Two-minute brief
NIST SP 800-171 requirements explained: video brief
A two-minute brief on the requirement families of NIST SP 800-171 and the differences between Revisions 2 and 3.
Key takeaways
- Revision 2 has 110 requirements in 14 families.
- Requirements derive from the SP 800-53 moderate baseline.
- Revision 3 adds planning, acquisition and supply chain risk families.
- Defence contracts and CMMC Level 2 enforce Revision 2.
- NIST does not certify; assessments are self-scored, government or C3PAO.
A catalogue of requirements in families
NIST SP 800-171 has no management system clauses. It is a catalogue of security requirements in families, and an assessment asks whether each is met across the components in scope. Revision 2 has 110 requirements in 14 families, each split into basic and derived requirements. This short film walks through them.
Everything starts with the CUI boundary: the components that process, store or transmit Controlled Unclassified Information, and those that protect them. The 14 Revision 2 families then cover access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. The requirements derive from the NIST SP 800-53 moderate baseline, tailored to nonfederal organisations.
What Revision 3 changes
Revision 3, published in May 2024, numbers its families 03.01 to 03.17, renames Security Assessment as Security Assessment and Monitoring, and adds Planning, System and Services Acquisition and Supply Chain Risk Management for consistency with the SP 800-53B moderate baseline. It also marks a number of earlier requirements as withdrawn and introduces organisation-defined parameters. For its contracts and for CMMC Level 2, the Department of War enforces Revision 2.
The requirements apply to prime contractors and subcontractors at every tier, in the United States and abroad, and to any organisation whose federal contract or agreement applies SP 800-171. NIST does not certify or determine compliance. Organisations show their position through their own assessment scored in SPRS, a Medium or High Assessment by government assessors, or a CMMC Level 2 assessment by a C3PAO.
NIST is a non-regulatory agency and has no role in determining compliance, so no certificate exists. The SPRS score is the summary result of an assessment under the DoD Assessment Methodology, posted with the date by which all requirements will be implemented. Universities and research organisations need SP 800-171 when their contract or agreement with a federal agency applies it to Controlled Unclassified Information. ISO/IEC 27001 helps, but Revision 3 maps only to NIST SP 800-53.
NIST SP 800-171 at a glance
- Purpose
- Protecting the confidentiality of Controlled Unclassified Information (CUI) on the systems of contractors, suppliers, universities and other nonfederal organisations
- Relevant to
- Prime contractors and subcontractors at every tier, in the US and abroad, and any organisation whose federal contract or agreement applies SP 800-171
- Edition
- Revision 3, May 2024, is NIST's current version. For its contracts and for CMMC Level 2, the Department of War enforces Revision 2: 110 requirements in 14 families
- Certification
- None: NIST does not certify or determine compliance. Your own assessment scored in SPRS, a DoD Medium or High Assessment, or a CMMC Level 2 assessment by a C3PAO
- Sterling's role
- CUI scoping, gap analysis, system security plan and remediation with your team, Effivity, training, scoring and assessment readiness, then Sustain™
- Cost and timing
- Total investment for a NIST SP 800-171 programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months
NIST SP 800-171: questions people ask
Is there a NIST SP 800-171 certification?
No. NIST is a non-regulatory agency and states that it has no role in determining compliance with SP 800-171, so it issues no certificate. Compliance is shown by the assessment your customer relies on: a Basic Assessment you score and post in SPRS, a Medium or High Assessment by government assessors, or, under CMMC, a Level 2 certification assessment by an authorised C3PAO. A "NIST 800-171 certificate" from anyone else is marketing, not evidence.
Should we implement Revision 2 or Revision 3?
The one your contract enforces. For Department of War contracts that is Revision 2 today: CMMC Level 2 is built on it, SPRS scores are out of 110, and the Department says it is enforcing Revision 2 while CMMC is paused in Phase 1. Where an agency names Revision 3 it may also set the organisation-defined parameters; if it sets none, you do.
What is the SPRS score, and how is it calculated?
It is the summary result of an assessment under the NIST SP 800-171 DoD Assessment Methodology (Version 1.2.1, June 2020), posted in the Supplier Performance Risk System, for example 105 out of 110, with the date by which all requirements will be implemented. A Basic Assessment is your own and carries a low confidence level; Medium and High Assessments are conducted by government assessors and carry medium and high confidence.
What is the difference between NIST SP 800-171 and CMMC?
NIST SP 800-171 is the set of requirements; CMMC is the Department of War's programme for verifying them before award. CMMC Level 2 is the 110 requirements of Revision 2, assessed every three years by the contractor or an authorised C3PAO, as the solicitation specifies, and affirmed annually. Phase 2, which would have added Level 2 (C3PAO) assessments as a condition of award from 10 November 2026, was suspended on 13 July 2026 pending a review; the Phase 1 self-assessment requirements stay in place.
Do subcontractors and suppliers outside the United States need to comply?
If their subcontract carries the requirement, yes. The DFARS safeguarding clause flows down to subcontracts whose performance involves the Department's CUI, and a prime may not award a subcontract subject to SP 800-171 unless the subcontractor has at least a Basic Assessment from the last three years. The CMMC rule makes no exception for location either, so agree the scope and revision with your prime early. Sterling supports suppliers from offices in 21 countries.
Keep exploring
Related to this video
The complete guide
Everything on NIST SP 800-171
Start with the NIST SP 800-171 page, or go straight to the guide you need.
On the NIST SP 800-171 page
- What are the main NIST SP 800-171 requirements?
- How do you become NIST SP 800-171 compliant?
- How much does NIST SP 800-171 compliance cost?
- How long does NIST SP 800-171 compliance take?
- Who needs NIST SP 800-171 compliance?
- What NIST SP 800-171 compliance does for your business
- Frequently asked questions about NIST SP 800-171
Often combined with NIST SP 800-171
More videos: Information security, cyber and cloud
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
- ISO/IEC 27001 requirements explainedTwo-minute brief · 2 min
- How to implement PCI DSSImplementation walkthrough · 3 min 24 s
- PCI DSS requirements explainedTwo-minute brief · 2 min
- How to implement SOC 2Implementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your NIST SP 800-171 compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice