NIST SP 800‑171 Rev. 3 Protecting Controlled Unclassified Information

Document Background

SP 800‑171 exists because of a simple problem: the federal government shares sensitive (but unclassified) information with thousands of nonfederal organizations, including defense contractors, universities conducting sponsored research, state and local agencies, and critical infrastructure operators. Those organizations do not operate under the Federal Information Security Modernization Act (FISMA) and are not required to implement the full SP 800‑53 control catalog. SP 800‑171 bridges that gap by providing a tailored set of security requirements derived from SP 800‑53 that are appropriate for nonfederal systems handling Controlled Unclassified Information (NIST, 2024, Chapter 1).

The first edition was published in 2015 in response to Executive Order 13556, which established the CUI program. Revision 2 (2020) refined the requirements and became the baseline for the Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program. Revision 3, published in May 2024, represents a major reorganization that aligns the document more closely with SP 800‑53 Rev. 5 and introduces a more consistent structure across all control families (NIST, 2024).

CUI and Why It Matters

Controlled Unclassified Information (CUI) is information that the government creates or possesses, or that an entity creates or possesses on behalf of the government, that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and government‑wide policies. CUI is not classified (it does not carry a classification marking like Confidential, Secret, or Top Secret), but it is sensitive enough that unauthorized disclosure could cause harm (NIST, 2024).

Examples of CUI categories include technical data subject to export controls, personally identifiable information (PII) held by contractors, law enforcement sensitive information, critical infrastructure security information, and controlled technical information related to military systems. The National Archives and Records Administration (NARA) maintains the CUI Registry, which catalogs all recognized CUI categories and their handling requirements.

The CUI program replaced a patchwork of agency‑specific designations (For Official Use Only, Sensitive But Unclassified, Law Enforcement Sensitive, and dozens of others) with a single, standardized framework. Before CUI, a contractor working with multiple agencies might face contradictory handling requirements for similar types of information. The CUI program and SP 800‑171 provide consistency (NIST, 2024, Chapter 1).

The Control Families

SP 800‑171 Rev. 3 organizes its security requirements into 17 control families. These families mirror the structure of SP 800‑53 Rev. 5, though not every SP 800‑53 family is represented (some, like Program Management, are not applicable to nonfederal CUI environments). Each family contains a set of specific security requirements that organizations must implement (NIST, 2024, Chapter 3).

Each requirement within these families is stated as a concise, testable statement. For example, within the Access Control family, a requirement might specify that the organization limits system access to the types of transactions and functions that authorized users are permitted to execute. The requirements are deliberately technology‑neutral; they describe what must be achieved, not how to achieve it, leaving implementation details to the organization (NIST, 2024).

Relationship to 800‑53

SP 800‑171 is not a standalone invention. Its requirements are derived directly from SP 800‑53 Rev. 5, which is the comprehensive catalog of security and privacy controls used by federal agencies under FISMA. The derivation process works as follows: NIST starts with the Moderate baseline of SP 800‑53 controls (the baseline appropriate for systems where the loss of confidentiality would have a serious adverse effect), then removes controls that are uniquely federal in nature (such as those that assume a federal agency organizational structure), controls that are not directly related to protecting the confidentiality of CUI, and controls that are expected to be satisfied by nonfederal organizations through other means (NIST, 2024, Chapter 2).

The result is a tailored subset that is smaller than the full Moderate baseline but still comprehensive enough to provide meaningful protection for CUI. Rev. 3 made this relationship more explicit and traceable than previous editions by aligning the family structure and requirement numbering more closely with SP 800‑53 Rev. 5 (NIST, 2024).

CMMC Connection

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the Department of Defense's mechanism for verifying that defense contractors actually implement the SP 800‑171 requirements they claim to meet. Before CMMC, compliance was self‑attested: contractors submitted a score on the Supplier Performance Risk System (SPRS) based on their own assessment. CMMC adds third‑party and government‑led assessments to raise the bar (NIST, 2024).

CMMC 2.0 Levels

Level 1 (Foundational): Requires implementation of 15 basic safeguarding requirements from FAR 52.204‑21. These are a small subset of SP 800‑171 requirements focused on fundamental practices like limiting access and sanitizing media. Self‑assessment is sufficient at this level.

Level 2 (Advanced): Requires implementation of all 110 security requirements from SP 800‑171 Rev. 2 (and will transition to Rev. 3 requirements as the program matures). Most contracts involving CUI will require Level 2 compliance. Depending on the sensitivity of the CUI, either self‑assessment or a third‑party assessment by a Certified Third‑Party Assessment Organization (C3PAO) is required.

Level 3 (Expert): Requires SP 800‑171 requirements plus additional controls from SP 800‑172 (enhanced security requirements). This level is reserved for the most sensitive programs and requires a government‑led assessment by the Defense Contract Management Agency (DCMA).

Rev. 2 vs. Rev. 3 at a Glance

Revision 3 is not a minor update. It represents a structural overhaul designed to improve clarity, traceability to SP 800‑53 Rev. 5, and consistency across control families (NIST, 2024).

The addition of Organization‑Defined Parameters (ODPs) is particularly significant. In Rev. 2, many requirements used fixed values or left implementation details ambiguous. In Rev. 3, ODPs allow organizations to specify values appropriate to their environment (for example, the frequency of audit log reviews or the timeout period for inactive sessions) while still meeting the intent of the requirement. This makes the framework more flexible without reducing its rigor (NIST, 2024).

Citing This Document (APA 7)

SP 800‑171 Rev. 3 follows the standard APA 7 pattern for government technical reports. NIST is the group author, the special publication number is the report identifier, and the U.S. Department of Commerce is the publisher.

When discussing both SP 800‑171 and SP 800‑53 in the same paper, be careful with dates. SP 800‑53 Rev. 5 was published in 2020 (updated 2024), while SP 800‑171 Rev. 3 was published in 2024. Listing both in the reference section and citing each with its correct year avoids ambiguity.