NIST 800-171 is the NIST publication that lists the security requirements non-federal systems must meet when they store, process, or transmit Controlled Unclassified Information (CUI) on behalf of a federal agency. It is the control catalog behind the DoD's CMMC program. Revision 3 was published in May 2024.
What changed in NIST 800-171 Revision 3?
Revision 3 trimmed the count from 110 requirements down to 97, kept the 17-family structure, and reworded language to track NIST 800-53 r5.
R3 added three new families (Planning, System and Services Acquisition, Supply Chain Risk Management) to align with the SP 800-53B moderate baseline (NIST SP 800-171r3). The matching assessment guide is SP 800-171A r3.
How does NIST 800-171 connect to CMMC and NIST CSF?
800-171 defines the controls a contractor must run on CUI systems. CMMC adds a third-party audit and certification on top of the same control set.
CMMC Level 2 today still tests against r2, not r3. The DoD issued a DFARS Class Deviation in May 2024 keeping r2 in force for DFARS 252.204-7012 and the CMMC program; r3 adoption is expected in a later phase. NIST CSF 2.0 sits one layer up as the strategic framework.
Who has to implement NIST 800-171?
Any non-federal system processing, storing, or transmitting Controlled Unclassified Information from a DoD or federal customer is in scope.
That includes prime contractors, subcontractors, university research labs, and SaaS vendors whose products touch CUI. The flow-down clause in DFARS 252.204-7012 has carried 800-171 obligations to a wide subset of the defense supply chain since 2017.
Related terms
These adjacent terms cover the audit and framework neighbors any contractor working CUI material runs into when scoping an 800-171 program.
- CMMC - the DoD audit program that certifies contractors against 800-171
- NIST CSF 2.0 - the strategy framework most teams pair with 800-171 for org-wide reporting
- CUI - Controlled Unclassified Information, the data class 800-171 protects
- DFARS 7012 - the Defense FAR Supplement clause that flows 800-171 to defense contractors