97 vs 110: NIST 800-171 Roadmap for U.S. Contractors

NIST SP 800-171 is the set of security requirements organizations must follow to protect Controlled Unclassified Information in nonfederal systems. Your first move is not buying a tool. It’s scoping where CUI lives and drafting a System Security Plan. Revision 3 is now the published standard, but most DoD and CMMC assessments still score against Revision 2, so evidence needs to work under both.

TL;DR:

• Most organizations should focus on scoping CUI and documenting specific controls, rather than rushing to buy security tools, to ensure effective compliance.
• Critical controls include implementing phishing-resistant multi-factor authentication, maintaining encryption at rest and in transit, and establishing a detailed incident response process with clear timelines.
• Evidence collection, policy documentation, and regular review of POA&Ms are essential to passing assessments and maintaining controls over time.
• Organizational parameters such as account lockout thresholds and log retention periods must be tailored based on actual risk and justified within the SSP.
• The current standard, Rev 3, streamlines requirements into 97 controls across 17 families, but many DoD assessments still rely on Rev 2, emphasizing the importance of aligning efforts accordingly.

Table of Contents

• What NIST 800-171 Controls Explained Actually Means for Your Organization
• Control Families: How Rev 3 Reorganized the Rulebook
• Which Controls Actually Move the Needle for CUI Protection
• How to Roll Out NIST 800-171 Requirements Step by Step
• Organization-Defined Parameters: Setting Values That Hold Up
• Scoring, Evidence, and the Rev 2 vs Rev 3 Reality for U.S. Contractors
• Pitfalls That Sink Assessments and a Checklist to Avoid Them
• Why Practice Experience Matters for CUI Protection Work
• Integrating NIST 800-171 Into Systems You Already Run
• Employee Training That Actually Supports Compliance
• Keeping Controls Working After the Assessment Ends
• Mapping NIST 800-171 to SP 800-53 and CMMC
• What Experience Teaches About Getting This Right
• Get Help Implementing These Controls Without Slowing Down Your Business
• Where to Verify These Requirements Directly
• Sources
• FAQ

What NIST 800-171 Controls Explained Actually Means for Your Organization

CUI is government-created or government-owned information that requires safeguarding under law, regulation, or agency policy, but isn’t classified. Think export-controlled technical drawings, unclassified defense contract specifications, or certain law enforcement data. If you’re not sure whether something qualifies, check the contract’s CUI markings or ask the contracting officer directly. Guessing wrong in either direction wastes money or creates real risk.

Who needs this? Any nonfederal organization that processes, stores, or transmits CUI on behalf of a federal agency. In practice that means:

• DoD prime contractors and their subcontractors handling defense-related CUI
• Contractors serving other federal agencies with CUI-bearing contracts
• Cloud and IT service providers hosting CUI for a covered contractor

The SP 800-171 Rev. 3 publication is the current authoritative text. It works alongside SP 800-171A, which defines assessment procedures, and it draws its underlying structure from NIST SP 800-53 and the impact categorization logic in FIPS 199 and FIPS 200.

Control Families: How Rev 3 Reorganized the Rulebook

Rev 2 organizes 110 requirements across 14 families. Rev 3 reorganizes the same protective intent into 97 requirements across 17 families, according to NIST’s Rev. 3 publication. Fewer numbered requirements, more precision in each one.

The 17 Rev 3 families are:

• Access Control, Awareness and Training, Audit and Accountability
• Configuration Management, Identification and Authentication
• Incident Response, Maintenance, Media Protection
• Personnel Security, Physical Protection, Risk Assessment
• Security Assessment and Monitoring, System and Communications Protection
• System and Information Integrity, Planning (new), System and Services Acquisition (new)
• Supply Chain Risk Management (new)

NIST added Planning, System and Services Acquisition, and Supply Chain Risk Management to align Rev 3 more tightly with SP 800-53’s control catalog. Rev 2’s 14 families cover the same core domains minus these three additions. The consolidation trims redundant requirement language while tightening what each control actually demands from your environment.

Which Controls Actually Move the Needle for CUI Protection

Not every requirement carries equal weight. A handful of controls do most of the real work of keeping CUI out of the wrong hands, and assessors know it.

1. Access control and least privilege. Rev 3 explicitly calls out phishing-resistant multifactor authentication for privileged accounts, a meaningful tightening from older MFA language, per NIST’s Rev. 3 documentation.
2. Encryption at rest and in transit. TLS for data moving across networks, IPsec for site-to-site links, and documented key management procedures. Weak or missing key rotation is a common finding.
3. Audit logging and monitoring. Log authentication events, privilege changes, and configuration modifications. Retain logs long enough to support incident investigation and protect them from tampering.
4. Incident response with defined timelines. Detection procedures, reporting chains, and a direct link between incidents and your POA&M when a gap caused the event.
5. Supply chain risk management. Rev 3’s new SR family expects evidence that you’re vetting vendors and subcontractors who touch CUI, not just your own internal systems.

Pro Tip: Assessors examine artifacts, not intentions. A policy document saying you require MFA means nothing without a configuration export or screenshot showing it enforced on the actual account.

How to Roll Out NIST 800-171 Requirements Step by Step

Implementation succeeds or fails on sequencing. Skip a step and you’ll redo work later.

1. Scope your CUI. Inventory every system, application, and storage location touching CUI. Segment it onto a smaller enclave where possible. Fewer systems in scope means fewer controls to prove.
2. Build the SSP. Map every requirement to the specific system component that satisfies it. Document your ODPs here, not in a side spreadsheet nobody updates.
3. Choose your assessment path. A self-assessment works for many basic-level obligations; a government or third-party assessment applies where the contract or CMMC level demands independent verification.
4. Stand up a POA&M. Every open gap gets an owner, a milestone date, and a remediation plan. Vague entries like “in progress” get flagged immediately.
5. Collect evidence continuously. Timestamp configuration exports, name files consistently, and assign a responsible owner for each artifact type.

Pro Tip: Set a recurring calendar reminder to refresh evidence every quarter instead of scrambling the month before an assessment. Stale screenshots are one of the fastest ways to lose assessor confidence.

Organization-Defined Parameters: Setting Values That Hold Up

ODPs let you set the actual numbers behind a requirement instead of following a one-size-fits-all default. Rev 3 embeds many ODPs in its requirements, according to NIST’s published guidance.

Common examples include:

• Account lockout thresholds after failed login attempts
• Log retention periods
• Password or credential review cadence
• Session timeout duration for inactive users

Pick values based on your actual risk posture, not a copied template. Document the rationale directly in the SSP so an assessor sees the reasoning, not just the number. Rev 3 also introduces tailoring symbols: NA marks a requirement as not applicable given your system’s characteristics, while ORC flags an organization-defined completion where you’ve implemented an equivalent control. Use both sparingly and back every one with a written justification.

Scoring, Evidence, and the Rev 2 vs Rev 3 Reality for U.S. Contractors

The DoD Assessment Methodology scores organizations against the 110 Rev 2 requirements, producing a number reported to the Supplier Performance Risk System, or SPRS. Basic assessments are self-reported; medium and high confidence assessments involve government or third-party verification of evidence.

Here’s the friction point for compliance teams: Rev 3 is the current NIST publication, but Class Deviation guidance from the DoD has preserved Rev 2 as the operative reference for many DFARS clauses, and CMMC Level 2 currently maps to Rev 2 requirements rather than Rev 3.

Practical takeaways:

• Implement to Rev 2’s 110 requirements now if you have active DoD contract obligations
• Structure your SSP and evidence library so items remap cleanly to Rev 3’s 97-requirement, 17-family structure when DoD assessments shift
• Budget realistically. Mid-size contractors starting from significant gaps often need well over a year of sustained effort to reach a defensible posture

Pitfalls That Sink Assessments and a Checklist to Avoid Them

Most failed assessments trace back to the same handful of mistakes, repeated across industries.

• Unclear CUI scope. Teams flag entire networks as in-scope because nobody drew a boundary, multiplying the work.
• Undocumented ODPs. A value exists in a config file but no rationale exists anywhere an assessor can find it.
• Weak MFA choices. SMS-based codes instead of phishing-resistant methods on privileged accounts.
• Thin POA&M entries. “Working on it” with no owner and no date.
• Mis-scoped SaaS tools. Cloud applications holding CUI that nobody accounted for during the inventory phase.

Prioritized checklist: confirm scope first, refresh the SSP second, close MFA and encryption gaps third, verify logging fourth, and keep the POA&M current throughout. Typical remediation windows for organizations starting from weak baseline controls run well beyond a single quarter, which is exactly why early scoping matters more than any single technical fix.

Why Practice Experience Matters for CUI Protection Work

Tatemweb brings direct CMMC Level 2 consulting experience to Florida contractors navigating this exact process, including SSP development, POA&M management, and staff cybersecurity training. The team has guided small and mid-size businesses through scoping, documentation, and assessment prep for organizations serving DoD and federal contracts.

Integrating NIST 800-171 Into Systems You Already Run

Retrofitting security requirements onto infrastructure that predates the compliance mandate is where most projects stall. Legacy file servers, unmanaged endpoints, and shadow IT tools all complicate scoping because nobody documented what touches CUI when those systems went live years ago.

The most common integration challenge is scope creep across shared infrastructure. A single Active Directory domain serving both CUI and non-CUI business functions forces every connected system into your assessment boundary. The fix is network segmentation: isolate CUI-handling systems onto a dedicated enclave with its own authentication boundary, rather than trying to secure an entire flat network to the same standard. This single architectural decision often determines whether a project takes months or years.

Legacy applications that can’t support modern authentication present another recurring problem. Rather than forcing a risky rip-and-replace, many contractors wrap older systems behind a modern access gateway that enforces MFA and logging at the perimeter, satisfying the requirement without touching the application code.

Best practice here favors incremental rollout over a single “big bang” migration. Start with the systems that actually touch CUI, get those fully compliant and documented, then expand outward. Trying to harden your entire enterprise network simultaneously usually means nothing gets finished on schedule. Change management also matters more than most technical teams expect. IT staff who’ve run the same configuration for a decade will resist new logging requirements or session timeout policies unless leadership frames the change as protecting contract revenue, not adding friction.

Employee Training That Actually Supports Compliance

Awareness and Training is one of Rev 3’s 17 control families, and it’s frequently underinvested compared to technical controls. A firewall doesn’t stop an employee from emailing a CUI-bearing spreadsheet to a personal account.

Effective training programs cover three layers. General security awareness reaches every employee, covering phishing recognition, password hygiene, and physical security basics. Role-based training targets people who handle CUI directly, teaching them what qualifies as CUI, how to mark and store it, and who to notify if they suspect a breach. Insider threat awareness, a specific Rev 3 expectation, trains managers and IT staff to recognize behavioral indicators that warrant escalation.

Timing matters as much as content. Training at hire is a baseline; annual refreshers are the minimum cadence assessors expect to see documented. Track completion with dates and names, because “we trained everyone” without a signed log is not evidence an assessor will accept.

Pro Tip: Run a short tabletop exercise once a year where staff practice reporting a mock incident. It surfaces confusion about escalation paths faster than any slide deck.

Keeping Controls Working After the Assessment Ends

Passing an assessment is a snapshot. Controls degrade the moment nobody’s watching, through configuration drift, staff turnover, and new software nobody vetted before deployment.

Continuous monitoring means automating what you can. Log aggregation tools that flag anomalous login patterns, configuration management systems that alert on unauthorized changes, and scheduled vulnerability scans all reduce the manual burden of staying compliant between formal assessments. Assign a specific owner to review these alerts weekly, not “whenever someone has time.”

Treat your POA&M as a living document rather than a project-closeout artifact. New gaps surface constantly: a new SaaS tool gets adopted, a vendor relationship changes, an employee with privileged access leaves without a clean offboarding process. Each of these needs to land on the POA&M with the same rigor as an original assessment finding.

Schedule an internal self-assessment at least annually, independent of any government-driven timeline, to catch drift before an external assessor does. Reassign artifact ownership when staff change roles. Evidence that had a clear owner a year ago and now has none is one of the fastest ways compliance posture quietly erodes.

Mapping NIST 800-171 to SP 800-53 and CMMC

NIST 800-171’s 97 requirements in Rev 3 derive directly from a moderate-baseline subset of SP 800-53’s much larger control catalog, tailored for nonfederal systems handling CUI rather than federal information systems. If your organization also holds federal agency contracts requiring FISMA-level controls, understanding this lineage helps you avoid building two disconnected compliance programs when one architecture largely satisfies both.

CMMC Level 2 is where the DoD-specific relevance concentrates: it currently assesses against the same 110 requirements found in Rev 2, formalized through a certification process rather than the self-attestation model many contractors used previously. Contractors working through a CMMC Level 2 checklist are, in practice, implementing NIST 800-171 controls under a different name and a stricter verification model.

Beyond DoD, other federal agencies increasingly reference SP 800-171 in contract clauses even without a formal CMMC-style certification requirement, borrowing the same control language because it’s already the established federal standard for nonfederal CUI protection. Building your compliance architecture around the NIST control set, rather than around any single agency’s certification program, positions you to satisfy multiple contract requirements without maintaining separate documentation for each one.

What Experience Teaches About Getting This Right

Most compliance failures aren’t technical. They’re sequencing failures, where teams buy security tools before they’ve scoped what actually needs protecting. Start with scoping and evidence discipline, not procurement.

Build your documentation so it remaps from Rev 2 to Rev 3 without a rewrite. Run assessments incrementally, and keep the POA&M alive long after the first passing score.

— Matt

Get Help Implementing These Controls Without Slowing Down Your Business

Reading through 97 requirements and mapping them to your actual systems is a real time investment most internal IT teams don’t have to spare on top of daily operations. Services are offered to assist contractors with scoping CUI, building the SSP, structuring a POA&M with realistic milestones, and delivering necessary staff training.

Where the process gets slower than it needs to be is usually evidence management. That’s where AI-driven cybersecurity consulting helps: automating configuration exports, log retention checks, and documentation upkeep so your team isn’t manually screenshotting settings every quarter. Combine that with hands-on CMMC Level 2 consulting and role-based cybersecurity training, and you get a compliance program that survives staff turnover instead of collapsing the moment one person leaves.

If you’re staring at a contract deadline and an incomplete SSP, call 772-224-8118 to schedule a scoping consultation, or start with the AI cybersecurity services overview to see what a guided assessment looks like before you commit.

Where to Verify These Requirements Directly

• SP 800-171 Rev. 3, the current NIST publication
• NIST SP 800-171 Revision 2, still the DoD assessment baseline
• NIST implementation primer and supporting guidance covering SP 800-171A procedures

Sources

• SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• NIST SP 800-171 Revision 2
• NIST implementation primer and supporting guidance

FAQ

What controls are outlined in NIST 800-171?

Rev 3 outlines 97 security requirements across 17 control families covering access control, encryption, audit logging, incident response, and supply chain risk, among others, as detailed in NIST’s Rev. 3 publication. Rev 2 covers the same protective ground with 110 requirements across 14 families.

What are the core focus areas of NIST 800-171?

There’s no official “five pillars” framework within 800-171 itself. The publication’s control families group around access management, system monitoring, incident handling, physical and personnel security, and system integrity, all aimed at protecting CUI confidentiality.

Who is required to comply with NIST 800-171?

Any nonfederal organization that processes, stores, or transmits CUI for a federal agency must comply, including DoD prime contractors, subcontractors, and cloud or IT providers hosting CUI on their behalf.

What is NIST 800-171 used for?

It sets the security requirements nonfederal organizations must implement to protect the confidentiality of Controlled Unclassified Information, forming the technical backbone that CMMC Level 2 assessments and many federal contract clauses reference directly.

Recommended

• Map 110 Controls: CMMC Level 2 Checklist for US Defense Contractors
• DoD Pause 2026: What U.S. Contractors Must Do About CMMC Level 2
• CMMC Level 2 Cost for U.S. Contractors: $75K–$300K vs DoD $104,670
• What a CMMC Level 2 Assessment Requires and How to Prepare