The security standard for protecting Controlled Unclassified Information (CUI) in non-federal systems. Required for US Department of Defense contractors and increasingly adopted across the federal supply chain.
What is NIST 800-171?
NIST Special Publication 800-171 Revision 2 defines 110 security requirements across 14 control families for protecting Controlled Unclassified Information (CUI) in non-federal information systems and organisations. It is a mandatory requirement for US Department of Defense contractors under DFARS clause 252.204-7012.
Organisations must self-assess their compliance and submit a score to the DoD Supplier Performance Risk System (SPRS). NIST 800-171 also forms the foundation for CMMC Level 2 certification, making it a critical baseline for defence contractors.
NIST published Revision 3 in May 2024, restructuring the standard into 97 requirements across 17 families and adding Planning, System and Services Acquisition, and Supply Chain Risk Management. It is not what you are assessed against. DoD Class Deviation 2024-O0013 keeps DFARS 252.204-7012 and CMMC Level 2 pointed at Revision 2, so your SPRS score is still calculated against the 110 requirements. Build to Revision 2, and read Revision 3 as a preview of where the baseline moves next.
Compliance requirements
NIST 800-171 organises its 110 requirements across 14 control families, each addressing a specific aspect of CUI protection.
Limit system access to authorised users and processes, and control the flow of CUI in accordance with approved authorisations.
Ensure personnel are aware of security risks associated with their activities and are trained to carry out assigned responsibilities.
Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorised activity.
Establish and maintain baseline configurations and inventories of organisational systems, and control changes to those systems.
Establish an operational incident-handling capability including preparation, detection, analysis, containment, recovery, and user response activities.
Periodically assess the risk to organisational operations, assets, and individuals resulting from the operation of systems and associated processing of CUI.
Monitor, control, and protect communications at external boundaries and key internal boundaries of systems processing CUI.
Audit process
Netru manages the complete NIST 800-171 compliance journey, from identifying your CUI environment through to SPRS score submission.
We identify all Controlled Unclassified Information (CUI) in your environment and define the system boundary for NIST 800-171 assessment.
We assess your current controls against all 110 security requirements across the 14 control families, producing a scored gap analysis.
We draft your System Security Plan documenting how each requirement is met, partially met, or not yet implemented.
We create a POA&M documenting deficiencies and a remediation timeline for requirements not yet fully implemented.
Your compliance manager guides implementation of required controls, with evidence collection throughout.
We conduct a formal assessment and calculate your SPRS score for submission to the DoD Supplier Performance Risk System.
How Netru delivers it
Our team has deep experience helping organisations achieve and maintain NIST 800-171 compliance. We scope your CUI environment, draft your SSP and POA&M, implement controls, and prepare you for SPRS submission and CMMC assessment.
Talk to our teamBefore you talk to anyone