NIST 800-171 Compliance for DIB Contractors

In October 2023, the DoD suspended a $47 million IT services contract after discovering the prime contractor had self-assessed a SPRS score of 97 but could not demonstrate implementation of 34 of the 110 NIST 800-171 requirements during a DCMA audit. The contractor had checked boxes on a self-assessment spreadsheet without implementing the actual controls — functioning MFA was missing, audit logs were not being reviewed, and the CUI boundary was undefined. Their SPRS score should have been -112, not 97.

That gap between self-assessed and actual compliance is not unusual. DoD assessments (DIBCAC audits in particular) have repeatedly found that most DIB contractors have material gaps between their submitted SPRS scores and their operational reality. CMMC closes that gap by requiring third-party assessment — but the underlying standard being assessed remains NIST 800-171.

Why Now: CMMC Makes 800-171 Enforceable

For years, NIST 800-171 compliance was contractually required under DFARS 252.204-7012 but effectively self-attested. Contractors submitted SPRS scores, and the DoD largely took them at face value. That era ended in 2024.

CMMC Level 2 maps directly to the 110 NIST 800-171 Rev 2 requirements — every single one. The difference is that C3PAOs (Certified Third-Party Assessment Organizations) now verify implementation rather than accepting self-attestation. Your SPRS score must be accurate before a C3PAO walks through the door, because they will test every control you claim is implemented.

The enforcement timeline:

DFARS 252.204-7021 is in DoD contracts now
Phase 1 (2025): Self-assessment at CMMC Level 1 appears in solicitations
Phase 2 (2025-2026): C3PAO assessments for Level 2 begin appearing as contract requirements
Phase 3 (2026-2027): Full rollout across new and option-year contracts

If you handle CUI under a DoD contract, the question is not whether you need 800-171 compliance — you have needed it since 2017. The question is whether your implementation survives a third-party assessment.

What Is CUI and Where Does It Live?

Controlled Unclassified Information is government-created or government-owned information requiring safeguarding but not classification. For defense contractors, CUI categories include:

Controlled Technical Information (CTI): Engineering data, research results, specs
Export-Controlled: ITAR and EAR technical data
Critical Infrastructure: Vulnerability assessments, security plans
Procurement/Acquisition: Source selection, contract pricing
Privacy: PII of government personnel
Legal: Privileged or investigative records

The CUI Registry (maintained by NARA) defines all categories and their marking/handling requirements. Your first job is identifying exactly where CUI exists in your environment — not where you think it exists, but where it actually flows.

The 14 Control Families

The 110 requirements are organized into 14 families derived from NIST 800-53:

Family	ID	Count	Focus
Access Control	AC	22	User access, remote access, CUI flow
Awareness and Training	AT	3	Security literacy, role-based training
Audit and Accountability	AU	9	Logging, log protection, log review
Configuration Management	CM	9	Baselines, change control, least functionality
Identification and Authentication	IA	11	MFA, password management, device auth
Incident Response	IR	3	IR plan, handling, reporting
Maintenance	MA	6	Controlled maintenance, remote maintenance
Media Protection	MP	9	Media handling, transport, sanitization
Personnel Security	PS	2	Screening, termination procedures
Physical Protection	PE	6	Facility access, visitor control
Risk Assessment	RA	3	Risk assessment, vulnerability scanning
Security Assessment	CA	4	Assessments, POA&M, monitoring
System and Communications Protection	SC	16	Encryption, boundary protection, CUI isolation
System and Information Integrity	SI	7	Flaw remediation, malware protection, monitoring

Implementation: The Practical Path

Step 1: Define Your CUI Boundary

The boundary determines your compliance scope. Every system that stores, processes, or transmits CUI must implement all 110 requirements. Systems outside the boundary do not.

Identify:

Systems that store CUI (file servers, databases, email, backups)
Systems that process CUI (workstations, applications, build servers)
Systems that transmit CUI (email servers, VPNs, file transfer services)
Security protection assets that guard the boundary (firewalls, SIEM, scanners)
People who access CUI and the devices they use

The contrarian advice: scope tightly, not broadly. Every system inside the boundary must meet all 110 requirements. A CUI enclave — a dedicated network segment that isolates CUI processing — dramatically reduces your compliance surface. The company with 500 endpoints in scope will spend 10x more than the company that isolates CUI to a 50-endpoint enclave, and the enclave is typically more secure because the controls are concentrated.

Step 2: Conduct a Gap Assessment

For each of the 110 requirements, determine your current implementation status:

Implemented: Fully met with demonstrable evidence
Partially Implemented: Some aspects in place, gaps remain
Not Implemented: Not addressed at all
Not Applicable: Does not apply (rare — justify carefully, assessors will challenge N/A claims)

Be honest. The SPRS score calculation penalizes unimplemented controls at 1, 3, or 5 points depending on the DoD-assigned weight. An honest -50 is survivable with a solid POA&M. A dishonest 97 that collapses under assessment is a contract-ending event.

Step 3: Build Your System Security Plan

The System Security Plan (SSP) documents how your organization implements each requirement. For each of the 110 practices, describe:

How the requirement is implemented (technical and procedural mechanisms)
Who is responsible (roles, not individuals)
What systems are in scope
What evidence demonstrates compliance

The SSP is the document the C3PAO works from. If a control is implemented but not documented in the SSP, it functionally does not exist for assessment purposes.

Step 4: Create Your POA&M

For any requirement not fully implemented, create a Plan of Action and Milestones entry documenting the gap, the planned remediation, resources required, and target completion date. A POA&M is not a parking lot for things you do not intend to fix — assessors evaluate whether your POA&M entries are credible, resourced, and on track.

Step 5: Compute and Submit Your SPRS Score

Calculate your SPRS score from the assessment results (110 = perfect, -203 = nothing implemented) and submit it to the Supplier Performance Risk System. This score must be on file before you can be awarded contracts requiring 800-171 compliance.

The Requirements That Break People

Multi-Factor Authentication (3.5.3 / IA.L2-3.5.3)

MFA must cover all local and network access to CUI systems — not just remote access, not just privileged accounts, not just VPN. Every user accessing any system in the CUI boundary must authenticate with two or more factors. Implementing MFA across legacy applications, OT systems, and shared workstations is where most organizations stall.

FIPS-Validated Cryptography (3.13.11 / SC.L2-3.13.11)

Using AES-256 is not enough. The specific implementation must appear on the NIST Cryptographic Module Validation Program (CMVP) validated modules list. Many commercial products use strong algorithms but are not FIPS-validated — the certificate number matters, not just the algorithm name.

Audit Log Review (3.3.1 / AU.L2-3.3.1)

Organizations must review and analyze audit logs for indications of inappropriate or unusual activity. Generating logs is not compliance. Storing logs is not compliance. Actively reviewing them is. For most organizations, this means a SIEM solution or managed detection service with defined review cadences and documented escalation procedures.

CUI Flow Enforcement (3.1.3 / AC.L2-3.1.3)

Control the flow of CUI in accordance with approved authorizations. This means you must know — and technically enforce — where CUI can go. DLP, network segmentation, approved sharing channels, and email gateway policies all play a role. "We told people not to" is not a technical enforcement mechanism.

Common Pitfalls

Scoping Too Broadly

Including systems that do not touch CUI inflates your compliance burden exponentially. Invest time in defining a tight CUI boundary. A well-designed enclave with 50 endpoints in scope is more achievable and more secure than a flat network with 500 endpoints all nominally "in scope."

Policies Without Technical Enforcement

Assessors look for evidence that controls are operational, not just documented. A password policy document is necessary but insufficient — the assessor wants to see the policy enforced technically (minimum length in Active Directory, complexity enabled, history enforced, lockout configured). Every policy needs a corresponding technical mechanism.

Ignoring the Supply Chain

If your subcontractors handle CUI, they must also comply with 800-171. You are responsible for flowing down DFARS 252.204-7012 requirements. A subcontractor breach is your breach in the eyes of the contracting officer.

Treating Compliance as a One-Time Exercise

800-171 compliance is continuous. Systems change, people leave, applications are deployed, configurations drift. Without continuous monitoring and periodic reassessment, your compliance posture degrades from Day 1 after assessment.

Rev 3: What Is Coming

NIST published 800-171 Rev 3 in May 2024, reorganizing requirements to align more closely with 800-53 Rev 5. Rev 3 consolidates the catalog to 97 requirements across 17 families, adds new families (including supply chain risk management and planning), and introduces organization-defined parameters that make many requirements broader and more configurable.

The DoD has not yet mandated Rev 3 for CMMC. Current CMMC assessments use Rev 2. But organizations should understand the delta — fewer requirements does not mean less work, since the consolidated requirements are broader — and the transition will come.

Key Takeaways

NIST 800-171 Rev 2 contains 110 requirements — every one maps to a CMMC Level 2 practice

CMMC replaces self-attestation with third-party assessment; your SPRS score must be real

Scope tightly with a CUI enclave to reduce the number of systems that must implement all 110 controls

MFA everywhere, FIPS-validated crypto, and active log review are the three controls that break most organizations

An honest SPRS score with a credible POA&M beats a fabricated perfect score every time

Rev 3 is published but not yet mandated for CMMC; prepare for the delta

Frequently Asked Questions

What is the difference between NIST 800-171 and CMMC Level 2?

They cover the same 110 security requirements. The difference is verification: 800-171 compliance was historically self-attested via SPRS score submission, while CMMC Level 2 requires a third-party assessment by a C3PAO. Think of 800-171 as the standard and CMMC as the assessment methodology that proves you meet it.

Can we get a CMMC Level 2 certification with open POA&M items?

The current CMMC rule allows conditional certification with a limited number of POA&M items, provided they are not among the highest-weighted requirements. POA&M items must have credible remediation plans with completion timelines not exceeding 180 days. An assessor who sees 30 open POA&M entries will not issue a conditional — that signals fundamental unreadiness.

How often should we reassess our SPRS score?

You must reassess and resubmit whenever there is a material change to your CUI environment or when a POA&M item is completed. At minimum, conduct an annual reassessment. Many organizations reassess quarterly to catch configuration drift before it compounds.

Does 800-171 apply to subcontractors?

Yes. DFARS 252.204-7012 requires flow-down to all subcontractors who handle CUI. Each subcontractor must independently comply with 800-171 and submit their own SPRS score. You are responsible for verifying their compliance as part of your supply chain risk management.

What is the relationship between 800-171 and 800-53?

NIST 800-171 is derived from NIST 800-53 Moderate baseline. The 110 requirements in 800-171 are a subset of the approximately 325 controls in the 800-53 Moderate baseline, tailored for nonfederal systems handling CUI. If you implement 800-53 Moderate, you exceed 800-171 requirements.

How Advisedly Helps

Advisedly maps all 110 NIST 800-171 Rev 2 requirements with implementation guidance, evidence tracking, and automated SPRS score computation that updates in real time as you close gaps. The platform shows compliance status across every requirement, highlights the highest-weighted gaps affecting your SPRS score, and tracks per-system compliance for organizations with multiple information systems in the CUI boundary. Multi-framework mapping means 800-171 work simultaneously addresses CMMC, FedRAMP, and 500+ other frameworks — implement once, satisfy many. Contact begin@advisedly.ai