What Is NIST SP 800-171 (Protecting Controlled Unclassified Information)?

NIST SP 800-171 defines what adequate security looks like when CUI leaves government systems and lives on contractor networks. Revision 2 organizes 110 requirements into 14 families, including access control, identification and authentication, incident response, system and communications protection, and security assessment. The requirements were derived from the moderate baseline of NIST SP 800-53 and tailored to what a nonfederal organization is expected to control.

The publication applies to any nonfederal organization that processes, stores, or transmits CUI on its own systems, which in defense contracting is imposed through DFARS 252.204-7012 and verified through DoD Assessment Methodology scores in SPRS and, under CMMC Level 2, through assessments. Federal civilian agencies also reference it in contracts involving CUI.

One version note matters for planning. NIST published Revision 3 in 2024 with a restructured requirement set, but the DoD issued a class deviation in May 2024 keeping Revision 2 as the contractual baseline, and Rev 3 has not been adopted for DFARS or CMMC assessments as of mid-2026. Contractors should implement and score against Rev 2 while tracking Rev 3 as the likely future state. For how the publication relates to certification, see NIST 800-171 vs CMMC, and for scoping and cost, CMMC Level 2 requirements for small business.