NIST SP 800-171 — CUI Protection for Non-Federal Systems¶

What This Skill Does¶

This skill guides you through NIST SP 800-171 Revision 2 compliance: assessing, implementing, and documenting the 110 security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations. It covers all 14 control families, SPRS scoring, POA&M management, and the path to CMMC Level 2 compliance.

Framework Overview¶

NIST SP 800-171r2 defines 110 security requirements organized into 14 families. These protect CUI handled by non-federal contractors and subcontractors under DFARS 252.204-7012. Unlike FISMA (which governs federal agencies), 800-171 governs contractors who process, store, or transmit CUI on behalf of the federal government.

Key documents: - NIST SP 800-171r2 — the requirements standard - NIST SP 800-171A — assessment procedures (the "how to audit" companion) - DoD Assessment Methodology — scoring guidance for SPRS submission - DFARS 252.204-7012 / 7019 / 7020 / 7021 — contract clauses that invoke 800-171

The 14 Control Families¶

1. Access Control (AC) — 3.1.x — 22 controls¶

Limit system access to authorized users, devices, and processes. Enforce least privilege, separate duties, control remote access sessions, and manage mobile/wireless/external connections.

Critical controls: - 3.1.1 — Limit access to authorized users and devices - 3.1.2 — Limit access to permitted transactions and functions - 3.1.5 — Employ least privilege including privileged accounts - 3.1.12 — Monitor and control remote access sessions - 3.1.13 — Encrypt remote access sessions cryptographically - 3.1.17 — Protect wireless access with authentication and encryption

2. Awareness and Training (AT) — 3.2.x — 3 controls¶

Ensure managers, admins, and users understand security risks. Provide role-based training. Train on insider threat indicators.

3.2.1 — Security awareness for all system users
3.2.2 — Role-based training for security responsibilities
3.2.3 — Insider threat recognition and reporting

3. Audit and Accountability (AU) — 3.3.x — 9 controls¶

Create, retain, and protect audit logs. Ensure user actions are traceable. Alert on logging failures. Correlate events across systems.

Critical controls: - 3.3.1 — Create and retain audit logs - 3.3.2 — Ensure actions are uniquely traceable to users - 3.3.5 — Correlate audit records for investigation - 3.3.8 — Protect audit information from unauthorized access/modification

4. Configuration Management (CM) — 3.4.x — 9 controls¶

Establish baselines, enforce secure configurations, track changes, apply least functionality. Control user-installed software.

3.4.1 — Establish and maintain baseline configurations
3.4.2 — Enforce security configuration settings
3.4.6 — Least functionality (only essential capabilities)
3.4.8 — Application allowlisting/denylisting

5. Identification and Authentication (IA) — 3.5.x — 11 controls¶

Identify and authenticate users, processes, and devices before granting access. Enforce MFA. Manage passwords and credentials securely.

Critical controls: - 3.5.1 — Identify all system users and devices - 3.5.2 — Authenticate identities before granting access - 3.5.3 — MFA for privileged accounts (local and network) and all non-privileged network accounts - 3.5.10 — Store and transmit only cryptographically protected passwords

6. Incident Response (IR) — 3.6.x — 3 controls¶

Establish operational incident handling: preparation, detection, containment, recovery. Track and report incidents. Test the capability.

3.6.1 — Establish incident handling capability
3.6.2 — Track, document, and report incidents
3.6.3 — Test incident response capability

7. Maintenance (MA) — 3.7.x — 6 controls¶

Control maintenance activities, tools, and personnel. Require MFA for remote maintenance sessions. Sanitize equipment before off-site maintenance.

3.7.3 — Sanitize CUI from equipment before off-site maintenance
3.7.5 — MFA for nonlocal (remote) maintenance sessions

8. Media Protection (MP) — 3.8.x — 9 controls¶

Protect, limit access to, mark, and sanitize system media containing CUI. Control transport of media. Encrypt CUI on portable storage.

3.8.1 — Physically protect and securely store CUI media
3.8.3 — Sanitize or destroy media before disposal/reuse
3.8.6 — Encrypt CUI on digital media during transport

9. Personnel Security (PS) — 3.9.x — 2 controls¶

Screen individuals before granting system access. Protect systems during and after terminations and transfers.

3.9.1 — Screen individuals prior to access authorization
3.9.2 — Protect systems during terminations and transfers (revoke access promptly)

10. Physical Protection (PE) — 3.10.x — 6 controls¶

Limit physical access to authorized individuals. Monitor facilities. Escort visitors. Maintain physical access audit logs. Enforce CUI safeguards at alternate work sites.

3.10.1 — Limit physical access to authorized individuals
3.10.2 — Monitor physical facility and infrastructure
3.10.6 — Enforce CUI safeguards at alternate work sites (remote workers)

11. Risk Assessment (RA) — 3.11.x — 3 controls¶

Periodically assess risk. Scan for vulnerabilities. Remediate in accordance with risk assessments.

3.11.1 — Periodic organizational risk assessment
3.11.2 — Vulnerability scanning (periodic and when new vulns identified)
3.11.3 — Remediate vulnerabilities per risk assessment prioritization

12. Security Assessment (CA) — 3.12.x — 4 controls¶

Periodically assess security controls. Develop and implement POA&Ms. Monitor controls on an ongoing basis. Maintain system security plans.

3.12.1 — Periodically assess security control effectiveness
3.12.2 — Develop and implement plans of action (POA&Ms)
3.12.3 — Ongoing monitoring of security control effectiveness
3.12.4 — Develop and maintain system security plan (SSP)

13. System and Communications Protection (SC) — 3.13.x — 16 controls¶

Monitor and protect communications at boundaries. Architect for security. Encrypt CUI in transit and at rest. Prevent split tunneling. Use FIPS-validated cryptography.

Critical controls: - 3.13.1 — Boundary protection: monitor/control at external and key internal boundaries - 3.13.5 — DMZ/subnetworks for publicly accessible components - 3.13.6 — Deny-by-default network communications - 3.13.8 — Encrypt CUI in transit (TLS, VPN) - 3.13.11 — FIPS-validated cryptography for CUI confidentiality - 3.13.16 — Protect CUI at rest

14. System and Information Integrity (SI) — 3.14.x — 7 controls¶

Identify and correct flaws. Protect against malicious code. Monitor for attacks and unauthorized use. Update malicious code protections.

3.14.1 — Identify, report, and correct system flaws timely
3.14.2 — Malicious code protection at designated locations
3.14.6 — Monitor inbound and outbound traffic for attacks
3.14.7 — Identify unauthorized use of systems

SPRS Score System¶

The Supplier Performance Risk System (SPRS) score represents a contractor's self-assessed compliance posture. DoD contractors must submit scores via SPRS before award and maintain them.

Scoring methodology (DoD Assessment Methodology v1.2.1): - Maximum score: 110 (full compliance) - Each of the 110 controls has a point value (most are 1 point; some multi-part controls are worth more) - Start at 110; deduct points for each unmet control - Negative scores are possible and reportable - Formula: SPRS Score = 110 - (sum of deductions for non-compliant controls)

Point deduction values: - 1-point controls: most basic controls - 3-point controls: high-impact controls (MFA, encryption, audit logging, boundary protection) - 5-point controls: critical controls (SSP, incident response capability)

SPRS submission requirements: - Submit at: https://www.sprs.csd.disa.mil - Required before contract award (DFARS 252.204-7019) - Must reflect current state at time of submission - DoD can request the supporting SSP for verification (DFARS 252.204-7020)

Self-Assessment Methodology¶

Step 1: Define System Boundary¶

Identify all systems, networks, devices, and cloud services that process, store, or transmit CUI
Document enclave boundary (what's in scope vs. out of scope)
Map data flows for CUI: where does it enter, move, rest, and exit?
Include all connected systems that could impact CUI confidentiality

Step 2: Develop the System Security Plan (SSP)¶

Document system name, purpose, boundary, and environment
For each of the 110 controls: state MET, NOT MET, or NOT APPLICABLE with justification
Describe how each met control is implemented (with specifics, not boilerplate)
Required by 3.12.4; also required for DoD review under DFARS 252.204-7020

Step 3: Collect Evidence¶

For each control, gather one or more of: - Examine: Policies, procedures, configuration screenshots, system logs, network diagrams - Interview: System owners, admins, security personnel (document responses) - Test: Run scans, attempt access, verify configurations functionally

Step 4: Gap Analysis¶

List all NOT MET controls
Categorize by family and by effort to remediate (quick win vs. major project)
Calculate current SPRS score
Identify highest-deduction gaps to prioritize

Step 5: Build the POA&M¶

For each gap: - Control ID and description - Current weakness/deficiency - Planned remediation action - Milestones with target completion dates - Responsible party - Resources required (cost estimate)

Step 6: Submit and Maintain¶

Submit SPRS score reflecting current state (not target state)
Update SSP and POA&M as controls are implemented
Resubmit SPRS score after significant changes

POA&M Structure¶

A Plan of Actions and Milestones documents unmet controls and the roadmap to address them.

Required fields per POA&M item:

Control ID:        3.5.3
Requirement:       Use multifactor authentication for local and network access to privileged accounts
Weakness:          MFA is not enforced for local privileged access on 12 workstations
Severity:          High (3-point deduction)
Scheduled Completion: 2024-03-31
Milestones:
  - 2024-01-15: Evaluate MFA solutions (Duo, Entra ID MFA, Okta)
  - 2024-02-15: Pilot deployment to 3 admin workstations
  - 2024-03-15: Full rollout to all privileged accounts
  - 2024-03-31: Evidence collected and SSP updated
Responsible Party: IT Manager
Resources:         $X licensing cost, 40 hours implementation

Common Control Deficiencies and Remediation Patterns¶

MFA Not Deployed (3.5.3) — High Impact¶

Problem: Password-only authentication for admin accounts. Remediation: Deploy Microsoft Entra ID MFA, Duo Security, or Okta. Enforce Conditional Access policies requiring MFA for all privileged account access. Enforce for all network access to non-privileged accounts as well. Evidence: MFA enrollment reports, Conditional Access policy screenshots, login audit logs.

No Formal SSP (3.12.4) — High Impact¶

Problem: No documented System Security Plan. Remediation: Use the NIST SP 800-171 SSP template. Document every control with implementation details, not just "yes/no." Include system boundary diagram. Evidence: Completed SSP document with revision history.

Vulnerability Scanning Not Occurring (3.11.2) — Medium Impact¶

Problem: No scheduled vulnerability scans. Remediation: Deploy Tenable Nessus, Rapid7, or Qualys. Schedule authenticated scans weekly/monthly. Track findings in POA&M. Evidence: Scan reports with timestamps, remediation tracking records.

Audit Logging Gaps (3.3.1, 3.3.2) — High Impact¶

Problem: Logs not retained; user actions not traceable. Remediation: Configure SIEM (Splunk, Microsoft Sentinel, Elastic). Ensure logs include user ID, timestamp, action, and outcome. Retain logs per policy (typically 1-3 years). Evidence: SIEM configuration, log retention policy, sample log queries.

Encryption at Rest Missing (3.13.16) — High Impact¶

Problem: CUI stored on unencrypted drives or in unencrypted databases. Remediation: Enable BitLocker (Windows), FileVault (macOS), or cloud provider encryption (AWS KMS, Azure Disk Encryption). Encrypt database columns or tablespaces containing CUI. Evidence: Encryption configuration screenshots, key management documentation.

No Incident Response Plan (3.6.1) — High Impact¶

Problem: No documented IR procedures. Remediation: Write an IRP covering: preparation, detection, containment, eradication, recovery, and lessons learned. Assign IR roles. Test annually with tabletop exercise. Evidence: IRP document, tabletop exercise records, incident log.

Least Privilege Not Enforced (3.1.5) — Medium Impact¶

Problem: Users have excessive permissions; no privileged account separation. Remediation: Conduct access review. Remove unnecessary admin rights. Require separate admin accounts for privileged tasks. Implement PAM tools (CyberArk, BeyondTrust) for enterprise environments. Evidence: Access review records, account inventory, PAM configuration.

Relationship to CMMC Level 2¶

CMMC (Cybersecurity Maturity Model Certification) Level 2 requires full compliance with all 110 NIST SP 800-171 controls. There is a direct one-to-one mapping.

CMMC 2.0 structure: - Level 1: 17 practices (basic cyber hygiene, FCI protection) - Level 2: 110 practices = all 110 NIST 800-171 controls (CUI protection) - Level 3: 110 + 24 additional NIST 800-172 practices (advanced/critical CUI)

Assessment requirements for Level 2: - Self-assessment: Allowed for some Level 2 contracts (DFARS 252.204-7019) - C3PAO third-party assessment: Required for contracts that require Level 2 certification - Government-led (DIBCAC): Required for Level 3 and high-priority Level 2

If you are working toward CMMC Level 2: achieving full 110-control compliance with NIST 800-171 IS CMMC Level 2 compliance. No additional controls are needed beyond what 800-171 requires.

Quick-Reference: All 110 Controls by Family¶

Family	ID Range	Count	Key Concerns
Access Control	3.1.1–3.1.22	22	Least privilege, remote access, MFA, wireless
Awareness & Training	3.2.1–3.2.3	3	User training, role-based training, insider threat
Audit & Accountability	3.3.1–3.3.9	9	Log creation, retention, protection, correlation
Config Management	3.4.1–3.4.9	9	Baselines, change control, least functionality
Identification & Auth	3.5.1–3.5.11	11	MFA, password policy, credential storage
Incident Response	3.6.1–3.6.3	3	IRP, tracking, testing
Maintenance	3.7.1–3.7.6	6	Controlled maintenance, remote maintenance MFA
Media Protection	3.8.1–3.8.9	9	Physical protection, sanitization, transport encryption
Personnel Security	3.9.1–3.9.2	2	Screening, termination procedures
Physical Protection	3.10.1–3.10.6	6	Physical access, monitoring, alternate work sites
Risk Assessment	3.11.1–3.11.3	3	Risk assessments, vuln scanning, remediation
Security Assessment	3.12.1–3.12.4	4	Control assessments, POA&M, SSP, monitoring
System & Comms Protection	3.13.1–3.13.16	16	Boundary protection, encryption in transit/at rest, FIPS
System & Info Integrity	3.14.1–3.14.7	7	Patch management, AV/EDR, monitoring, flaw remediation

Assessment Conversation Starters¶

When a user asks about 800-171 compliance, start by asking:

"Do you have a System Security Plan (SSP) that documents all 110 controls?"
No SSP = start there; it is both 3.12.4 and the foundation for scoring
"Have you defined your CUI boundary — what systems touch CUI?"
Undefined boundary = you can't scope the assessment correctly
"What is your current SPRS score, and when was it last submitted?"
This reveals overall posture and whether they are contractually compliant
"Which families have the most NOT MET controls?"
Common answers: IA (MFA), SC (encryption), AU (logging), CA (no SSP/POA&M)
"Do you have a POA&M tracking open gaps with dates?"
No POA&M = cannot demonstrate active remediation effort to auditors

Evidence Checklist for Common Controls¶

For MFA (3.5.3): - [ ] MFA enrollment report (100% of privileged accounts) - [ ] MFA enrollment report (100% of non-privileged accounts for network access) - [ ] Conditional Access or equivalent policy screenshot - [ ] Exception process if any accounts are excluded

For Encryption in Transit (3.13.8): - [ ] Network diagram showing where TLS is enforced - [ ] TLS configuration (minimum TLS 1.2, cipher suites) - [ ] VPN configuration for remote access - [ ] Certificate inventory

For Audit Logging (3.3.1): - [ ] Log retention policy (minimum period defined) - [ ] SIEM/log aggregation configuration - [ ] Evidence logs include: user ID, timestamp, event, outcome - [ ] Alert configuration for anomalous events

For Vulnerability Management (3.11.2, 3.14.1): - [ ] Vulnerability scan schedule and tool configuration - [ ] Most recent scan report - [ ] Remediation SLAs (critical within X days) - [ ] Patch management policy and records

Plugin: compliance-frameworks · View SKILL.md on GitHub