NIST SP 800-171 in one read

A defense contractor that handles controlled unclassified information (CUI) on its own systems is held to a published list of security requirements: National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. It reaches contractors through Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. NIST shows Revision 2 withdrawn and superseded by Revision 3, and the Department of War (DoW) says it enforces Revision 2, as of October 12, 2026.

What the publication covers

The full title is Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The NIST page for Revision 3 describes it as recommended security requirements for protecting the confidentiality of CUI, written for federal agencies to use in contracts and other agreements with nonfederal organizations. A companion, SP 800-171A, provides the assessment procedures.

The requirements apply to the components of a nonfederal system that process, store, or transmit CUI, and to components that protect them. The Revision 3 text says they do not apply to nonfederal organizations that collect or maintain information on an agency's behalf, or that operate a system for an agency.

How the contract brings it in

For defense contractors the obligation comes from the contract. DFARS clause 252.204-7012, dated May 2024 on Acquisition.gov, applies to a covered contractor information system: an unclassified system owned or operated by or for the contractor that processes, stores, or transmits covered defense information. The clause defines covered defense information as unclassified controlled technical information or other information from the CUI Registry that requires safeguarding or dissemination controls, and that is either marked and provided by or for the Department of Defense (DoD) or collected, developed, or handled by or for the contractor to perform the contract.

Paragraph (b)(2)(i) requires the security requirements of NIST SP 800-171 in effect at the time the solicitation is issued, or as the contracting officer authorizes. Paragraph (b)(2)(ii)(A) required implementation no later than December 31, 2017. A contractor that wants to vary from a requirement submits a written request to the contracting officer, who forwards it to the DoD Chief Information Officer. An approved variance means the requirement need not be implemented.

Paragraph (m) requires the clause, unaltered except to identify the parties, in subcontracts for operationally critical support or involving covered defense information. The clause also sets a 72-hour reporting standard for cyber incidents and requires external cloud providers that handle covered defense information to meet security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.

The same list of requirements underlies the Cybersecurity Maturity Model Certification (CMMC) program. The DoW About CMMC page ties the 110 Level 2 requirements in Revision 2 to clause 252.204-7012.

The 17 requirement families

The Revision 3 text organizes its requirements into 17 families:

• Access Control
• Audit and Accountability
• Awareness and Training
• Configuration Management
• Identification and Authentication
• Incident Response
• Maintenance
• Media Protection
• Personnel Security
• Physical Protection
• Planning
• Risk Assessment
• Security Assessment and Monitoring
• System and Communications Protection
• System and Information Integrity
• System and Services Acquisition
• Supply Chain Risk Management

The requirements start from the controls in the moderate baseline of SP 800-53 and are tailored to remove selected controls. The Revision 3 text omits three SP 800-53 families: PII Processing and Transparency, Program Management, and Contingency Planning. It explains that Contingency Planning concerns availability, and the publication addresses the confidentiality of CUI.

Revision 2 and Revision 3

Revision 2 was published in February 2020 and updated on January 28, 2021. NIST's Revision 2 page shows it withdrawn on May 14, 2024 and superseded by Revision 3.

Revision 3 went through three drafts, dated July 19, 2022, May 10, 2023, and November 9, 2023, before the final version on May 14, 2024. According to NIST's announcement, it restructured the requirements to align directly with SP 800-53 Revision 5 controls, introduced new tailoring criteria to reduce redundancy and improve clarity, and added outcome-oriented guidance. It also added organization-defined parameters, which are values that an agency, or otherwise the nonfederal organization, assigns to complete certain requirements. NIST published an analysis of changes and a set of frequently asked questions alongside it.

Which revision assessments use

NIST shows Revision 2 withdrawn and Revision 3 as the revision that supersedes it. The DFARS clause points to the version in effect when a solicitation is issued, unless the contracting officer authorizes otherwise, and it does not name a revision.

The About CMMC page from the DoW Chief Information Officer (CIO) is more specific and more recent. It says Level 2 assessments cover the 110 security requirements in Revision 2, and a July 13, 2026 notice about the suspension of CMMC Phase II says that during this period the department will enforce compliance with Revision 2. The page does not mention Revision 3. On that basis, assessments currently use Revision 2, as of October 12, 2026.

What to check

• Which revision of SP 800-171 the solicitation names. The clause points to the version in effect when the solicitation is issued, unless the contracting officer authorizes otherwise.
• Whether a vendor's statement of 110 requirements refers to Revision 2, the revision the DoW page counts for Level 2.
• Whether the clause is flowed down in subcontracts for operationally critical support or involving covered defense information (paragraph (m)).
• Whether any variance was requested in writing through the contracting officer, and approved, before a requirement is treated as not implemented.
• Whether external cloud providers that handle covered defense information meet the FedRAMP Moderate equivalent, and whether the 72-hour reporting standard is addressed.

Sources

1. 1NIST Special Publication (SP) 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations · NIST Computer Security Resource Center
2. 2Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171r3, HTML edition) · National Institute of Standards and Technology
3. 3NIST Special Publication (SP) 800-171 Rev. 2 (Withdrawn), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations · NIST Computer Security Resource Center
4. 4NIST Issues Updated Security Requirements and Assessment Procedures for Protecting Controlled Unclassified Information (CUI) · National Institute of Standards and Technology
5. 5252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting · Acquisition.gov
6. 6About CMMC · Department of War Chief Information Officer