NIST SP 800-171

1. 2026-09-17 Medium
   NIST publishes Special Publication 800-171A Revision 3 with small business assessment guidance

   NIST has published Revision 3 of Special Publication 800-171A, which provides guidance for assessing security requirements for Controlled Unclassified Information (CUI) and includes a dedicated small …

   New version Action required

1. 2026-07-13 DoD CIO memo suspends the November 2026 CMMC Phase 2 transition. It requires baseline compliance with SP 800-171 Rev. 2 under DFARS 252.204-7012, and permits Level 1 (Self) or Level 2 (Self) assessments in procurement requests. The codified phase-in schedule in 32 CFR 170.3(e) has not been amended.
2. 2025-11-10 DFARS CMMC rule takes effect (CMMC Phase 1). Level 1 checks the 15 requirements of FAR 52.204-21; Level 2 checks the 110 requirements of SP 800-171 Rev. 2.
3. 2025-01-15 Proposed FAR rule on CUI published for Governmentwide (FAR) contracts; comments closed 17 March 2025. No final rule as of this check.
4. 2024-12-16 CMMC program rule (32 CFR 170) takes effect. It incorporates SP 800-171 Rev. 2 and SP 800-171A (June 2018) by reference.

1. 2024-05-14
   SP 800-171 Rev. 3 Major versionCurrent

   Aligned with the SP 800-53B moderate baseline and SP 800-53 wording. source

   More

   • It has 97 requirements in 17 families; Rev. 2 had 110 requirements in 14 families.
   • The split into basic and derived requirements is gone.
   • Organization-defined parameters (ODPs: values an agency or organization sets, such as frequencies) were introduced.
   • Requirements now have titles, and outdated ones were removed while new ones were added.
2. 2023-11-09
   SP 800-171 Rev. 3 (final public draft) Draft

   Final public draft of Rev. 3. source

3. 2023-05-10
   SP 800-171 Rev. 3 (initial public draft) Draft

   First public draft of Rev. 3. source

4. 2021-01-28
   SP 800-171 Rev. 2 (errata update) Errata

   Editorial errata. source

   More

   • The scoping paragraph, which lets organizations isolate CUI in a separate security domain, moved earlier in Section 1.1.
   • Scope and requirements did not change.
   • This is the edition that CMMC and the current DoD baseline use.
5. 2020-02-21
   SP 800-171 Rev. 2 Revision source

   Not confirmed by an official source yet.

SP 800-171 applies to components of nonfederal systems that process, store or transmit CUI, or that protect those components.

Only by agreement

It applies only when a federal agency imposes it through a contract or other agreement. source

Federal agencies

Under 32 CFR 2002.14, agencies must use SP 800-171 to protect CUI on non-federal systems, unless the law behind a CUI category prescribes something else. source

Defense contracts

In defense contracting, DFARS 252.204-7012 applies it to every covered contractor information system. source

Which revision

The version is the one "in effect at the time the solicitation is issued or as authorized by the Contracting Officer". source

DoD baseline

Since July 2026 DoD has required Rev. 2 as the baseline. source

NIST sets no assessment cadence or certification.

Procedures

SP 800-171A gives the assessment procedures. source

CMMC Level 2

For DoD contracts, CMMC Level 2 status can be self-assessed or certified by a CMMC Third-Party Assessment Organization (C3PAO). source source

Since July 2026

Since the July 2026 suspension of Phase 2, DoD permits Level 1 (Self) and Level 2 (Self) assessments in procurement requests and has told contracting officers to remove or revise CMMC requirements accordingly. source

Validity

A Final Level 2 status is valid for 3 years and needs an annual affirmation of continuous compliance (DFARS 252.204-7021). source

Contract clause

Under class deviation 2026-O0025, contracts carry clause 252.240-7997 "NIST SP 800-171 DoD Assessment Requirements (FEB 2026) (DEVIATION)" instead of the codified 252.204-7019/7020. source

Government assessments

That clause covers only government Medium and High Assessments, whose scores DoD posts in the Supplier Performance Risk System (SPRS). source

Before the deviation

The codified 252.204-7019 required a contractor self-assessment ("Basic Assessment") no more than 3 years old, with a score out of 110 in SPRS, as a condition of award. source

SP 800-171 has no penalties of its own; NIST is not a regulator.

Contract award

It is enforced through contracts. When CMMC status is required, contracting officers must check SPRS and may not award a contract or exercise an option without the required status. source

DCMA assessments

DCMA (Defense Contract Management Agency) can run Medium or High assessments whose results take precedence over other assessments. source

Incident reporting

DFARS 252.204-7012 also requires cyber incidents to be reported to DoD within 72 hours and images to be kept for 90 days. source

1. Standard NIST SP 800-171 Rev. 3 (PDF)
2. Standard NIST SP 800-171A Rev. 3 – Assessing Security Requirements for CUI (assessment companion, May 2024)
3. Standard NIST SP 800-171 Rev. 2, updated 28 January 2021 (withdrawn by NIST; DoD baseline and CMMC Level 2)
4. Standard NIST SP 800-171A, June 2018 (withdrawn by NIST; used by CMMC)
5. Guidance Rev. 2 to Rev. 3 change analysis (XLSX)

1. CMMC

   CMMC is DoD's program for checking and certifying that contractors meet the requirements. Its Level 2 is identical to SP 800-171 Rev. 2, not Rev. 3.

2. DFARS 252.204-7012

   DFARS 252.204-7012 is the contract clause that makes SP 800-171 binding on DoD suppliers and adds 72-hour cyber incident reporting.

3. NIST SP 800-172

   SP 800-172 is a supplement to SP 800-171 with enhanced requirements for protecting CUI. Rev. 3 was published in May 2026, but CMMC Level 3 uses the February 2021 edition.

4. NIST SP 800-53

   SP 800-53 is the full control catalog for federal systems. SP 800-171 is a subset tailored from its moderate baseline to protect the confidentiality of CUI in nonfederal systems.

Verified against official sources on 17 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to NIST SP 800-171 (RSS)