Implementation walkthrough
How to implement NIST SP 800-171: video walkthrough
A walkthrough of protecting Controlled Unclassified Information to NIST SP 800-171, from defining the CUI boundary to the assessment a customer relies on.
Key takeaways
- NIST SP 800-171 protects CUI on nonfederal systems.
- Scope the CUI boundary before assessing any requirement.
- Revision 2 has 110 requirements in 14 families; defence contracts enforce it.
- A system security plan describes how each requirement is met.
- There is no certificate; scores are posted in SPRS or assessed by government or a C3PAO.
Protecting CUI outside government systems
NIST SP 800-171 is the US National Institute of Standards and Technology's publication on protecting Controlled Unclassified Information in nonfederal systems and organisations: the security requirements for keeping CUI confidential once it leaves government systems, on a contractor's network, a supplier's laptops, a university research cluster or the cloud services they use. CUI is information held by or for the US government that law, regulation or government-wide policy requires to be safeguarded, although it is not classified; in a supply chain it is typically drawings, specifications, technical data and reports a customer has marked as CUI.
There is no certificate at the end: NIST does not certify or determine compliance. This short film walks through how an organisation implements the requirements.
From the CUI boundary to the assessment
Scope comes first: identify the components that process, store or transmit CUI, and those that protect them, before any requirement is assessed. Confirm which revision the contract applies; NIST's current version is Revision 3, while the Department of War enforces Revision 2, with 110 requirements in 14 families, for its contracts and for CMMC Level 2.
A gap analysis then checks each requirement across the components in scope, and remediation closes the gaps family by family, from access control, awareness and training and audit and accountability to configuration management, identification and authentication, incident response, media protection and system and communications protection. The requirements are described in a system security plan, with a plan of action for anything still open. The organisation then shows its position through the assessment its customer relies on: its own Basic Assessment, scored with the DoD Assessment Methodology and posted in SPRS; a Medium or High Assessment by government assessors; or, where a contract requires CMMC Level 2 certification, an assessment by an authorised C3PAO.
Sterling's expert and experienced consultants carry CUI scoping, gap analysis, the system security plan and remediation with your team under Sterling OS™. The score posted is the organisation's own.
NIST SP 800-171 at a glance
- Purpose
- Protecting the confidentiality of Controlled Unclassified Information (CUI) on the systems of contractors, suppliers, universities and other nonfederal organisations
- Relevant to
- Prime contractors and subcontractors at every tier, in the US and abroad, and any organisation whose federal contract or agreement applies SP 800-171
- Edition
- Revision 3, May 2024, is NIST's current version. For its contracts and for CMMC Level 2, the Department of War enforces Revision 2: 110 requirements in 14 families
- Certification
- None: NIST does not certify or determine compliance. Your own assessment scored in SPRS, a DoD Medium or High Assessment, or a CMMC Level 2 assessment by a C3PAO
- Sterling's role
- CUI scoping, gap analysis, system security plan and remediation with your team, Effivity, training, scoring and assessment readiness, then Sustain™
- Cost and timing
- Total investment for a NIST SP 800-171 programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months
NIST SP 800-171: questions people ask
Is there a NIST SP 800-171 certification?
No. NIST is a non-regulatory agency and states that it has no role in determining compliance with SP 800-171, so it issues no certificate. Compliance is shown by the assessment your customer relies on: a Basic Assessment you score and post in SPRS, a Medium or High Assessment by government assessors, or, under CMMC, a Level 2 certification assessment by an authorised C3PAO. A "NIST 800-171 certificate" from anyone else is marketing, not evidence.
Should we implement Revision 2 or Revision 3?
The one your contract enforces. For Department of War contracts that is Revision 2 today: CMMC Level 2 is built on it, SPRS scores are out of 110, and the Department says it is enforcing Revision 2 while CMMC is paused in Phase 1. Where an agency names Revision 3 it may also set the organisation-defined parameters; if it sets none, you do.
What is the SPRS score, and how is it calculated?
It is the summary result of an assessment under the NIST SP 800-171 DoD Assessment Methodology (Version 1.2.1, June 2020), posted in the Supplier Performance Risk System, for example 105 out of 110, with the date by which all requirements will be implemented. A Basic Assessment is your own and carries a low confidence level; Medium and High Assessments are conducted by government assessors and carry medium and high confidence.
What is the difference between NIST SP 800-171 and CMMC?
NIST SP 800-171 is the set of requirements; CMMC is the Department of War's programme for verifying them before award. CMMC Level 2 is the 110 requirements of Revision 2, assessed every three years by the contractor or an authorised C3PAO, as the solicitation specifies, and affirmed annually. Phase 2, which would have added Level 2 (C3PAO) assessments as a condition of award from 10 November 2026, was suspended on 13 July 2026 pending a review; the Phase 1 self-assessment requirements stay in place.
Do subcontractors and suppliers outside the United States need to comply?
If their subcontract carries the requirement, yes. The DFARS safeguarding clause flows down to subcontracts whose performance involves the Department's CUI, and a prime may not award a subcontract subject to SP 800-171 unless the subcontractor has at least a Basic Assessment from the last three years. The CMMC rule makes no exception for location either, so agree the scope and revision with your prime early. Sterling supports suppliers from offices in 21 countries.
Keep exploring
Related to this video
The complete guide
Everything on NIST SP 800-171
Start with the NIST SP 800-171 page, or go straight to the guide you need.
On the NIST SP 800-171 page
- What are the main NIST SP 800-171 requirements?
- How do you become NIST SP 800-171 compliant?
- How much does NIST SP 800-171 compliance cost?
- How long does NIST SP 800-171 compliance take?
- Who needs NIST SP 800-171 compliance?
- What NIST SP 800-171 compliance does for your business
- Frequently asked questions about NIST SP 800-171
Often combined with NIST SP 800-171
More videos: Information security, cyber and cloud
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
- ISO/IEC 27001 requirements explainedTwo-minute brief · 2 min
- How to implement PCI DSSImplementation walkthrough · 3 min 24 s
- PCI DSS requirements explainedTwo-minute brief · 2 min
- How to implement SOC 2Implementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your NIST SP 800-171 compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice