Glossary

NIST SP 800-171

NIST SP 800-171 is the National Institute of Standards and Technology’s publication specifying how Controlled Unclassified Information (CUI) must be protected in nonfederal systems — contractor networks, not government ones. Defense contract clauses have required it for years; the Cybersecurity Maturity Model Certification (CMMC) program now verifies it instead of taking your word.

Assemble Your GRC Team

Last updated July 26, 2026

What the control set asks for

The publication translates federal security expectations into requirements a commercial company can implement, organized into families spanning access control, awareness and training, incident response, media protection, system and communications protection, and system and information integrity, among others. Requirements are outcome-focused — enforce least privilege, control the flow of sensitive information, monitor and log activity — leaving the mechanism to you. Scope follows the data: only systems that store, process, or transmit Controlled Unclassified Information (CUI) must meet the bar, which makes boundary design the highest-leverage decision in the whole program.

Self-assessment, and what changed with CMMC

For years compliance ran on the honor system: contractors self-assessed against the requirements, computed a score under the Department of Defense’s assessment methodology, and posted it to the department’s Supplier Performance Risk System (SPRS). Self-reported scores often failed to survive contact with an actual review, and the Cybersecurity Maturity Model Certification (CMMC) program is the correction: at Level 2, most contractors must now demonstrate implementation to a C3PAO instead of grading their own homework. The paperwork carries over — a current System Security Plan and Plan of Action and Milestones (POA&M) are required artifacts either way.

Where teams start

The sequence rarely varies: map where CUI actually lives, shrink that footprint hard, run a gap assessment against the requirements, then work remediation in risk order while the documentation catches up. It is unglamorous, sequenced work, and it is exactly what Agency’s federal-track programs deliver — phasing, staffing, and timeline are on the CMMC compliance page.

Keep exploring

CMMC 2.0

The certification program that verifies 800-171 implementation.

CUI

The data category that pulls systems into 800-171 scope.

CMMC Compliance Program

Agency’s phased path from gap assessment to certification readiness.

Government

From self-assessed to verified

Agency closes 800-171 gaps and builds the evidence a certification assessment expects. 500+ programs delivered.

Assemble Your GRC Team