you.

Withdrawn by NIST, still binding on DoD contracts

NIST withdrew Rev 2 on May 14, 2024, the day Rev 3 came out. For NIST that is housekeeping: a newer text replaces an older one. For a defense contractor it changes nothing, because NIST never decided which revision you follow. DoD does, and three documents pin it to Rev 2.

Why name the revision at all? Because the clause on the books points at whatever version is current:

On its own, that sentence follows NIST: a solicitation issued after May 2024 would point at whatever NIST calls current. The deviated clause and the CMMC rule remove the doubt by naming Rev 2 (our reading of how the pieces fit; your contracting officer has the last word). What comes next is on the record, but not yet in force:

So: build, document and score on Rev 2, and read Rev 3 as the plan for later. NIST publishes a change-analysis spreadsheet with Rev 3 that maps every Rev 2 requirement to its Rev 3 home and marks what changed, which is the cheapest way to see your future gap. If a requirement genuinely cannot apply to you, 7012 lets you ask to vary from it in writing to the contracting officer, for the DoD CIO to decide. The CMMC status page tracks the rule changes as they land.

NIST SP 800-171A: how each requirement is checked

A requirement says what to do; it does not say how anyone can tell you did it. That is the job of SP 800-171A, the companion volume. For every requirement it gives an assessment objective, a short list of statements that must all be true, and the methods an assessor may use to find out. NIST wrote it for self-assessments, third-party assessments and government assessments alike.

One requirement, six findings. Three of them are about knowing (who and what is authorized), three about enforcing. A shop that controls logins well but cannot say which devices may connect fails [c], and with it 3.1.1. The CMMC rule says so in its definitions:

Across all 110 Rev 2 requirements, 800-171A sets 320 objectives: 297 lettered ones like those above, and 23 requirements that have a single objective of their own. NIST withdrew this 2018 edition on the same day as Rev 2, and the CMMC rule incorporates it by its June 2018 date all the same. The NIST SP 800-171 checklist lists every objective, so you can mark each one and attach the evidence an assessor would examine.

From standard to score: CMMC Level 2 and SPRS

NIST stops at the requirements and the objectives. Everything after that is DoD's: the point values, the score, the place it is posted and the program that checks it. Four links connect the standard to a number your customer can look up.

CMMC Level 2 sits on top of the same four links. The rule says its requirements “are identical to the requirements in NIST SP 800-171 R2”, so the work does not change; what CMMC adds is the rulebook around the score: the minimum to hold a conditional status, which gaps may wait on a POA&M, and a senior official's signature. The CMMC vs NIST SP 800-171 page lays those differences side by side, and CMMC Level 2 requirements walks the 110 requirements with their point values.

Which DFARS text governs your SPRS entry depends on when the contract was written: new contracts under the class deviation carry a replacement for 252.204-7020, while contracts already awarded keep the clause versions they have. DFARS 252.204-7019 and -7020 sorts that out, and the SPRS score calculator does the arithmetic requirement by requirement.

Fig. 03

NIST SP 800-171 on one sheet

Everything above on one sheet. Print it for whoever owns your SSP.

Questions about NIST SP 800-171

How we read the sources