NIST SP 800-171 — the 110 controls every CUI-handling contractor lives by.

NIST Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," defines the security requirements that contractors must meet when they store, process, or transmit Controlled Unclassified Information (CUI) on their own systems.

Revision 2, the current assessable baseline, contains 110 controls across 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

800-171 was derived from the NIST 800-53 Moderate baseline, tailored down to the controls relevant to protecting CUI when it lives outside federal systems. It is the standard that DFARS 252.204-7012 requires defense contractors to implement, and the technical substance that CMMC Level 2 assesses.

Any organization that handles Controlled Unclassified Information under a federal contract. In the defense world, that means any contractor or subcontractor whose contract includes DFARS 252.204-7012, which is a large share of the Defense Industrial Base. For scale, DoD's own estimate in the CMMC final rule is that roughly 76,600 entities will require a CMMC Level 2 certification assessment, with a further 4,000 at Level 2 self-assessment and 1,487 at Level 3.

The reach extends through the supply chain. A prime contractor flows the requirement down to subcontractors at any tier that touches CUI. A small machine shop, a software vendor, a logistics provider — if CUI passes through their systems, 800-171 applies.

Beyond DoD, NIST 800-171 is becoming the default federal CUI baseline. GSA's 2026 civilian-contractor CUI rule draws on the same 800-171 foundation, meaning contractors serving civilian agencies are increasingly subject to equivalent requirements.

DFARS requires contractors to submit a NIST 800-171 self-assessment score to the Supplier Performance Risk System (SPRS). The score starts at 110 and subtracts weighted points for each control not fully implemented: some controls are worth 1 point, others 3 or 5, reflecting their security impact. A perfect implementation scores 110; significant gaps can produce sharply negative scores.

The SPRS score is what contracting officers check before award, and it is the figure that False Claims Act enforcement now scrutinizes. A self-asserted score materially higher than what an honest assessment would produce is, in the Department of Justice's reading, a false claim, actionable even without a breach. Eight cyber-fraud settlements landed in 2025.

We treat the SPRS score as an output of a real assessment, not a number to optimize. A defensible score is one you could re-derive in front of an assessor.

NIST published 800-171 Revision 3, but CMMC Level 2 is still assessed against Revision 2, and 32 CFR 170.2 incorporates Revision 2 by reference. DoD staged the transition by publishing Organization-Defined Parameters ahead of formal rulemaking, but it has published no date: the CMMC final rule says only that Rev 3 "is not currently applicable to this rule" and that DoD "will issue future amendments to this rule to incorporate the current version at that time." Treat any specific migration year you see quoted as trade-press expectation, not a DoD commitment.

Rev 3 restructures the catalog. It adds three control families: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR). That aligns it more closely with NIST 800-53 Rev 5, and it introduces Organization-Defined Parameters that let organizations specify implementation details.

The practical guidance for 2026: build to Rev 2, because it is what 32 CFR 170.2 incorporates and what any assessment — self or third-party — is scored against. That did not change when the Phase 2 transition was suspended on July 13, 2026; the CIO memo is explicit that the Department "will continue enforcing baseline compliance with NIST SP 800-171 Rev 2 through DIB self-assessments and select government-led assessments." Track the Rev 3 delta anyway. Tier-1 primes are starting to ask subs about Rev 3 readiness in pre-award evaluations even where Rev 2 remains the contractual baseline.

The program that carries into CMMC. Implementing 800-171 well is implementing CMMC Level 2 well: the 110 controls are identical. We design the program once, to assessor grade, so the same evidence and documentation support both the SPRS score and a C3PAO assessment. No throwaway work.

Authorship-level CMMC knowledge. A member of our team contributed to the CMMC standard at the Department of Defense in 2019. The 800-171-to-CMMC relationship is not abstract to us; we helped shape how the controls are assessed.

Evidence-as-byproduct design. A defensible 800-171 posture produces audit-grade artifacts as a byproduct of operations, not a reconstruction exercise at assessment time. That discipline is the difference between a score you can defend and a score that invites scrutiny.

Honest SPRS scoring. We score against reality, not aspiration. A score we help you submit is one you could re-derive in front of a C3PAO or, if it comes to it, a DOJ inquiry.