NIST 800-171
The 110-control baseline for protecting Controlled Unclassified Information (CUI).
NIST Special Publication 800-171 defines 110 security requirements across 14 control families — from access control to system integrity. Every DoD contractor handling CUI is required to implement them under DFARS 252.204-7012.
NIST 800-171 is the foundation of CMMC Level 2. A self-assessment score against these controls (max 110) is what gets posted to SPRS.
Specify the revision before assessing
NIST publications change. Revision 3 reorganizes requirements and is not interchangeable with the Revision 2 baseline commonly referenced in CMMC Level 2 discussions. Confirm which revision your contract or assessment program requires before selecting a checklist, calculating a score, or mapping evidence.
Turn a requirement into an evidence trail
Consider access control: a written rule is only part of the implementation. You may also need account inventories, approval records, configuration settings, and records of review. Tie evidence to the systems and information in scope so a reader can understand what was tested and what remains outside the boundary.
Separate implementation from scoring
A readiness percentage, a contract-specific assessment score, and a formal certification result are different outputs. Do not convert one into another without the appropriate methodology. Use a gap record to track incomplete work, responsible people, dependencies, and supporting evidence; refer to the governing assessment rules for formal scoring.
Related terms
CMMC
The DoD's Cybersecurity Maturity Model Certification, mandatory across the defense supply chain.
CUI
Controlled Unclassified Information — unclassified but protected government data.
SPRS
The DoD's Supplier Performance Risk System — where your NIST 800-171 score lives.
POA&M
Plan of Action & Milestones — the roadmap for closing security control gaps.
See how Scarlet Risk covers NIST 800-171.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo