--- question: "What is NIST SP 800-171?" title: "What Is NIST SP 800-171" seoTitle: "What Is NIST SP 800-171? CUI Requirements Explained" summary: "NIST SP 800-171 defines 110 security requirements across 14 families for protecting Controlled Unclassified Information on nonfederal systems. It applies to contractors and subcontractors handling CUI for the US government, is enforced through DFARS contract clauses, and forms the technical basis of CMMC Level 2. It is a derived subset of NIST 800-53's moderate baseline, not a separate framework." publishedAt: "2026-08-18" keywords: - "NIST SP 800-171" - "NIST special publication 800 171" - "NIST 800 53 vs 800 171" - "CUI requirements" - "CMMC Level 2" pillar: "Beyond SOC 2" faqs: - question: "Who has to comply with NIST 800-171?" answer: "Nonfederal organisations that store, process, or transmit Controlled Unclassified Information for a US federal agency. In practice that means defence and civilian contractors and their subcontractors, with the obligation arriving through a DFARS or agency contract clause rather than through law directly." - question: "What is the difference between NIST 800-53 and 800-171?" answer: "800-53 is the full control catalogue for federal systems, roughly 1,000 controls across 20 families. 800-171 is a 110-requirement subset across 14 families, derived from the 800-53 moderate baseline and rewritten for nonfederal systems handling CUI. If you are a contractor, 800-171 is your obligation." - question: "How does 800-171 relate to CMMC?" answer: "CMMC Level 2 is an assessment and certification scheme built on the 110 requirements of 800-171. 800-171 tells you what to implement; CMMC decides who verifies it and how. A self-attested 800-171 score is what CMMC replaces with third-party assessment for most Level 2 contracts." --- ## What is NIST SP 800-171? NIST SP 800-171 defines **110 security requirements across 14 families** for protecting **Controlled Unclassified Information** on nonfederal systems. It applies to contractors and subcontractors that handle CUI for the US government, arrives through DFARS or agency contract clauses, and forms the technical basis of CMMC Level 2. It is a derived subset of NIST 800-53's moderate baseline rather than an independent framework. ### The 14 requirement families Access Control · Awareness and Training · Audit and Accountability · Configuration Management · Identification and Authentication · Incident Response · Maintenance · Media Protection · Personnel Security · Physical Protection · Risk Assessment · Security Assessment · System and Communications Protection · System and Information Integrity 110 requirements distributed across those 14. Substantially smaller than 800-53, and that is the point: it is scoped to one problem, protecting CUI outside federal systems. ## 800-53 or 800-171, and how to tell | | NIST 800-53 | NIST SP 800-171 | |---|---|---| | Applies to | Federal information systems | Nonfederal systems holding CUI | | Size | ~1,000 controls, 20 families | 110 requirements, 14 families | | Enforced by | FISMA, FedRAMP | DFARS and agency contract clauses | | Relationship | The catalogue | A derived, tailored subset | | Certification | None | Via CMMC for most Level 2 contracts | The practical test: if a federal agency runs the system, 800-53. If you are a company holding government information on your own systems, 800-171. ## What CUI actually is Information the government creates or possesses, or that an entity creates for the government, which requires safeguarding under law or policy but is **not classified**. Technical drawings, research data, procurement information. The contract that imposes the obligation should identify the CUI categories involved, and if it does not, that is a question to ask before signing rather than after. ## The CMMC relationship CMMC does not replace 800-171, it verifies it. The 110 requirements stay the same; CMMC decides who assesses them and how. Level 2 requires third-party assessment for most contracts, replacing the self-attested SPRS score that preceded it. ## Honest scope note Screenata supports SOC 2, HIPAA, ISO 27001, and ISO 42001 through a NIST 800-53 hub. **We do not currently support NIST 800-171 or CMMC as enrollable frameworks.** Because 800-171 derives from the 800-53 moderate baseline, much of the underlying evidence overlaps with work an existing programme already produces, but the assessment path and the requirement mapping are not something we ship today.