NIST SP 800-171 · Controlled Unclassified Information · Revision 2 and Revision 3

NIST 800-171 compliance consulting for CUI protection that stands up to assessment.

Protect the Controlled Unclassified Information that US government customers and prime contractors share with you, and prove it: a system security plan that describes your real network, a score in SPRS you can defend, and evidence ready for a Department of War assessment or a CMMC assessment by a C3PAO. Sterling's expert and experienced consultants trace where your CUI lives, put the requirements in place with your IT team or provider and stay with you through every assessment and score update, in 60+ countries. We ensure successful NIST SP 800-171 compliance for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced CUI compliance consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the system security plan, the controls and the evidence; the assessment is yours, the DoD's or your C3PAO's

NIST SP 800-171 at a glance

Purpose: Protecting the confidentiality of Controlled Unclassified Information (CUI) on the systems of contractors, suppliers, universities and other nonfederal organisations
Relevant to: Prime contractors and subcontractors at every tier, in the US and abroad, and any organisation whose federal contract or agreement applies SP 800-171
Edition: Revision 3, May 2024, is NIST's current version. For its contracts and for CMMC Level 2, the Department of War enforces Revision 2: 110 requirements in 14 families
Certification: None: NIST does not certify or determine compliance. Your own assessment scored in SPRS, a DoD Medium or High Assessment, or a CMMC Level 2 assessment by a C3PAO
Sterling's role: CUI scoping, gap analysis, system security plan and remediation with your team, Effivity, training, scoring and assessment readiness, then Sustain™
Cost and timing: Total investment for a NIST SP 800-171 programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months

8,100+ client engagements in 60+ countries.

NIST SP 800-171 client experience

What it is

What is NIST SP 800-171 and what is it used for?

NIST SP 800-171 is the US National Institute of Standards and Technology's publication on protecting Controlled Unclassified Information (CUI) in nonfederal systems and organisations: the security requirements it recommends for keeping CUI confidential once it leaves government systems, on a contractor's network, a supplier's laptops, a university research cluster or the cloud services they use. CUI is information held by or for the US government which a law, regulation or government-wide policy requires to be safeguarded, although it is not classified; in a supply chain it is typically drawings, specifications, technical data and reports a customer has marked as CUI.

The requirements are the NIST SP 800-53 moderate baseline, tailored to remove what is primarily the government's responsibility, not directly related to confidentiality, covered elsewhere or not applicable. They apply to components that process, store or transmit CUI and to those that protect them. Agencies impose them through contracts and other agreements, and the CUI rule, 32 CFR 2002.14(h)(2), makes SP 800-171 the requirement for CUI on non-federal systems unless the law, regulation or government-wide policy behind a CUI category prescribes specific safeguards. NIST, a non-regulatory agency, has no role in determining compliance. Compliance is shown through the assessment your customer relies on, most often for the US Department of War (DoW, written DoD in its regulations): a self-assessment scored with the NIST SP 800-171 DoD Assessment Methodology and posted in the Supplier Performance Risk System (SPRS), a Medium or High Assessment by government assessors, or a CMMC Level 2 assessment.

Current revisions. NIST published Revision 3 in May 2024, reorganised into 17 requirement families, and on 14 May 2024 withdrew Revision 2, which dates from February 2020, was updated in January 2021 and has 110 requirements in 14 families. Revision 2 is nevertheless the one the Department of War enforces: the CMMC rule, 32 CFR Part 170, builds Level 2 on its 110 requirements, SPRS scores are reported out of 110, and with CMMC paused in Phase 1 since 13 July 2026 the Department says it will enforce Revision 2 through self-assessments and select government-led assessments. DFARS 252.204-7012 points to the version in effect when the solicitation is issued, or as the contracting officer authorises, so your own contract settles the question; other agencies may call for Revision 3. The companion assessment procedures, SP 800-171A Revision 3, were also published in May 2024. NIST SP 800-171 Revision 2 or Revision 3: which applies to you

Who it is for

Who needs NIST SP 800-171 compliance?

SP 800-171 applies wherever a US federal contract or agreement says it does, and it travels down the supply chain with the clause that carries it: DFARS 252.204-7012 in defence work, and the terms other agencies set for the contractors, universities and research bodies holding their CUI. Organisations come to Sterling for NIST SP 800-171 from four starting points:

Your contract or solicitation carries the DFARS clauses. Under 252.204-7012 you implement the requirements on every covered contractor information system, tell the Department's CIO within 30 days of award of any not yet implemented, and report cyber incidents within 72 hours of discovery. Under 252.204-7019 an offer needs a current assessment in SPRS, no more than three years old unless the solicitation sets less, for each covered system relevant to it.
A prime contractor has flowed the requirement down to you. The safeguarding clause passes into subcontracts whose performance involves the Department's CUI, and 252.204-7020 bars a prime from awarding one unless the subcontractor has at least a Basic Assessment from the last three years. A machine shop in India receiving CUI drawings from a US prime is in scope when its subcontract carries the clause.
Your university, laboratory or research institute holds CUI under a federal agreement. The CUI rule makes SP 800-171 the default for CUI outside federal systems, so a research group receiving data that an agency, or a company holding a federal contract, has marked as CUI needs a defined environment in which that data stays.
You hold ISO/IEC 27001 or a SOC 2 report, and a customer still asks about SP 800-171. Neither is SP 800-171 compliance. Your ISMS gives you risk assessment, policies and internal audit to build on, but each requirement is scored on its own, including specifics such as FIPS-validated cryptography for CUI.

The intended benefit is continued eligibility and CUI that is genuinely protected, which depends on a tight boundary and controls that operate every day.

Business benefits

What NIST SP 800-171 compliance does for your business

The programme pays back at award, when a prime qualifies its suppliers, and on the day an incident tests whether the controls were real.

A score you can defendEvery point in your SPRS score traced to evidence for the requirement behind it, so a government review confirms the number rather than lowering it.
Offers that stay eligibleA current assessment in SPRS for each covered system, so no offer is held back by a missing or stale entry.
A supplier primes can approve quicklyPrimes must check for at least a Basic Assessment before subcontracting CUI work; a supplier with its score, SSP and evidence ready is the simpler choice.
A smaller, cheaper boundaryCUI confined to the systems and people that need it, so fewer assets carry the full requirement set.
Incidents handled on the clockDetection, response and reporting rehearsed, so the 72-hour report and the 90-day preservation of images and monitoring data happen by plan.
One control set for several customersRevision 2 for the Department's contracts, a tested map to Revision 3 for agencies that ask for it, and evidence ready for CMMC Level 2.

Track what the programme changes: requirements implemented, the score and its trend, plan-of-action items against their dates, CUI found outside the boundary, and detection-to-report time in incident tests.

Requirements

What are the main NIST SP 800-171 requirements?

SP 800-171 has no management-system clauses: it is a catalogue of security requirements in families, and an assessment asks whether each is met across the components in scope. Revision 2 has 110 requirements in 14 families, each split into basic and derived requirements. Revision 3 numbers its families 03.01 to 03.17, renames Security Assessment as Security Assessment and Monitoring, adds Planning, System and Services Acquisition and Supply Chain Risk Management for consistency with the SP 800-53B moderate baseline, marks a number of earlier requirements as withdrawn and introduces organisation-defined parameters. The table is a plain-language map, with Revision 2 section numbers, not a substitute for the requirement text.

Family	What it requires of you	What it looks like in practice
Scope The CUI boundary	Identify the components that process, store or transmit CUI, and those that protect them, before any requirement is assessed	A CUI inventory and flow map, a network diagram with the boundary drawn, the enclave decision, and the cloud and managed service providers involved
3.1 · 3.5 Access Control; Identification and Authentication	Allow only authorised users, processes and devices, only for the functions they need, and confirm identities before access	Least privilege, separation of duties, controlled remote and wireless access, session locks, limits on CUI posted to public systems, and multi-factor authentication for privileged accounts and network access
3.2 · 3.9 · 3.10 Awareness and Training; Personnel Security; Physical Protection	Prepare people for their security duties, screen them before access, and control the places where CUI is handled	Awareness training covering insider threat, role-based training, screening before access, access removed on departure or transfer, escorted visitors, physical access logs and safeguards at alternate work sites
3.4 · 3.7 · 3.8 Configuration Management; Maintenance; Media Protection	Keep systems in a documented, approved state, maintain them under control, and protect CUI on paper and digital media	Baselines and inventories, security impact analysis before changes, least functionality, supervised maintenance, and media marked, stored securely, encrypted in transport and sanitised before disposal or reuse
3.3 · 3.6 · 3.14 Audit and Accountability; Incident Response; System and Information Integrity	Keep records that trace actions to individuals, handle and report incidents, correct flaws in time and watch for attack	Logs protected, correlated and reviewed, a tested incident capability that meets the 72-hour DFARS reporting clock where it applies, flaws remediated on schedule, malicious code protection kept current and traffic monitored for attack
3.13 System and Communications Protection	Protect CUI at the boundary and in transit, and separate what should be kept apart	Boundary protection that denies by default, subnetworks for public-facing components, no split tunnelling for remote devices, FIPS-validated cryptography protecting CUI, and CUI protected at rest
3.11 · 3.12 Risk Assessment; Security Assessment	Assess risk and the controls periodically, plan the fixes, and describe how the system meets each requirement	Risk assessments and vulnerability scans with remediation, periodic control assessments and monitoring, plans of action (3.12.2), and the system security plan (3.12.4): boundary, environment, how each requirement is met and connections to other systems
Revision 3 Planning; System and Services Acquisition; Supply Chain Risk Management; parameters	Meet the three added families, with the system security plan now under Planning (03.15.02) and plans of action under Security Assessment and Monitoring (03.12.02)	Security considered in the systems, components and external services you acquire, supply chain risks managed, and a register of organisation-defined parameters holding the agency's value or, where it sets none, yours

What does useful NIST SP 800-171 evidence look like?

A system security plan that matches what is configured, a CUI flow map and asset inventory, policies and procedures, baselines, access reviews, multi-factor settings, signed-off log reviews, an incident response test, scan results with remediation dates, training records, the scoring worksheet behind your SPRS entry and a plan of action and milestones (POA&M). We keep what the requirements call for and nothing for show, in Effivity from the first workshop, so every point you claim has evidence an assessor can open.

NIST SP 800-171 requirements explained, family by family

Compliance process

How do you become NIST SP 800-171 compliant?

There is no certificate at the end. You implement the requirements, describe them in the system security plan and show them through the assessment your customer relies on: your own Basic Assessment, scored with the DoD Assessment Methodology and posted in SPRS; a Medium or High Assessment by government assessors; or, where a contract requires CMMC Level 2 (C3PAO) status, a certification assessment by an authorised C3PAO. Sterling prepares and supports you; the score you post is your organisation's own, and any independent assessor reaches its own result.

01
Confirm what applies and where CUI lives.Read the clauses in your contracts or the prime's flow-down, confirm the revision and any organisation-defined values, and trace where CUI arrives, is stored and leaves.
02
Gap analysis: score every requirement against the evidence.The gap analysis tests each requirement inside the boundary, scores it as the DoD Assessment Methodology does, and agrees fixes, owners and dates, starting with the gaps that weigh most on the score.
03
Write the system security plan and close the gaps.Multi-factor authentication, FIPS-validated encryption, logging and review, configuration baselines, an enclave where it shrinks the boundary, and an SSP written from what is really configured.
04
Assess yourself the way an assessor would.Sterling runs a mock assessment with the SP 800-171A procedures, recalculates the score and writes plans of action for anything still open, while there is time to fix it.
05
Post the score and support any assessment.Your team posts the Basic Assessment summary score in SPRS with the date all requirements will be met. In a Medium or High Assessment you give government assessors access and have 14 business days to answer the findings; C3PAO assessments follow the CMMC rules.
06
Keep the score true between assessments.Update the SSP as the system changes, close plan-of-action items on their dates, re-score after significant change and reassess before three years pass.

Check the route, not only the price. Nobody can sell you a NIST certificate, and the score in SPRS is your organisation's own statement to the Department. Ask how each requirement will be tested before a number is entered, confirm any C3PAO on the Cyber AB's CMMC Marketplace, and keep implementers apart from assessors. How to choose a credible NIST SP 800-171 consultant · The certification buyer's checklist

Cost

How much does NIST SP 800-171 compliance cost?

There is no list price, because the cost follows the boundary: a forty-person firm with CUI in one cloud enclave faces a different programme from a manufacturer whose drawings flow through three plants. What we can promise is a proposal with every component visible and our fee fixed.

Cost component	What affects it
Consulting and implementation	The size of the CUI boundary, current maturity, sites and legal entities, the revision in scope, and how much of the work your team takes on (Design™ or Drive™)
Self-assessment and SPRS	Internal time to score each requirement, review the SSP and post the summary score; no outside assessor is involved in a Basic Assessment
Independent assessment	Government assessors conduct Medium and High Assessments; where CMMC Level 2 (C3PAO) is required, the C3PAO quotes by boundary, assets, locations and complexity
Remediation and technology	Multi-factor authentication, FIPS-validated encryption, logging, endpoint protection, an enclave or FedRAMP Moderate-equivalent cloud services, and IT staff or provider time
Software and learning	Included in a Sterling engagement: Effivity for the SSP, the plans of action and the evidence, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Score updates, plan-of-action closure, reassessment before three years pass, and a move to Revision 3 or CMMC Level 2, under Sustain™ and Revise™

What moves the price

How many systems, users and sites touch CUI today
Whether CUI can move into an enclave or is spread across the whole network
Cloud, e-mail and managed service providers inside the boundary
Which assessment follows: your own, a government review or a C3PAO
The award or flow-down date, and how much your IT team or provider can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, stated in writing
Technology purchases and any C3PAO fee listed apart from our fee
Effivity, training and Academy access itemised at no additional cost
Payments tied to deliverables, not to dates on a calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does NIST SP 800-171 compliance take?

Most of the time goes into the controls, not the paperwork. A contractor with a small, well-run network and CUI confined to a few systems can often be ready in three to four months. From a low starting point a programme typically takes six to twelve months, longer on large or flat networks: multi-factor authentication and FIPS-validated encryption rolled out, logs reviewed, baselines set, an SSP that matches the system and enough operating history for credible evidence. We plan backwards from the award or flow-down date and track every requirement in Effivity.

Phase	What determines the pace
Scope and gap analysis	Access to IT staff or your provider, network diagrams, the contracts that show where CUI arrives, and existing policies
SSP and remediation	Requirements not met, technology lead times, enclave or cloud decisions, and change windows on production systems
Evidence and self-assessment	Controls operating long enough to produce records, the mock assessment, the score and the plan-of-action dates
Posting and assessment	The SPRS entry, any government Medium or High Assessment, a C3PAO's availability where CMMC applies, and the rebuttal window

If an award or a prime's deadline is fixed, tell us at the start; sometimes the realistic plan is a tight enclave first and a wider boundary later. A score of 110 promised before anyone has traced your CUI is a guess, not a plan.

Challenges

Common NIST SP 800-171 implementation challenges

SP 800-171 programmes stall on five familiar problems. Each has a practical answer.

Nobody is sure which information is CUI.

Customers do not always mark what they send, and marked files spread into e-mail and shared drives. We work from the contract, the customer's guidance and the CUI Registry, agree what counts and trace every route by which it moves.

The system security plan describes intentions, not the network.

An assessor reads the SSP beside the configuration. We write it from the environment as built, keep it current through change control and record the value chosen for each organisation-defined parameter where Revision 3 applies.

Revision 2 or Revision 3?

Build to the revision your contract enforces; for Department of War work that is Revision 2 today. Where an agency asks for Revision 3, we keep a requirement-by-requirement map and set the parameter values once, so one control set serves both.

Cloud services and managed providers hold CUI.

Under the DFARS clause a cloud service holding the Department's CUI must meet requirements equivalent to the FedRAMP Moderate baseline and the clause's incident-reporting, malicious software, preservation, forensic-access and damage-assessment provisions. We map each provider, collect its evidence and write the shared responsibilities into the SSP.

The SPRS score is older, or higher, than the system.

An assessment stays current for three years, but networks change in months. We re-score after significant change, keep plan-of-action dates realistic and prepare the evidence a government assessment would ask for.

Your engagement

What your NIST SP 800-171 engagement includes

The engagement covers everything a defensible score depends on, from the first CUI flow map to the SPRS entry and the reviews that follow, delivered by one team for one all-inclusive proposal.

Boundary, gap analysis and plan
CUI flows traced, the boundary drawn, each requirement scored against evidence, and fixes agreed with owners and dates.
System security plan, policies and procedures
Written from your configured environment on Sterling's own template sets, with your IT team or provider.
Effivity ISO & GRC software
Your SSP, plans of action, inventory, reviews and evidence in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, and internal auditor training for the team that checks the controls, as applicable to your standard.
Mock assessment and scoring
Every requirement tested with the SP 800-171A procedures, the score calculated with the DoD Assessment Methodology, and plans of action with milestones you can meet.
SPRS and assessment support
The summary score posted by your team with our help, and support through any Medium or High Assessment, rebuttal or C3PAO assessment until findings are closed.

NIST does not certify, and Sterling does not assess: compliance rests on your own scored assessment or on the result of a DoD or C3PAO assessment.

How we deliver

How Sterling supports your NIST SP 800-171 implementation

Each NIST SP 800-171 engagement runs on Sterling OS™, our delivery operating system: five phases with deliverables, decision owners and evidence at every step. Pick the support level your IT capacity calls for; the method, the software and the accountability do not change.

01
Design™Guided implementation: your IT team closes the gaps with Sterling's boundary method, SSP structure, policy templates, working sessions and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed scoping, documentation, scoring and assessment preparation beside your IT team or provider.
03
Sustain™After the score is posted: plan-of-action closure, periodic control checks, new systems and users brought into the boundary, and reassessment prepared in good time.
04
Automate™The programme in Effivity: CUI inventory, SSP, plans of action, access and log reviews, incidents, training and assessment dates in one workspace.
05
Revise™Changes of basis: Revision 2 to Revision 3, a step up to CMMC Level 2 (C3PAO), new agency requirements, and changes in scope, sites or contracts.

Before work starts we fix the engagement team, the weekly working session, the deliverables and who signs off each. Every requirement then carries a status and a date, so a gap that will not close in time shows early.

How Sterling OS™ works

Often combined with

Standards organisations pair with NIST SP 800-171

Effivity · NIST SP 800-171 compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of NIST SP 800-171 Revision 2 and Revision 3.

Every Sterling NIST SP 800-171 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the CUI inventory, the SSP, the plans of action, access and log reviews, incidents, training and SPRS dates live in one place. Sterling consulting clients receive the Effivity subscription included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Planning

System security plan and parameters

The SSP kept requirement by requirement, with approvals, review dates and each organisation-defined parameter value.

Security Assessment and Monitoring

Scores, plans of action and control checks

The current score and its calculation, every open plan-of-action item with its milestone, and the periodic control assessments that show the score still holds.

Access Control

Accounts, privileges and remote access

Joiner, mover and leaver approvals, privileged accounts reviewed on schedule, remote access recorded, and the multi-factor status of each system that reaches CUI.

System and Communications Protection

Boundaries, encryption and enclaves

The boundary diagram, firewall rule reviews, the FIPS-validated modules protecting CUI, and the enclave design, each with an owner and a review date.

Awareness and Training

Awareness, role training and insider threat

Completion of CUI awareness, insider-threat and role-based training, linked to Sterling Academy, with new starters flagged before they get access.

Incident Response

Incident handling and the 72-hour clock

Incidents logged from detection to closure, the report deadline tracked from discovery, preserved images held for their 90 days, and response tests planned and reviewed.

Risk Assessment

Risk assessments and vulnerability remediation

Risk assessments, scan results and remediation due dates in one register, with overdue fixes visible to management before they cost points.

System and Services Acquisition

Cloud, managed and other external services

Each provider that stores, processes or protects CUI, its FedRAMP Moderate equivalence evidence, its responsibilities in the SSP and its next review date.

What this means at the audit

At a High Assessment or a C3PAO assessment, the assessors compare your SSP with what they can see: accounts and multi-factor settings, sampled log reviews, the latest incident response test, scan results with remediation dates, and the plan of action. In Effivity each is a screen with owners, dates and records attached, and after the assessment Sustain™ runs in the same workspace.

Effivity for NIST SP 800-171: the guide Effivity on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your SSP, inventories and records migrated, not retyped
Admin and user training for your team
ISMS, QMS and other modules when ISO/IEC 27001, ISO 9001 or CMMC join the programme

NIST SP 800-171 client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for NIST SP 800-171 are available on request. The client feedback wall lists every letter by standard.

Programmes with NIST SP 800-171 in scope

How a CUI programme runs inside an existing ISMS.

All case studies

01
Engineering and manufacturing supplier: NIST SP 800-171 inside an ISO/IEC 27001 ISMS
Where a supplier holding CUI already runs an ISO/IEC 27001 information security management system, and perhaps AS9100 or ISO 9001, the SP 800-171 programme is built inside it: the CUI boundary, the SSP and the requirements become part of the ISMS, its risk assessment, internal audit and corrective action serve both, and one evidence base in one Effivity workspace supports the certification audits, the SPRS score and, where required, a CMMC assessment.
How integrated programmes run

Sterling Academy · NIST SP 800-171 e-learning

Train every person who handles CUI, not just the IT team.

Sterling Academy teaches, through e-learning, both the wider workforce and the people who operate the security controls: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for every learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

NIST SP 800-171 awareness for everyone who can reach CUI: what it is, how it is marked, where it may be kept and how to report an incident
Practitioner courses for administrators, the security lead and those who approve access, changes and suppliers
Internal auditor training for the people who test the controls between assessments, as applicable to your standard, as part of the engagement
Completion by department, and training records an assessor can sample
New starters trained before they are given access to CUI
A Sterling consultant available when a learner has a question

Keep exploring

Explore more about NIST SP 800-171

Watch a video on how to implement NIST 800-171 here.
Watch a video on NIST 800-171 requirements here.

NIST SP 800-171 resources

Services for NIST SP 800-171

Why Sterling

Want successful NIST SP 800-171 compliance? Come to Sterling.

Sterling works with the organisations SP 800-171 actually reaches, from precision engineering shops and software suppliers to research groups and multi-site manufacturers, keeping the boundary as small as the information allows and the controls fitted to how your IT really runs.

60+ countries, since 2003

Management system and information security programmes for manufacturing, engineering, technology and service businesses, with one engagement team answerable for your whole CUI boundary.

All-inclusive proposal

One proposal covering consulting, Effivity, training and Academy access, with technology and any C3PAO fee on their own lines. No surprises, ever.

An SSP that matches the network

Controls built into how your IT team or provider already works, and a plan written from the configuration, so this year's score is still true next year.

Expert and experienced consultants

Consultants with information security and management system experience across sectors and countries since 2003, who test each requirement against its evidence before an assessor does.

Sterling vs the rest: the full comparison Explore NIST SP 800-171 client experience

The Sterling Promise

What our NIST SP 800-171 compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until the agreed NIST SP 800-171 outcome is achieved for the boundary and revision in your engagement: requirements implemented, the system security plan complete, a score your evidence supports and, where your contract calls for one, the government or C3PAO assessment supported until its findings close. Clear explanations, practical delivery, included software and employee learning make the protection outlast the assessment.

The engagement records the revision, the boundary, the target outcome and each party's responsibilities. Your organisation supplies accurate information, gives access to the systems in scope, makes the agreed changes and decides what score to post. Government assessors or a C3PAO determine the result of any independent assessment. Our commitment covers the agreed support, not future awards, a year without incidents or changes the Department makes to its programmes.

After the assessment

What happens after your NIST SP 800-171 assessment?

The work does not end with a number in SPRS. The assessment must be current at every offer that needs it, the plan of action carries completion dates you declared, the SSP has to follow the system as it changes, and incidents still go to the Department within 72 hours. The Department can also conduct a Medium or High Assessment, for which you give its assessors access to facilities, systems and people.

Between assessments the boundary moves with new people, tools, sites and contracts. Under Sterling OS™ Sustain™ we keep the SSP, the inventory, the evidence and the score current with you; under Revise™ we manage a change of basis, such as Revision 3 or the Department's decisions on CMMC.

FAQs

Frequently asked questions about NIST SP 800-171

Is there a NIST SP 800-171 certification?

No. NIST is a non-regulatory agency and states that it has no role in determining compliance with SP 800-171, so it issues no certificate. Compliance is shown by the assessment your customer relies on: a Basic Assessment you score and post in SPRS, a Medium or High Assessment by government assessors, or, under CMMC, a Level 2 certification assessment by an authorised C3PAO. A "NIST 800-171 certificate" from anyone else is marketing, not evidence.

Should we implement Revision 2 or Revision 3?

The one your contract enforces. For Department of War contracts that is Revision 2 today: CMMC Level 2 is built on it, SPRS scores are out of 110, and the Department says it is enforcing Revision 2 while CMMC is paused in Phase 1. Where an agency names Revision 3 it may also set the organisation-defined parameters; if it sets none, you do.

What is the SPRS score, and how is it calculated?

It is the summary result of an assessment under the NIST SP 800-171 DoD Assessment Methodology (Version 1.2.1, June 2020), posted in the Supplier Performance Risk System, for example 105 out of 110, with the date by which all requirements will be implemented. A Basic Assessment is your own and carries a low confidence level; Medium and High Assessments are conducted by government assessors and carry medium and high confidence.

What is the difference between NIST SP 800-171 and CMMC?

NIST SP 800-171 is the set of requirements; CMMC is the Department of War's programme for verifying them before award. CMMC Level 2 is the 110 requirements of Revision 2, assessed every three years by the contractor or an authorised C3PAO, as the solicitation specifies, and affirmed annually. Phase 2, which would have added Level 2 (C3PAO) assessments as a condition of award from 10 November 2026, was suspended on 13 July 2026 pending a review; the Phase 1 self-assessment requirements stay in place.

Do subcontractors and suppliers outside the United States need to comply?

If their subcontract carries the requirement, yes. The DFARS safeguarding clause flows down to subcontracts whose performance involves the Department's CUI, and a prime may not award a subcontract subject to SP 800-171 unless the subcontractor has at least a Basic Assessment from the last three years. The CMMC rule makes no exception for location either, so agree the scope and revision with your prime early. Sterling supports suppliers from offices in 21 countries.

Do universities and research organisations need NIST SP 800-171?

When their contract or agreement with a federal agency applies it to CUI, yes. The CUI rule requires agencies to use SP 800-171 for CUI on non-federal systems unless the law, regulation or government-wide policy behind that category prescribes other safeguards. A research group usually meets it with a dedicated, well-bounded environment for the CUI project, not the whole campus network.

Does ISO/IEC 27001 certification make us NIST SP 800-171 compliant?

No, although it helps. Revision 2 carried an informal mapping to ISO/IEC 27001 controls in its Appendix D, which NIST said was not intended to impose additional requirements; Revision 3 dropped it and maps only to NIST SP 800-53, which NIST calls the authoritative source. Your ISMS supplies governance, risk assessment and internal audit, but each SP 800-171 requirement is scored on its own, including specifics such as FIPS-validated cryptography.

Does Sterling assess or certify NIST SP 800-171 compliance?

No. Sterling builds the system security plan, the controls and the evidence; the assessment is yours, the DoD's or your C3PAO's. We are not a C3PAO, and under the Cyber AB's rules a person who helped implement a company's controls may not assess that company. We prepare you, check the evidence and support you through whichever assessment applies.

What do you need to prepare a NIST SP 800-171 proposal?

The contracts or flow-downs and the revision they name, the CUI you receive and from whom, the sites, entities and users in scope, who runs your IT, any existing SPRS score, SSP or plan of action, and your deadline. That is enough for a scoped, all-inclusive proposal.

Before the first call

Prepare a useful NIST SP 800-171 readiness brief

You do not need a system security plan before the first conversation; a short account of the contracts, the information and the systems involved is enough. Seven questions cover it:

Which contract, solicitation, prime or agency is asking, which clauses or revision does it name, and by when? Or, if nobody has asked yet, which federal work do you plan to pursue?
What kinds of CUI arrive or are created in your work, who provides them, and in what form?
Which systems store or carry it: servers, laptops, cloud tenants, file shares, e-mail and collaboration tools, and at which sites?
Roughly how many users and devices can reach CUI, and do any sit with partners or outside the United States?
Is your IT run in-house or by a managed service provider, and what security tooling is deployed?
Is there an SPRS score on record, and when was it calculated? Do an SSP and a plan of action exist?
Which certifications or reports already exist, such as ISO/IEC 27001, AS9100 or SOC 2, that the programme can reuse?

These answers let us scope the work and quote an all-inclusive proposal. They prepare a discussion, not an assessment, and nothing you share becomes a score.

Don’t be fooled by certification scams

If someone sells you a certificate, it is not NIST SP 800-171 compliance.

SP 800-171 compliance is worth something when the requirements are really met and the SPRS score says so accurately. The market also sells substitutes: "NIST 800-171 certified" badges that NIST never issues, system security plans written for somebody else's network, software sold as instant compliance, and scores of 110 posted on the strength of a questionnaire. They cost less, until a government assessment, a prime's review or an incident shows what was never there.

How to choose a credible NIST SP 800-171 consultant

Ask what you will actually receive. NIST has no role in determining compliance and issues no certificate; what counts is an accurate SPRS score and, where required, a government or C3PAO assessment result.
Ask how every requirement will be tested before a score is posted. The Basic Assessment is your organisation's own statement to the Department, and a government Medium Assessment starts by reviewing it.
Keep the people who build apart from the people who assess. For CMMC the Cyber AB bars an individual who helped implement a company's controls from assessing that company; confirm any C3PAO on its CMMC Marketplace.
Identify who carries each task, which costs belong to technology, providers or a C3PAO, and what support exists when requirements are found not met.
Ask where the evidence will live and what your people will learn. Scores must stay current; without records and training every reassessment starts from memory.
Walk away from "certified in two weeks", "guaranteed 110" and compliance in a box. The requirements are met by controls that operate, not documents that exist.

All ten warning signs of shortcut certification

What genuine NIST SP 800-171 compliance always involves

A boundary that follows the CUI, with every component that stores, processes, transmits or protects it identified
The requirements of the revision your contract names, in place across that boundary
A system security plan that describes the system as configured
Plans of action with realistic milestones for anything not yet met
A score calculated with the DoD Assessment Methodology and posted in SPRS, where the DFARS clauses apply
A government Medium or High Assessment, or a C3PAO assessment under CMMC, where required
Reassessment before the score is three years old, and incidents reported within 72 hours

Sterling's position. Sterling does not certify or assess, is not a C3PAO and does not post scores for you; NIST certifies no one. We consult, train and prepare you; you score and post your own Basic Assessment, and government assessors or an authorised C3PAO conduct any independent assessment. We do not sell scores without controls, and we tell you when an offer you have received is a shortcut.

Holding a "NIST 800-171 certificate", a pre-written SSP or an offer that sounds too easy? Send it to us and we will tell you, at no charge, whether it would stand up to a government assessment or a prime's review.

Keep exploring

More on NIST SP 800-171 and related standards

More in Information security, cyber & cloud

Talk to a consultant

Plan your NIST SP 800-171 compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Implement NIST SP 800-171 and post our first SPRS scoreUnderstand cost, scope and timingRaise an existing SPRS score and evidence itPrepare for a DoD assessment or CMMC Level 2

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice