Skip to main content
Cyber Risk Council
Category: Compliance Frameworks & Standards

NIST SP 800-171

Also known as: SP 800-171, NIST Special Publication 800-171, 800-171, NIST SP800-171
Simply put

NIST SP 800-171 is a U.S. government publication that lays out recommended security requirements for protecting sensitive but unclassified government information, known as Controlled Unclassified Information (CUI), when it lives on systems that are not run by the federal government. It generally applies to non-federal organizations, such as contractors and their partners, that store, process, or handle this kind of information. The publication has been revised over time, with Revision 2 and the later Revision 3 being the versions organizations most commonly reference.

Formal definition

NIST SP 800-171 is a NIST Special Publication that specifies recommended security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations. It codifies requirements that non-Federal information systems must satisfy to store, process, or transmit CUI, organized into families of security requirements. Revision 2 (2021) and Revision 3 (2024) represent successive iterations, with Rev. 3 reflecting extended data collection, technical analysis, and redesign of the security requirements. A virtual CISO can support an organization's readiness and gap assessment against SP 800-171, but the publication itself defines requirements rather than conferring compliance or certification; organizational accountability for meeting and attesting to these requirements typically remains with the client organization and any contractual or regulatory obligations it holds.

Why it matters

For organizations that do business with the U.S. government, NIST SP 800-171 defines the baseline expectations for protecting Controlled Unclassified Information (CUI) when that information resides on systems the federal government does not operate. Because CUI often flows from federal agencies down through prime contractors to subcontractors and partners, the reach of the publication extends well beyond direct government suppliers. Meeting its requirements can become a condition of winning or retaining contracts, which makes it a business and risk-management concern, not merely a technical one.

The publication has evolved over time. Revision 2 (2021) and Revision 3 (2024) represent successive iterations, with Rev. 3 reflecting extended data collection, technical analysis, customer interaction, and a redesign of the security requirements. Organizations that aligned to an earlier revision may need to reassess as expectations shift, and the version an organization must satisfy is often driven by contractual or regulatory obligations rather than by choice.

A critical point that experienced leaders stress: SP 800-171 defines recommended security requirements; it does not by itself confer compliance or certification. Satisfying the requirements, attesting to that status, and carrying the associated legal and organizational accountability typically remain with the client organization and the contractual or regulatory obligations it holds. Treating the document as a checklist that guarantees a favorable outcome, or assuming an external advisor absorbs that accountability, is a common and consequential misunderstanding.

Who it's relevant to

Government contractors and their partners
Non-federal organizations that store, process, or transmit CUI on their own systems are the primary audience. This includes prime contractors as well as subcontractors and partners further down the supply chain, since CUI-handling obligations often flow through contractual relationships.
Security and compliance leaders
Those responsible for governance and risk use SP 800-171 as a reference point for gap assessment, remediation planning, and evidencing the state of their program. They should be clear that alignment to the requirements supports readiness but does not by itself constitute certification or transfer accountability.
Executives and officers accountable for contractual obligations
Because legal and organizational accountability for meeting and attesting to the requirements typically remains with the client organization and its officers, leadership needs to understand which revision applies and how the requirements tie to the organization's contractual or regulatory commitments.
Virtual and fractional CISOs advising affected organizations
A vCISO can support readiness and gap assessment against SP 800-171, help interpret the security requirement families, and direct remediation efforts. The engagement generally focuses on strategy, governance, and program development rather than hands-on operational implementation, and its value depends on client cooperation and defined scope.

Inside SP 800-171

Controlled Unclassified Information (CUI) Focus
NIST SP 800-171 provides requirements for protecting the confidentiality of CUI when it resides in nonfederal systems and organizations, typically relevant to contractors and subcontractors handling government-related information.
Security Requirement Families
The publication organizes its requirements into families addressing areas such as access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, and system and communications protection, among others.
Basic and Derived Requirements
Within each family, requirements are typically structured as basic requirements that state high-level objectives and derived requirements that provide more specific supporting detail.
Relationship to CMMC
NIST SP 800-171 requirements often serve as a foundation for CMMC assessments, though the two are distinct; a virtual CISO engagement may support readiness against 800-171 controls without asserting formal certification.
Governance and Program Alignment
The standard is generally addressed through a combination of policy, process, and technical controls, which a virtual CISO may help map, prioritize, and integrate into an organization's broader security program.

Common questions

Answers to the questions practitioners most commonly ask about SP 800-171.

Does hiring a virtual CISO make my organization NIST SP 800-171 compliant?
No. Engaging a virtual CISO does not by itself produce compliance with NIST SP 800-171. A vCISO typically supports readiness by assessing gaps against the control requirements, advising on remediation priorities, and helping build the governance and documentation needed to demonstrate implementation. Actual compliance depends on the client organization implementing the controls, maintaining evidence, and, where applicable, undergoing assessment. Accountability for meeting the requirements generally remains with the client organization and its officers, not the vCISO, unless a contract specifies otherwise.
Is NIST SP 800-171 the same as CMMC certification?
They are related but not the same, and treating them as interchangeable is a common mistake. NIST SP 800-171 is a set of control requirements for protecting Controlled Unclassified Information in non-federal systems, while CMMC is a separate assessment and certification framework that draws on those requirements to verify implementation across the defense industrial base. Meeting the 800-171 requirements is generally foundational to CMMC readiness, but the certification process, assessment mechanics, and scope may differ. A vCISO can support readiness for both, but supporting readiness is distinct from asserting that certification has been achieved.
How does a virtual CISO typically approach a NIST SP 800-171 engagement?
In many engagements, a vCISO begins with a gap assessment comparing current practices against the control families, then helps document a System Security Plan and Plan of Action and Milestones where those artifacts are expected. From there they often advise on prioritizing remediation based on business risk and resource constraints, and provide governance oversight as the client implements changes. The vCISO generally directs and advises at the strategy and program level rather than performing hands-on technical tasks such as tool configuration or continuous monitoring, unless those activities are explicitly contracted.
What is typically out of scope when a vCISO supports NIST SP 800-171 work?
Scope varies by provider and contract, but a virtual CISO engagement typically excludes hands-on operational execution such as administering security tools, running SOC monitoring, or executing incident response. It also does not usually include acting as the certifying assessor, since that role generally sits with an independent party. The vCISO's contribution is often concentrated in strategy, governance, control interpretation, documentation guidance, and executive-level direction, so buyers should confirm in writing which implementation tasks are included.
What does successful NIST SP 800-171 support from a vCISO depend on?
Engagement value often depends on organizational maturity, the availability and cooperation of internal stakeholders, and clearly defined scope and access. Because many 800-171 controls require operational change across IT, HR, and business units, a vCISO's guidance is more effective when the client can dedicate resources to implementation and provide access to systems, documentation, and decision-makers. Limited access or unclear scope can constrain what the engagement is able to achieve.
How should an organization document its NIST SP 800-171 posture during a vCISO engagement?
Documentation commonly centers on artifacts such as a System Security Plan describing how controls are implemented and a Plan of Action and Milestones tracking gaps and remediation timelines. A vCISO often helps structure and maintain these records and align them with the control requirements so the organization can demonstrate its posture over time. The client typically retains ownership of and accountability for this evidence, and the specific documentation expectations may vary depending on contractual and assessment requirements.

Common misconceptions

A virtual CISO engagement guarantees NIST SP 800-171 compliance or CMMC certification.
A virtual CISO typically supports readiness by advising on gap analysis, control mapping, and program development, but compliance and any certification outcomes depend on client implementation, assessment processes, and organizational cooperation. The vCISO advises and directs rather than guaranteeing certification.
NIST SP 800-171 and CMMC are the same thing.
They are related but distinct. NIST SP 800-171 defines requirements for protecting CUI in nonfederal systems, while CMMC is a separate framework that often builds upon those requirements and may add assessment and maturity elements.
A vCISO will directly implement and operate all the technical controls required by NIST SP 800-171.
A virtual CISO generally provides strategy, governance, and executive-level guidance and does not typically perform hands-on operational tasks such as tool administration or configuration unless explicitly contracted. Accountability for implementing controls usually remains with the client organization.

Best practices

Begin with a documented gap analysis that maps existing controls against the relevant NIST SP 800-171 requirement families to identify prioritized areas for remediation.
Clarify scope in the engagement contract, distinguishing between advisory support for readiness and any hands-on operational work, so expectations about vCISO responsibilities are explicit.
Distinguish NIST SP 800-171 readiness from CMMC certification in planning discussions, and avoid representing readiness support as an assertion of formal certification.
Maintain accountability with client officers by ensuring security decisions, control ownership, and implementation responsibilities are formally assigned within the organization.
Structure remediation around both basic and derived requirements within each family, and document evidence of implementation to support future assessments.
Secure stakeholder access and organizational cooperation early, since the value of readiness work depends heavily on client maturity, resource availability, and follow-through.