NIST SP 800-171
NIST Special Publication 800-171 lists the security requirements for protecting CUI on nonfederal information systems. DFARS 252.204-7012 makes it contractual for defense work — held at Revision 2 by class deviation — and its 110 requirements are the CMMC Level 2 baseline.
NIST wrote 800-171 as the requirements catalog for contractor systems that process, store, or transmit CUI. Revision 2 contains 110 requirements across families like access control, incident response, and system integrity. Revision 3, published May 2024, reorganizes the set into 17 families and adds organization-defined parameters — values the government fills in — and superseded Revision 2 at NIST the same day.
Contracts are where the version question bites. DFARS 252.204-7012 points to the edition in effect when the solicitation issues, but class deviation 2024-O0013 holds DoD contracts to Revision 2, and it stays operative until rescinded. Clauses 252.204-7019 and -7020 require a DoD Assessment Methodology score posted in SPRS, and CMMC Level 2 assesses the same 110 requirements.
A system security plan and a POA&M are not compliance, though contractors keep treating them that way. The posted score has to reflect what is implemented on the day it is affirmed; a Medium or High government assessment re-derives it from evidence, not paperwork.
Regulatory Reference
NIST SP 800-171 Rev. 2; DFARS 252.204-7012; DFARS 252.204-7019; DFARS 252.204-7020; DoD Class Deviation 2024-O0013
RFO Status
The June 2026 proposed FAR CUI framework (FAR Case 2026-001) would carry 800-171 governmentwide, its standard form specifying organization-defined parameters for Revision 3, while DoD's class deviation keeps DFARS work on Revision 2.
Category
Regulations & Policy
How AcqBot Helps
AcqBot flags when a requirement triggers 800-171, applies the revision the operative deviation actually imposes, and verifies an offeror's SPRS assessment date and score during evaluation rather than after award.
Related glossary entries
Class Deviation
A class deviation authorizes an agency to depart from specific FAR or supplement provisions for a category of contract actions rather than a single case — the mechanism agencies are using to implement the Revolutionary FAR Overhaul ahead of formal rulemaking.
Commercial Products and Services (FAR Part 12)
Commercial products and commercial services are items of a type sold, leased, licensed, or offered in the commercial marketplace, defined at FAR 2.101. FAR Part 12 implements the statutory preference for buying them whenever market research shows they can meet the agency's need.
Rule of Two
The rule of two directs a contracting officer to set aside an acquisition for small business when there is a reasonable expectation of receiving offers from at least two responsible small business concerns and making award at fair market prices, per FAR 19.502-2.
Controlled Unclassified Information (CUI)
Controlled Unclassified Information (CUI) is information the government creates or possesses, or that an entity handles on its behalf, that a law, regulation, or governmentwide policy requires safeguarding or dissemination controls for — sensitive but not classified, governed by 32 CFR Part 2002.