NIST SP 800-171 — the 110 controls every CUI-handling contractor lives by.

NIST Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," defines the security requirements that contractors must meet when they store, process, or transmit Controlled Unclassified Information (CUI) on their own systems.

Revision 2 — the current assessable baseline — contains 110 controls across 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

800-171 was derived from the NIST 800-53 Moderate baseline, tailored down to the controls relevant to protecting CUI when it lives outside federal systems. It is the standard that DFARS 252.204-7012 requires defense contractors to implement, and the technical substance that CMMC Level 2 assesses.

Any organization that handles Controlled Unclassified Information under a federal contract. In the defense world, that means any contractor or subcontractor whose contract includes DFARS 252.204-7012 — which, in practice, is the majority of the roughly 76,600 organizations in the CUI-handling Defense Industrial Base.

The reach extends through the supply chain. A prime contractor flows the requirement down to subcontractors at any tier that touches CUI. A small machine shop, a software vendor, a logistics provider — if CUI passes through their systems, 800-171 applies.

Beyond DoD, NIST 800-171 is becoming the default federal CUI baseline. GSA's 2026 civilian-contractor CUI rule draws on the same 800-171 foundation, meaning contractors serving civilian agencies are increasingly subject to equivalent requirements.

DFARS requires contractors to submit a NIST 800-171 self-assessment score to the Supplier Performance Risk System (SPRS). The score starts at 110 and subtracts weighted points for each control not fully implemented — some controls are worth 1 point, others 3 or 5, reflecting their security impact. A perfect implementation scores 110; significant gaps can produce sharply negative scores.

The SPRS score is what contracting officers check before award, and it is the figure that False Claims Act enforcement now scrutinizes. A self-asserted score materially higher than what an honest assessment would produce is, in the Department of Justice's reading, a false claim — actionable even without a breach. Six cyber-fraud settlements have landed in FY26 to date, on top of seven in 2025.

We treat the SPRS score as an output of a real assessment, not a number to optimize. A defensible score is one you could re-derive in front of an assessor.

NIST published 800-171 Revision 3, but CMMC Level 2 is still assessed against Revision 2. DoD staged the Rev 3 transition by publishing Organization-Defined Parameters ahead of formal rulemaking, and practitioner consensus now expects Rev 3 rulemaking in late 2026 to early 2027.

Rev 3 restructures the catalog: it adds three control families — Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR) — aligning more closely with NIST 800-53 Rev 5, and introduces Organization-Defined Parameters that let organizations specify implementation details.

The practical guidance for 2026: build to Rev 2, because that is what C3PAOs assess against through the first wave of CMMC Phase 2 enforcement. But track the Rev 3 delta — Tier-1 primes are starting to ask subs about Rev 3 readiness in pre-award evaluations even where Rev 2 remains the contractual baseline.

The program that carries into CMMC. Implementing 800-171 well is implementing CMMC Level 2 well — the 110 controls are identical. We design the program once, to assessor grade, so the same evidence and documentation support both the SPRS score and a C3PAO assessment. No throwaway work.

Authorship-level CMMC knowledge. A member of our team contributed to the CMMC standard at the Department of Defense in 2019. The 800-171-to-CMMC relationship is not abstract to us; we helped shape how the controls are assessed.

Evidence-as-byproduct design. A defensible 800-171 posture produces audit-grade artifacts as a byproduct of operations, not a reconstruction exercise at assessment time. That discipline is the difference between a score you can defend and a score that invites scrutiny.

Honest SPRS scoring. We score against reality, not aspiration. A score we help you submit is one you could re-derive in front of a C3PAO or, if it comes to it, a DOJ inquiry.