The 110 Controls: Which NIST 800-171 Requirements Trip Up DIB Contractors Most

NIST SP 800-171 has 110 requirements, but assessments do not fail evenly across them. The same handful show up again and again in gap analyses, C3PAO findings, and DIBCAC reviews. If you are a small or mid-sized Defense Industrial Base (DIB) contractor, your budget and IT team are likely limited. Knowing which controls actually trip people up is more useful than treating all 110 as equally hard.

Wait — Is It Still 110 NIST 800-171 Requirements?

Yes, for now. NIST published Revision 3 of SP 800-171 in May 2024. It reorganizes the standard into 97 requirements across 17 control families, up from the original 14. It also restructures several controls to align with NIST SP 800-53 Revision 5. That is a real change. However, it is not yet the standard CMMC assessments run against.

CMMC Level 2 assessments and DIBCAC reviews are still measured against the 110 requirements in Revision 2. So is the score you post to the Supplier Performance Risk System (SPRS). Moving CMMC to Revision 3 requires a rulemaking change. CMMC Phase 2 has been suspended since July 2026, pending the Department of War’s program review. As a result, that transition has not moved forward. Until a new rule says otherwise, Revision 2’s 110-control scope determines your SPRS score. It is also what a C3PAO or DIBCAC assessor will check against.

The NIST 800-171 Requirements That Show Up in Findings Again and Again

Across gap analyses and third-party assessments, failures cluster around a predictable set of NIST 800-171 requirements. Here is what consistently causes trouble for smaller contractors.

3.5.3 — Multifactor Authentication

Organizations often implement MFA on the obvious front door, like a VPN or Microsoft 365 login. However, they often miss privileged local accounts, legacy on-premises systems, and network devices. Some of these cannot easily support a second factor. The requirement covers all access to CUI and to privileged functions, not just remote access. Legacy hardware is usually where contractors fall short.

3.11.1 and 3.11.2 — Risk Assessment and Vulnerability Scanning

A one-time risk assessment performed to check a box does not satisfy this requirement. Assessors look for a defined schedule, a documented process, and evidence that scans actually happen on schedule. Small IT teams without a dedicated vulnerability management tool frequently cannot produce that evidence.

3.3.1 through 3.3.5 — Audit Logging, Review, and Alerting

Turning on logging is the easy part. The requirement also expects a defined process for reviewing logs and alerting on logging failures. You must also correlate events to identify suspicious activity. Without a SIEM or an outsourced SOC, most small contractors log everything and review almost nothing. That is exactly what an assessor is trained to probe.

3.6.1 through 3.6.3 — Incident Response Planning and Testing

Having a written incident response plan is common. Having tested it — through even a basic tabletop exercise — is not. Assessors increasingly ask for evidence of an actual test, not just a document that has never been exercised.

3.4.1 — Baseline Configuration and System Inventory

This requirement asks for a current, accurate inventory of hardware, software, and firmware. It also requires a documented baseline configuration. Inventories that are months out of date are a common finding. So are inventories that exclude cloud services and SaaS tools handling CUI.

3.13.11 — FIPS-Validated Cryptography

Contractors often confirm that an encryption algorithm (like AES-256) is FIPS-approved. But the requirement goes further. It calls for a FIPS-validated cryptographic module actually configured to operate in FIPS mode. A correct algorithm in a non-validated, non-FIPS-mode configuration does not satisfy this control.

3.8.9 through 3.8.11 — Media Protection

Removable media controls are easy to overlook once an organization moves most work to the cloud. The same goes for encrypting CUI on portable devices and documenting sanitization procedures. Still, the requirement applies to whatever media exists. That includes backup drives and old laptops awaiting disposal.

3.12.4 — The System Security Plan Itself

This is less a technical control than a documentation control. It is also one of the most common findings of all. Experienced assessors quickly spot generic, templated SSPs. These SSPs often fail to describe the organization’s actual environment, boundaries, and CUI flow. A weak SSP can cast doubt on every other control in the assessment.

Why These NIST 800-171 Requirements Keep Coming Up

Notice what these requirements have in common. None of them are solved by buying a single product and walking away. They require ongoing operational discipline. That means reviewing logs on a schedule, testing a plan, and keeping an inventory current. It also means generating evidence over time, not at a single point in time. Controls that can be satisfied with a one-time configuration change tend to get done. Controls that require sustained process and documentation tend to decay. That decay is exactly what shows up as a finding a year or two later.

Why This Matters More Than Ever Right Now

With CMMC Phase 2 suspended, third-party certification is not currently a condition of award for most new solicitations. That has led some contractors to conclude the pressure is off. It is not. DFARS 252.204-7012 has required full NIST SP 800-171 implementation since 2017. DFARS 252.204-7019 and 7020 still require an accurate score in SPRS. They also require an annual senior official affirmation. Self-attestation without a third party checking your work does not reduce your exposure — it shifts it.

In September 2026, Honeywell Aerospace agreed to pay more than $2 million to resolve False Claims Act allegations. The Department of Justice tied those allegations to cybersecurity compliance representations on a DoD contract. The case shows the government continues to pursue inaccurate compliance claims, regardless of where CMMC rulemaking stands. An SPRS score may assume these frequently missed controls are handled when they are not. That is exactly the kind of gap that turns into liability later.

A Practical Way to Prioritize NIST 800-171 Requirements

If your budget and staff time are limited, start with the NIST 800-171 requirements above. Then work sequentially through the remaining controls. A focused gap analysis against these specific requirements will usually surface your biggest true risk areas fastest. That beats a generic run through all 110. For anything you cannot close immediately, use a realistic Plan of Action and Milestones (POA&M) with an honest timeline. That is far more defensible than an SSP claiming a control is fully in place when it is not.

See Where You Stand on NIST 800-171 Requirements

Custom Cybersecurity Solutions helps DIB contractors run focused NIST SP 800-171 gap analyses. We also build System Security Plans that hold up to scrutiny. And we help you prepare for CMMC Level 2 assessment on a timeline that fits your business and budget. Schedule a consultation or browse our SSP and policy templates to get started.