What is NIST 800-171?
NIST Special Publication 800-171 defines 110 security requirements for protecting Controlled Unclassified Information (CUI) when it is stored, processed, or transmitted by non-federal organizations. It is a key requirement for US defense contractors and subcontractors.
Control Families
The standard organizes requirements into 14 families:
- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical Protection
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity
Relationship to CMMC
CMMC Level 2 is directly aligned with NIST SP 800-171. Organizations that fully implement NIST 800-171 will meet the technical requirements for CMMC Level 2 certification.
Back to Glossary