NIST SP 800-171 Guide: Protecting CUI (Rev. 2 vs Rev. 3, DFARS, CMMC)

Who it applies to

The requirements "apply to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components" (NIST). In practice, that means:

• DoD contractors and subcontractors under DFARS 252.204-7012, the clause on safeguarding covered defense information and reporting cyber incidents.
• Organizations whose civilian-agency contracts or agreements reference SP 800-171.
• Universities and research institutions that handle CUI under federal grants or contracts.

CUI is defined in 32 CFR 2002.4(h). The CUI Registry lists the categories.

Key requirements

Rev. 2 families (14)

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. Together they contain 110 requirements. Requirement 3.12.4 requires a System Security Plan (SSP). NIST says there's "no prescribed format" for it, but it must convey the required information (NIST CSRC).

What changed in Rev. 3

• There are now 17 families: Planning, System and Services Acquisition, and Supply Chain Risk Management were added.
• Requirements were consolidated, so many Rev. 2 items are now "Withdrawn" and folded into others.
• ODPs let "federal agencies and nonfederal organizations … specify values" such as review frequencies. Once specified, these values "become part of the requirement" (SP 800-171r3).
• Companion documents include SP 800-171A Rev. 3 (assessment procedures), SP 800-172 Rev. 3 (enhanced requirements), a change-analysis spreadsheet and a CUI overlay.

DFARS obligations around SP 800-171

• Incident reporting: DFARS 252.204-7012 requires you to "rapidly report", which means "within 72 hours of discovery of any cyber incident". You must hold a DoD-approved medium assurance certificate to report, and keep images and relevant monitoring data for at least 90 days after reporting (DFARS 252.204-7012).
• Assessment scores: DFARS 252.204-7019 requires current Basic, Medium or High NIST SP 800-171 DoD Assessment results, "not more than 3 years old", to be posted in the Supplier Performance Risk System (SPRS) (DFARS 252.204-7019).

Scoping CUI environments

Scope drives both cost and risk. The requirements cover every component that processes, stores or transmits CUI, and every component that protects those components: firewalls, identity providers, logging platforms and endpoint management tools. Common ways to keep scope manageable:

• Enclaves: a separate network, tenant or virtual desktop environment used only for CUI work.
• Data-flow mapping: follow CUI from the moment it's received (email, portals, file transfer) to where it's stored, processed and destroyed.
• Service-provider inventory: record which cloud, managed security and IT providers touch CUI or its protections, and what each one is responsible for.
• Shared-responsibility matrices: these show the assessor who implements each requirement.

Preparing for the Rev. 3 transition

DoD hasn't moved to Rev. 3 yet, but civilian agencies and future rules may. To prepare:

• Use NIST's Rev. 2 to Rev. 3 change-analysis spreadsheet to see which requirements are withdrawn, merged or new.
• Draft your values for the organization-defined parameters now. DoD has published its own ODP values for Rev. 3.
• Start the new supply chain risk management practices early, because they depend on supplier cooperation.

Assessment process and timeline

1. Scope the systems and components that handle CUI or protect them.
2. Document the SSP, plus a POA&M for any unmet requirements.
3. Self-assess with SP 800-171A procedures. For DoD work, score with the DoD Assessment Methodology (Basic Assessment).
4. Post the score and dates in SPRS.
5. Escalate where your contract requires it: DoD Medium or High assessments, or a CMMC Level 2 (C3PAO) certification.

There's no fixed duration. Timing depends on scope and on how many gaps you find.

Penalties

SP 800-171 itself carries no fines. Not meeting the DFARS requirements can make you ineligible for award, and it's a breach of contract. Misrepresenting your compliance in SPRS or in CMMC affirmations creates legal exposure. Get legal advice on how this applies to you.

Mapping to related frameworks

• CMMC Level 2: the 110 Rev. 2 requirements. Level 3 adds selected SP 800-172 requirements.
• NIST SP 800-53: the source catalogue that the SP 800-171 requirements are derived from.
• NIST CSF 2.0: use it for executive reporting on top of SP 800-171 controls.
• ISO/IEC 27001 and SOC 2: these overlap heavily on access, logging, change and incident controls, but they don't satisfy DFARS on their own.

Readiness checklist

1. Confirm which revision your contract requires. For DoD, it's Rev. 2 under the class deviation.
2. Identify CUI with the contracting officer and the CUI Registry, and map where it flows.
3. Minimize scope, for example with a CUI enclave.
4. Write the SSP and a network diagram.
5. Assess yourself against every requirement and record a POA&M.
6. Calculate the SPRS score and post it before you bid.
7. Get a medium assurance certificate and test the 72-hour reporting process.
8. Check that cloud and managed service providers meet the DFARS requirements.
9. Plan Rev. 3 changes (ODPs, supply chain) so the eventual transition is smooth.
10. Re-assess at least every three years, and sooner after major changes.

Common pitfalls

• Implementing Rev. 3 for DoD contracts and assuming that satisfies Rev. 2 scoring.
• An SPRS score with no SSP or evidence behind it.
• Forgetting the medium assurance certificate until an incident happens.
• Unscoped endpoints and SaaS tools that hold CUI.
• Treating POA&Ms as permanent.

How AssureCore helps

AssureCore's Controls Register can hold SP 800-171 requirements with linked evidence and expiry alerts. Action plans track POA&M items, and Cross-framework Mapping reuses work across CMMC, ISO 27001 and NIST CSF. You can export Audit Reports (PDF/CSV) for assessors.

Frequently asked questions

Official references

• NIST CSRC – SP 800-171 Rev. 3
• NIST SP 800-171r3 (PDF)
• NIST CSRC – SP 800-171 Rev. 2 (withdrawn)
• DoD – DFARS class deviation on SP 800-171 Rev. 2 (May 2024)
• DFARS 252.204-7012
• DFARS 252.204-7019
• DoD CIO – Organization-Defined Parameters for SP 800-171 Rev. 3 (PDF)

Related frameworks

• CMMC guide
• FedRAMP guide
• NIST CSF guide
• ISO 27001 guide