Beyond SOC 2
What is NIST SP 800-171?
What is NIST SP 800-171?
NIST SP 800-171 defines 110 security requirements across 14 families for protecting Controlled Unclassified Information on nonfederal systems. It applies to contractors and subcontractors that handle CUI for the US government, arrives through DFARS or agency contract clauses, and forms the technical basis of CMMC Level 2. It is a derived subset of NIST 800-53's moderate baseline rather than an independent framework.
The 14 requirement families
Access Control · Awareness and Training · Audit and Accountability · Configuration Management · Identification and Authentication · Incident Response · Maintenance · Media Protection · Personnel Security · Physical Protection · Risk Assessment · Security Assessment · System and Communications Protection · System and Information Integrity
110 requirements distributed across those 14. Substantially smaller than 800-53, and that is the point: it is scoped to one problem, protecting CUI outside federal systems.
800-53 or 800-171, and how to tell
| NIST 800-53 | NIST SP 800-171 | |
|---|---|---|
| Applies to | Federal information systems | Nonfederal systems holding CUI |
| Size | ~1,000 controls, 20 families | 110 requirements, 14 families |
| Enforced by | FISMA, FedRAMP | DFARS and agency contract clauses |
| Relationship | The catalogue | A derived, tailored subset |
| Certification | None | Via CMMC for most Level 2 contracts |
The practical test: if a federal agency runs the system, 800-53. If you are a company holding government information on your own systems, 800-171.
What CUI actually is
Information the government creates or possesses, or that an entity creates for the government, which requires safeguarding under law or policy but is not classified. Technical drawings, research data, procurement information. The contract that imposes the obligation should identify the CUI categories involved, and if it does not, that is a question to ask before signing rather than after.
The CMMC relationship
CMMC does not replace 800-171, it verifies it. The 110 requirements stay the same; CMMC decides who assesses them and how. Level 2 requires third-party assessment for most contracts, replacing the self-attested SPRS score that preceded it.
Honest scope note
Screenata supports SOC 2, HIPAA, ISO 27001, and ISO 42001 through a NIST 800-53 hub. We do not currently support NIST 800-171 or CMMC as enrollable frameworks. Because 800-171 derives from the 800-53 moderate baseline, much of the underlying evidence overlaps with work an existing programme already produces, but the assessment path and the requirement mapping are not something we ship today.