- NIST SP 800-171 Rev 3 (May 14, 2024) is the current NIST version and supersedes Rev 2. Federal agencies are expected to adopt new NIST guidance within one year (OMB Circular A-130), but your contract clauses set the revision you must meet.
- While CUI controls dropped from 110 to 97, discrete requirements increased 170% (from 110 to 297) and Assessment Objectives increased 59% (from 320 to 510).
- All 61 NFO controls were absorbed into the CUI control set, increasing governance burden on contractors.
- The heaviest lifts are NFO-to-CUI migration (more governance) and implementing an operational C-SCRM Plan with evidence.
- DoD class deviation 2024-O0013 keeps DFARS 252.204-7012 on R2 until it is rescinded, and CMMC Level 2 is still based on R2. Plan for R3 now to avoid rebuilding your documentation twice.
- ComplianceForge recommends the Secure Controls Framework (SCF) as the best framework for NIST SP 800-171 R3, since it maps to R3 at the Assessment Objective (AO) level and to 200+ other laws, regulations and frameworks.
What Is NIST SP 800-171 Rev 3?
NIST SP 800-171 Rev 3 is focused on the protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations (e.g., defense contractors). NIST SP 800-171 provides US federal agencies (including the US Department of Defense (DoD)) with recommended security requirements to protect the confidentiality of CUI in nonfederal systems and organizations. NIST SP 800-171 was first published in 2015 and the current version (Rev 3) was published on May 14, 2024.
NIST SP 800-171 is designed to require contractors to adhere with reasonably-expected security requirements that have been in use by the US government for years. NIST 800-171 establishes a basic set of expectations and maps these requirements to NIST 800-53, which is the de facto standard for US government cybersecurity controls. NIST 800-171 creates a standardized and uniform set of requirements for all Controlled Unclassified Information (CUI) security needs. This is designed to address common deficiencies in managing and protecting unclassified information that is being stored, transmitted or processed by private businesses.
While NIST SP 800-171 Rev 3 is the current version of NIST SP 800-171, the DoD issued a class deviation (2024-O0013) in May 2024 that ties DFARS Clause 252.204-7012 to NIST SP 800-171 Rev 2 until the deviation is rescinded. DFARS Clause 252.204-7012 mandates defense contractors to:
- Safeguard CUI;
- Report cyber incidents; and
- Comply with NIST SP 800-171.
How Do You Comply With NIST 800-171 Rev 3?
This material provides a guide for each requirement in NIST 800-171 Rev 3. The purpose is to provide a comprehensive compliance resource for NIST 800-171 Rev 3 that points you in the right direction to become secure, compliant & resilient.
Why Do You Need To Upgrade To NIST SP 800-171 Rev 3?
OMB Circular A-130 expects federal agencies to comply with new or updated NIST publications within one year of their publication dates, which pointed to May 2025 for NIST SP 800-171 Rev 3. In practice, the revision you must meet is set by the clauses in your contract. DoD has kept Rev 2 in place through class deviation 2024-O0013 and the CMMC program rule (32 CFR Part 170), so a DoD move to Rev 3 is expected to come through future rulemaking. Organizations that build their program around Rev 3 now, while still meeting Rev 2 where contracts require it, avoid a second documentation rebuild later.
Per OMB in CIRCULAR NO. A-130: "For legacy information systems, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates unless otherwise directed by OMB. The one-year compliance date for revisions to NIST publications applies only to new or updated material in the publications. For information systems under development or for legacy systems undergoing significant changes, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines immediately upon deployment of the systems."
Who Needs To Comply With NIST SP 800-171 Rev 3?
An organization that stores, processes and/or transmits CUI as part of a contract with the US government is required to comply with NIST SP 800-171. Examples of these organizations that may store, process and/or transmit CUI as part of a contract include, but are not limited to:
What Is The Source of NIST SP 800-171 Rev 3 Requirements?
The requirements in NIST SP 800-171 Rev 3 support the CUI program established by 32 CFR Part 2002 and are derived from:
- Federal Information Processing Standards (FIPS) Publication 200 (FIPS 200); and
- The moderate security control baseline in NIST SP 800-53 Rev 5.
NIST determined the requirements in NIST SP 800-171 Rev 3 provide the necessary protection for federal information and systems that are covered under the Federal Information Security Modernization Act (FISMA). NIST applied five (5) tailoring criteria (NCO, FED, ORC, NA and CUI) to the NIST SP 800-53 Rev 5 moderate baseline controls, as described in Appendix C of NIST SP 800-171 Rev 3. The four criteria that shape the requirements are:
NCO Controls
What Are NCO Requirements? NCO controls are not directly related to protecting the confidentiality of CUI. NCO controls are not included as NIST SP 800-171 Rev 3 requirements.
FED Controls
What Are FED Requirements? FED controls are “uniquely federal” and primarily the responsibility of the US federal government. FED controls are not included as NIST SP 800-171 Rev 3 requirements.
ORC Controls
What Are ORC Requirements? ORC controls are NIST SP 800-53 Rev 5 controls whose outcome for protecting the confidentiality of CUI is adequately covered by other related controls. ORC controls are not listed as separate NIST SP 800-171 Rev 3 requirements, but their outcome is still expected through those related requirements.
CUI Controls
What Are CUI Requirements? CUI controls are directly related to protecting the confidentiality of CUI. They became the security requirements that must be implemented to comply with NIST SP 800-171 Rev 3.
Non-Federal Organization (NFO) requirements were removed from NIST SP 800-171 Rev 3
What Are The NIST SP 800-171 R3 Families?
While NIST SP 800-171 Rev 3 contains 97 core requirements, the total number of discrete requirements is 297. As for Assessment Objectives (AOs) in NIST SP 800-171A Rev 3, there are 510 AOs that must be used to evaluate the requirements from NIST SP 800-171 R3. The requirement to use NIST SP 800-171A AOs was first defined by NARA’s Information Security Oversight Office (ISOO) in 2020 with CUI Notice 2020-04.
NIST SP 800-171 Rev 3 organizes the requirements according to 17 families. The requirements in NIST SP 800-171 Rev 3 use a “03.XX.YY” numbering format (e.g., 03.01.01 Account Management) because the requirements are in Chapter 3 of NIST SP 800-171.
The NIST SP 800-171 Rev 3 families are:
3.1 Access Control
This family of NIST SP 800-171 Rev 3 requirements focuses on logical access control.
3.2 Awareness & Training
This family of NIST SP 800-171 Rev 3 requirements focuses on end user training, specifically for personnel who handle CUI or administer technologies that support and/or protect CUI.
3.3 Audit & Accountability
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related event logging to maintain situational awareness of the CUI environment.
3.4 Configuration Management
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related configuration management practices to secure the CUI environment.
3.5 Identification & Authentication
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related Identity and Access Management (IAM) practices to securely limit access to only those people and processes with a legitimate business need.
3.6 Incident Response
This family of NIST SP 800-171 Rev 3 requirements focuses on incident response practices associated with the CUI environment.
3.7 Maintenance
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related maintenance activities within CUI environment.
3.8 Media Protection
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related media protection and handling practices.
3.9 Personnel Security
This family of NIST SP 800-171 Rev 3 requirements focuses on personnel-related management practices to ensure only necessary individuals have access to the CUI environment.
3.10 Physical Protection
This family of NIST SP 800-171 Rev 3 requirements focuses on physical security-related practices to physically secure the CUI environment.
3.11 Risk Assessment
This family of NIST SP 800-171 Rev 3 requirements focuses on risk management practices associated with the CUI environment.
3.12 Security Assessment & Monitoring
This family of NIST SP 800-171 Rev 3 requirements focuses on security assessments, Plans of Action & Milestones (POA&M), continuous monitoring and information exchange agreements for the CUI environment.
3.13 System & Communications Protection
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related network security aspects of the CUI environment.
3.14 System & Information Integrity
This family of NIST SP 800-171 Rev 3 requirements focuses on flaw remediation, malicious code protection and system monitoring to maintain the integrity and situational awareness of the CUI environment.
3.15 Planning
This family of NIST SP 800-171 Rev 3 requirements focuses on the organization’s strategic plans to govern cybersecurity risks and threats to protect the CUI environment.
3.16 System and Services Acquisition
This family of NIST SP 800-171 Rev 3 requirements focuses on technology-related development and acquisition processes to maintain the confidentiality and integrity of the CUI environment.
3.17 Supply Chain Risk Management
This family of NIST SP 800-171 Rev 3 requirements focuses on Cybersecurity Supply Chain Risk Management (C-SCRM)-related practices to operationalize concepts from NIST SP 800-161 Rev 1 to protect the CUI environment.
What Are The Penalties For Non-Compliance With NIST 800-171 Rev 3?
Non-compliance with NIST SP 800-171 (whichever revision your contract requires) could be a False Claims Act (FCA) violation and the US Department of Justice (DOJ) is taking FCA violations seriously. Additional penalties for non-compliance with NIST SP 800-171 include, but are not limited to:
Contract Termination
It is reasonably expected that the U.S. Government will terminate contracts with prime contractors over non-compliance with DFARS / NIST 800-171 requirements since it is a failure to uphold contract requirements. Subcontractor non-compliance will cause a prime contractor to be non-compliant, as a whole.
False Claims Act Liability
If a company states it is compliant when it knowingly is not compliant, that is a misrepresentation of material facts. Under the False Claims Act (31 U.S.C. §§ 3729-3733), a civil statute, knowingly false claims or statements made to obtain government payment can lead to treble damages plus civil penalties for each false claim. Whistleblowers can also file FCA lawsuits on the government's behalf.
Breach of Contract Lawsuits
Both prime contractors and subcontractors could be exposed legally. A tort is a civil breach committed against another in which the injured party can sue for damages. The likely scenario for a DFARS / NIST 800-171-related tort would be around negligence on behalf of the accused party by not maintaining a specific code of conduct (e.g., DFARS / NIST 800-171 cybersecurity controls).
As you can see from those examples, the cost of non-compliance is quite significant. As always, seek competent legal counsel for any pertinent questions on your specific compliance obligations.
How Do I Upgrade To NIST 800-171 R3?
Sooner, rather than later, the US Government's global supply chain will have to transition to NIST 800-171 R3. ComplianceForge provides a free resource for organizations migrating from NIST 800-171 R2 to R3. This guide provides an Assessment Objective (AO)-level analysis to address differences:
- Over 1/3 are minimal effort (clear, direct mapping);
- Approximately 1/5 are moderate effort (indirect mapping); and
- Approximately 1/2 are significant effort (no clear mapping or new AOs).
This guide also addresses the logical dependencies that exist from "orphaned AOs" that are not in NIST 800-171A R3, but a requirement to demonstrate evidence of due diligence and due care still exists for specific functions (e.g., maintenance operations, roles & responsibilities, inventories, physical security, etc.).
What Is The Best Framework For NIST SP 800-171 Rev 3 Compliance?
ComplianceForge recommends the Secure Controls Framework (SCF) as the best framework for NIST SP 800-171 Rev 3. Most organizations that handle CUI have more than NIST SP 800-171 to comply with, such as CMMC, FAR 52.204-21, ISO 27001, SOC 2, state privacy laws and customer contract requirements. The SCF is a free metaframework with 1,500+ controls across 34 domains that are mapped to 200+ laws, regulations and frameworks, so one set of controls can demonstrate conformity with NIST SP 800-171 Rev 3 at the Assessment Objective (AO) level while also addressing your other obligations.
ComplianceForge is an authorized SCF Licensed Content Provider (LCP). Our SCF-based policies and standards (SCRP), procedures (CSOP) and CMMC Bundle 4 (SCF) give you editable documentation that is already aligned to SCF controls, so your evidence traces back to NIST SP 800-171 Rev 3 AOs through the SCF mappings. You can review the AO-level mapping in the SCF's NIST SP 800-171A R3 STRM.
What Problem Does ComplianceForge's NIST SP 800-171 Rev 3 Documentation Solve?
We sell cybersecurity documentation - policies, standards, procedures and more! Our documentation is meant to help companies become audit-ready!
How Does ComplianceForge Help Me Comply With NIST SP 800-171 Rev 3?
We take a holistic approach to creating comprehensive cybersecurity documentation that is both scalable and affordable. This is beyond just generic policies and allows you to build out an audit-ready cybersecurity program for your organization!
Editable NIST 800-171 Policies, Standards, Procedures Templates
ComplianceForge’s NIST 800-171 / CMMC documentation has been used successfully by multiple companies during DIBCAC assessments to efficiently and effectively generate the necessary artifact documentation to demonstrate compliance with NIST SP 800-171 controls and NIST SP 800-171A control objectives. This battle tested documentation includes the necessary policies, standards, procedures, SSP, POA&M, Incident Response Plan (IRP) and other documentation that are expected to exist to successfully pass a third-party assessment, be it DIBCAC or a C3PAO.
The "NIST 800-171 in a nutshell" graphic show below helps depict NIST 800-171 R3 requirements from Peope, Process, Technology, Data and Facility (PPTDF) perspective. This can help better visualize what the various requirements are (e.g., administrative, technical solutions, configurations, etc.). You can download the PDF version here and you can read more about the concept of PPTDF here.
NIST 800-171 Documentation Done Right - Scalable, Comprehensive & Efficient
ComplianceForge is an industry leader in NIST 800-171 compliance. We specialize in cybersecurity compliance documentation and our products include the policies, standards, procedures and POA&M/SSP templates that companies (small, medium and large) need to comply with NIST 800-171. We've been writing cybersecurity documentation since 2005 and we've been writing documentation specific to NIST 800-171 since 2016. We are here to help make NIST 800-171 compliance as easy and as affordable as possible!
Complying with NIST SP 800-171 & CMMC can be hard enough without arguing over terminology. Terminology pertaining to cybersecurity documentation is often abused, so a simplified concept of the hierarchical nature of cybersecurity documentation is needed to demonstrate the unique nature of these components, as well as the dependencies that exist. ComplianceForge created a reference model that is designed to encourage clear communication by defining cybersecurity documentation components and how those are linked. This model is based on industry-recognized terminology from NIST, ISO, ISACA and AICPA to addresses the inter-connectivity of policies, control objectives, standards, guidelines, controls, assessment objectives, risks, threats, procedures & metrics. This also addresses what SSPs, POA&Ms and secure configurations are and how those integrate into an organization's existing cybersecurity documentation.
We leverage the Hierarchical Cybersecurity Governance Framework to develop the necessary documentation components that are key to being able to demonstrate evidence of due diligence and due care for our clients. This methodology towards documentation acknowledges the interconnectivity that exists between policies, control objectives, standards, guidelines, controls, risks, procedures & metrics. Essentially, ComplianceForge simplified the concept of the hierarchical nature of cybersecurity and privacy documentation that you can see in the downloadable diagram shown below. This helps demonstrate the unique nature of these components, as well as the dependencies that exist. You can download the example to better understand how we write our documentation that links policies all the way down to metrics. This is a great solution for any organization currently using or migrating to a Governance, Risk & Compliance (GRC) or Integrated Risk Management (IRM) platform to help automate their governance practices. Click on the image below to download the PDF:
As a quick summary of your requirements to comply with NIST 800-171, you are expected to have several different "documentation artifacts" to prove that your cybersecurity program exists. The reality with compliance assessments is that if something is not documented, you cannot prove it exists. Given that reality, you need to ensure your company has the proper cybersecurity documentation in place:
- Cybersecurity policies, standards & procedures;
- System Security Plan (SSP) (Rev 3 requirement 03.15.02; Rev 2 requirement 3.12.4); and
- Plan of Action & Milestones (POA&M) (Rev 3 requirement 03.12.02; Rev 2 requirement 3.12.2).
