NIST SP 800-171: the 110 controls, in plain language

What the rule actually says

NIST Special Publication 800-171 answers one question: when controlled unclassified information sits on a system a private company owns and operates, how must that company protect it? Revision 2, published February 2020 and updated January 28, 2021, carries 110 security requirements grouped into fourteen families. That is the entire rule. Everything built around it, the DFARS clauses, the Supplier Performance Risk System score, the Cybersecurity Maturity Model Certification program, the assessor market, exists to prove a company did the 110.

Two definitions have to land before the controls make sense. Controlled unclassified information is government-created or government-owned information that is not classified but that law, regulation, or government-wide policy requires be safeguarded. Its scope is set by 32 CFR Part 2002 and enumerated in the National Archives CUI Registry, which lists the categories: export-controlled technical data, procurement-sensitive material, privacy information, critical infrastructure data, and dozens more. A vendor does not get to decide what is CUI. The agency does, and it does so through markings and contract language.

The second definition is nonfederal system. SP 800-171 applies to systems the government does not own. Federal systems answer to NIST SP 800-53 and the Risk Management Framework instead. That distinction is why a company can be told to satisfy 800-171 for its corporate laptops and 800-53 for a hosted product in the same year, with two different control sets and two different assessment paths.

Who it applies to, and through which clause

SP 800-171 is not self-executing. It reaches a company through a contract clause, and the clause matters more than the publication.

DFARS 252.204-7012. The Department of Defense clause on safeguarding covered defense information and cyber incident reporting. It requires "adequate security," which the clause defines as implementing NIST SP 800-171. It also carries obligations most vendors miss on first read: report cyber incidents through dibnet.dod.mil within 72 hours of discovery, preserve images of affected systems for at least 90 days, submit malicious software to the DoD Cyber Crime Center, and flow the clause down to subcontractors that will handle the same information.

DFARS 252.204-7019 and 252.204-7020. The assessment clauses. An offeror must have a current Basic Assessment, meaning one less than three years old, posted in SPRS before a contracting officer may award. The 7020 clause grants the government access to conduct Medium and High assessments and obliges a prime to confirm its subcontractors have their own scores on file.

DFARS 252.204-7021 and 32 CFR Part 170. The CMMC program rule, effective December 16, 2024, converts self-attestation into graded verification. Level 1 covers federal contract information under the fifteen requirements of FAR 52.204-21. Level 2 is the 110 requirements of SP 800-171 Rev 2, verified either by self-assessment or by a certified third-party assessment organization depending on the contract. Level 3 layers on selected enhanced requirements drawn from NIST SP 800-172 and is assessed by the government itself.

Civilian agencies. Outside DoD, coverage is thinner and moving. FAR 52.204-21 already applies broadly to federal contract information. A government-wide FAR rule extending uniform CUI handling to civilian contracts has been through proposed rulemaking, and many civilian solicitations already incorporate 800-171 by reference in the statement of work. Read the clause list on every award. The publication never binds a company by itself.

The fourteen families, in plain language

Read the families as engineering questions rather than legal text. Each one asks something a working system either does or does not do, and the requirement counts sum to 110.

Family	Count	What it asks in plain terms
Access control	22	Only approved people and processes reach CUI. Roles are defined, least privilege holds, remote sessions are routed and monitored, and public web content carries no CUI.
Awareness and training	3	People who touch CUI know the rules, know the insider-threat indicators, and can prove they were trained.
Audit and accountability	9	The system records who did what, keeps the records long enough to reconstruct an incident, protects them from tampering, and somebody actually reviews them.
Configuration management	9	There is a known-good baseline, changes go through a process, unnecessary services are off, and users cannot install whatever they like.
Identification and authentication	11	Every account maps to a real identity, credentials are strong and stored hashed, and multifactor authentication guards privileged and network access.
Incident response	3	A written plan exists, incidents get tracked and reported inside and outside the company, and the plan is exercised rather than filed.
Maintenance	6	Maintenance is controlled, tools are checked, remote maintenance sessions use multifactor authentication, and equipment leaving for repair is sanitized.
Media protection	9	Drives, backups, and paper holding CUI are marked, encrypted, tracked, and destroyed on a defined path. Removable media is controlled or prohibited.
Personnel security	2	People are screened before access, and access ends when employment or assignment does.
Physical protection	6	Facilities and equipment are limited to authorized people, visitors are escorted and logged, and remote work sites are covered too.
Risk assessment	3	Risk is assessed on a schedule, systems are scanned for vulnerabilities, and findings are remediated on a defined timeline.
Security assessment	4	Controls are tested for effectiveness, a system security plan exists, a plan of action tracks the gaps, and monitoring is continuous.
System and communications protection	16	The boundary is defined and defended, traffic is separated, CUI is encrypted in transit and at rest, and cryptography is FIPS-validated.
System and information integrity	7	Flaws are patched on a clock, malicious code protection is current, and the network is monitored for attacks and indicators.

Read that way, the set is not exotic. A well-run engineering organization already does most of configuration management, identification and authentication, and system integrity because those practices keep production alive. What 800-171 adds is scope discipline and evidence. The controls must apply everywhere CUI lives, including the laptop of the contractor who only joins for two sprints, and each one must be demonstrable to a stranger who was not there when it was built.

The artifacts that must exist

Assessors do not grade intentions. They grade documents, configurations, and records, and four artifacts carry most of the weight.

The system security plan. Required by 3.12.4. It defines the boundary, describes the environment, and states how each of the 110 requirements is met in that specific environment. Generic plans fail. A plan that says "the organization employs multifactor authentication" without naming the identity provider, the enforcement policy, and which account classes it covers gives an assessor nothing to verify.

The plan of action and milestones. Required by 3.12.2. Every requirement not fully implemented appears here with a remediation approach, an owner, and a date. Under CMMC rules, only a limited set of requirements are even eligible for a POA&M, the plan must close inside 180 days, and the highest-weight items cannot be deferred at all.

The incident response plan, exercised. Required by 3.6.1 through 3.6.3. The 72-hour DFARS reporting obligation makes this operational rather than theoretical. Reporting requires a DoD-approved medium assurance certificate, which takes weeks to obtain. A company that first learns this during an incident has already missed the window.

The assessment record and the score. The DoD Assessment Methodology starts a company at 110 and subtracts 1, 3, or 5 points for each requirement not implemented, with a floor of negative 203. Two requirements get partial credit rules: multifactor authentication at 3.5.3 and FIPS-validated cryptography at 3.13.11. The resulting number, the assessment date, the scope, and the projected date of full implementation are posted in SPRS. That posting is a representation to the government.

• System security plan covering all 110 requirements, environment-specific
• Plan of action with owners, dates, and closure evidence
• Incident response plan plus a medium assurance certificate already issued
• Assessment objective evidence mapped to NIST SP 800-171A procedures
• CUI data flow diagram and a written boundary definition
• External service provider inventory with FedRAMP status recorded
• Current SPRS entry with score, scope, and full-implementation date

The findings that come up again and again

Across published assessment guidance and the pattern our engineers see when we inherit a compliance program, the same gaps repeat.

FIPS-validated is not the same as encrypted. Requirement 3.13.11 asks for cryptography validated under the Cryptographic Module Validation Program. Strong ciphers from an unvalidated library do not satisfy it. The evidence is a certificate number, and the module must be running in its approved mode. This is one of the 5-point items, and it is failed constantly.

Multifactor authentication covers too few accounts. Requirement 3.5.3 reaches local and network access for privileged accounts and network access for all users. Firms commonly protect the VPN and the administrator console, then leave a code repository, a build server, or a file share on single-factor access.

Logs are collected but never reviewed. Requirement 3.3.5 expects correlated review and analysis. Shipping everything to a bucket nobody opens satisfies retention and fails the control.

Cloud services sit outside the boundary drawing. When an external cloud provider stores, processes, or transmits covered defense information, DFARS 252.204-7012 requires that provider to meet security requirements equivalent to the FedRAMP Moderate baseline. A collaboration tool or a managed database quietly added by a delivery team is the most common way a clean boundary goes stale.

Scope creeps beyond the enclave. A company builds a controlled environment, then a developer copies a marked file to a personal drive to work over a weekend. Scope is defined by where the data actually goes, not by where the architecture diagram says it goes.

The score was never updated. Scores expire at three years, and a score that no longer matches the environment is worse than a low score honestly reported.

What getting it wrong costs

There are two costs, and the second is the serious one.

The first is contractual. Without a current SPRS assessment, a contracting officer cannot make an award covered by DFARS 252.204-7019. A prime that cannot confirm a subcontractor's posture under 252.204-7020 will select a different subcontractor. As CMMC requirements phase into solicitations, a missing certification removes a company from consideration before any technical evaluation happens.

The second is legal. The Department of Justice opened its Civil Cyber-Fraud Initiative in October 2021 to pursue contractors that misrepresent cybersecurity posture, using the False Claims Act at 31 U.S.C. 3729. The statute carries treble damages plus a civil penalty for each false claim, with per-claim penalties adjusted annually for inflation and now exceeding fourteen thousand dollars at the low end. The settlements are public: Aerojet Rocketdyne paid $9 million in 2022, Verizon paid roughly $4.09 million in 2023, Penn State paid $1.25 million in 2024, and MORSE Corp, a defense software firm, paid $4.6 million in 2025 over 800-171 representations. Several of these began with whistleblower complaints filed by employees who knew the posted score was not real.

The lesson is narrow and worth stating plainly. A low score is a business problem. A score that overstates the truth is a legal exposure. Post what is real, carry the gaps openly in the plan of action, and close them on a schedule the company can defend.

A practical sequence for the first time through

The mistake most first-time programs make is starting with control text. Start with data instead. Find where CUI actually lives, shrink that footprint hard, then apply controls to what remains.

Two decisions inside that sequence do more work than all the others. The first is the enclave. A controlled environment holding only the systems that genuinely touch CUI reduces assessment scope, cost, and ongoing burden by a large factor compared with treating the whole company as in scope. The second is buying inheritance rather than building it. A government-community cloud tier and a managed identity platform deliver dozens of the 110 as documented, inheritable capability, which is faster and cheaper than assembling equivalent controls in-house and far easier to evidence.

Revision 2 or Revision 3

NIST published Revision 3 in May 2024. It restructures the requirements into seventeen families, adds planning, system and services acquisition, and supply chain risk management, and introduces organization-defined parameters that let an agency tune specific values. It is a better-organized document.

It is also not what most contracts currently require. The CMMC program rule at 32 CFR Part 170 is written against Revision 2, and DFARS 252.204-7012 continues to point there. Build against Revision 2 unless a specific contract says otherwise, and read Revision 3 in parallel so the transition is a mapping exercise rather than a restart. Where the two agree, and they mostly do, implement in the way Revision 3 describes. The underlying engineering is stable even while the numbering moves.

Bottom line

SP 800-171 rewards companies that treat it as system design instead of paperwork. Define a small boundary, buy inherited controls where they exist, implement the heavy requirements properly, document what was actually built, and report a number that matches reality. Done in that order, a first pass runs a few months and leaves a real security posture behind. Done backwards, starting from a spreadsheet of control text, it produces a thick binder, a score nobody can defend, and a finding on the first assessment.

Frequently asked questions