Any organization that handles Controlled Unclassified Information (CUI) for the federal government, including DoD prime contractors, subcontractors, and other federal contractors, is required to protect that information according to NIST SP 800-171. Custom Cybersecurity Solutions helps organizations understand where they stand today, close the gaps, and build the documentation a real assessment or audit will expect.

What Is NIST SP 800-171?

NIST SP 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” is the security standard published by the National Institute of Standards and Technology that DoD contractors and other federal contractors must follow to protect CUI. It sets out 110 security requirements across 14 families, from access control and incident response to system and communications protection. It is also the technical foundation underneath CMMC Level 2: the CMMC assessment objectives are drawn directly from NIST SP 800-171.

Who Needs to Comply

If your organization handles CUI under a DoD contract or subcontract, DFARS 252.204-7012 requires NIST SP 800-171 compliance today, independent of where CMMC certification stands. The same obligation increasingly extends to subcontractors further down the supply chain, and to contractors working with other federal agencies that handle CUI outside the DoD.

Our NIST SP 800-171 Services

Gap Analysis

We assess your current environment against all 110 NIST SP 800-171 requirements and document exactly where you stand.

System Security Plan (SSP) and POA&M Development

We build the System Security Plan and Plan of Action and Milestones that document your controls and remediation timeline, the same documentation a DoD contracting officer or C3PAO assessor will expect to see.

Control Implementation Support

From access control and multi-factor authentication to system monitoring and CUI-aware configuration management, we help you put the required controls in place, not just document them on paper.

NIST SP 800-171 and CMMC Level 2

CMMC Level 2 was built on top of NIST SP 800-171: its 320 assessment objectives map back to the same 110 requirements. Work you do to reach NIST SP 800-171 compliance directly prepares you for a CMMC Level 2 self-assessment or third-party assessment. See our CMMC Level 2 Compliance Consulting page for how the two programs fit together.

Why Custom Cybersecurity Solutions

Our team includes a Lead Certified CMMC Assessor (CCA) and professionals holding CISSP, CISM, and CISA credentials, so the same experts who understand how an assessment is actually scored are the ones building your documentation and controls. Contact us for a free consultation on where your organization stands against NIST SP 800-171.