What is NIST 800-171?

The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 rev2 is a set of cybersecurity guidelines that define how Controlled Unclassified Information (CUI) should be protected in non-federal systems. The Department of Defense (DoD), General Services Administration (GSA), and NASA require, or are planning to require, contractors and subcontractors to implement these controls to safeguard sensitive information shared with the federal government.

NIST 800-171 serves as the foundation for the Cybersecurity Maturity Model Certification (CMMC), which builds upon its requirements to ensure compliance within the Defense Industrial Base (DIB). If you’re a government contractor handling CUI, you must meet these standards to win and maintain DoD contracts.

Why is NIST 800-171 Important?

THE BASICS OF DFARS

DFARS are a set of regulations designed to ensure defense contractors maintain adequate cybersecurity measures. We cover the ins and outs of DFARS requirements here.

DFARS 252.204-7012: safeguard to cover defense information which contractors and subcontractors must implement in NIST SP 800-171.
DFARS 252.204-7019: requires companies maintain a record of NIST 800-171 compliance within the Supplier Performance Risk System (SPRS).
DFARS 252.204-7020: requires companies provide Government access to facilities, systems, and personnel any time the Department of Defense (DoD) is renewing or conducting a Medium or High assessment.

NIST 800-171 and CMMC: What’s the Connection?

CMMC Level 2 includes all 110 security requirements from NIST 800-171 Rev 2. If your business already follows NIST 800-171, you’re well on your way to achieving CMMC Level 2 certification.
However, CMMC adds an independent assessment requirement for most contractors handling CUI. Unlike NIST 800-171, which relies on self-attestation, CMMC Level 2 requires a third-party assessment (C3PAO) to verify compliance.

What About NIST 800-171 Rev 3?

The new revision (Rev 3) introduces additional protections against advanced persistent threats (APTs), but DoD contractors must still comply with Rev 2 until the DoD updates CMMC requirements.

Getting Started with NIST 800-171 Compliance

First, check out our article, “What is SPRS” for a quick guide on SPRS, how to create an account, and how to submit your data. SPRS is a risk management tool that helps organizations meet Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7019 and 252.204-7012 compliance. Once you have established the appropriate account access in the SPRS, it’s time to take the assessment. Often – when a company commences completion of the self-assessment, they aren’t sure what to do and may not understand what is being asked with the controls.

The simple answer is – a company should determine if each control is implemented, partially implemented, or not implemented. The assessment score starts at a perfect 110, and points are deducted for each area of deficiency for a possible score of negative 203. The controls are weighted at 1 point, 3 points, or 5 points, depending on their criticality.

Steps to Achieve NIST 800-171 Compliance

Conduct a Gap Assessment – Identify security gaps using NIST SP 800-171A (the official assessment guide).
Develop a System Security Plan (SSP) – Document your security policies and procedures.
Implement Security Controls – Address all 110 controls across people, processes, and technology.
Create a Plan of Action & Milestones (POA&M) – If gaps exist, document how you'll fix them.
Submit a Self-Assessment to SPRS – If seeking CMMC Level 2, prepare for an external assessment.

Confused by what the controls are asking?

To complete the assessment, it is imperative that your organization understands what the controls mean in order to determine if they are implemented in your environment. This can be tricky if you aren’t a cyber pro. The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) curated a list of the top NIST 800-171 requirements that have been determined as other than satisfied (OTS) during DIBCAC assessments.

Below, find a deep dive into four of those most commonly non-compliant controls to help you get on track; Multi-factor authentication, Risk Assessment, Incident Response, and FIPS Validated Encryption.

1. Identification and Authentication (IA) 3.5.3 – Multi-Factor Authentication
To protect CUI, it’s important to limit access to authorized users, to do this effectively you need to verify the identity of those users. That is where multi-factor authentication comes into play. Multi-factor Authentication is the means used to confirm the identity of a user, process, or device, a system which requires more than one distinct authentication factor for successful authentication. Multi-factor authentication includes three factors; something you know, such as passwords and personal identification numbers; something you have, such as a cryptographic identification device token; or something you are, such as biometrics. Authentication uses two or more different factors to achieve authentication.

2. Risk Assessment (RA) 3.11.1 – Periodically Assess Risk
The DoD expects organizations handling CUI to annually assess organizational risk as a means of keeping information safe. So, what are the best practices your organization should consider implementing to comply with this control? First, the control references “periodic” assessments. These should be conducted at a minimum of an annual basis to support the development of a risk management plan. Consider the following as part of your risk assessment process:

Assess and mitigate cybersecurity risks to ensure protection of networks and data against potential threats.
Evaluatethe nature of the data being processed and stored and the potential threats against that data.
Develop, tailor, and implement mitigation strategies to the identified risks and include measures such as security controls and contingency plans.
Monitor the environment for changes that could impact data security.

3. Incident Response (IR) 3.6.3 – Test Your Incident Response Capabilities
The Incident Response requirements within the NIST 800-171A and Cybersecurity Maturity Model Certification (CMMC) v2.0 framework requires an organization seeking certification to establish and test an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

With ever-evolving threats, incident response testing capabilities have become necessary components of information security programs. IR testing can include tabletop exercise, functional exercises, and tests which simulate attacks to examine your incident response procedures:

Tabletop Exercises are facilitated, discussion-based exercises where personnel meet to discuss roles, responsibilities, coordination, and decision-making of a given scenario.
Functional Exercises allow personnel to validate their readiness for emergencies by performing their duties in a simulated environment.
Testsare evaluation tools that use quantifiable metrics to validate the operability of an IT system or system component in an operational environment. A test is conducted in as close to an operational environment as possible.

4. System Communications & Protection (SC) 3.13.11 – FIPS Validated Encryption

This is number one on DIBCAC’s list of most commonly non-compliant controls, and for good reason. A FIPS-validated cryptographic module is one that has been tested and approved by a NIST-approved laboratory per the Federal Information Processing Standard (FIPS) 140-2 U.S. Government standard. The NIST 800-171 control 3.13. 11 requires FIPS-validated cryptography to be used when protecting the Controlled Unclassified Information – whether you are storing it in your system(s) or transmitting it across the internet. Cryptography is the use of mathematical algorithms to ensure secure data communication. Encryption is the process of applying a cryptographic algorithm on data to transform into a new form that only an authorized party is able to understand. It’s like wrapping that sensitive information up in a bubble so that only desired and authorized recipients of the data can access it.

So, how do you comply with this standard? You will need to implement FIPS Validated Encryption in your systems that handle CUI. You will need to document this in policy, process and procedural documents – AND in your System Security Plan. BitLocker is an example of a FIPS-validated system, but it requires a setting before encryption that ensures that the encryption meets the standards set forth by FIPS 140-2.

Still struggling, let Alluvionic help.

We’ve helped dozens of companies complete the NIST Basic Assessment. Our experts guide you through each control, assess your score, document compliance, and provide clear next steps.

If you’re looking to learn more, check out our articles on the basics of CMMC or What is SPRS.

Contact

Read From Our Blog

Process Improvement

Are You Throwing Away Time and Money? 6 Hidden Inefficiencies Draining Your Business (and How to Fix Them)

Businesses love to talk about efficiency, but let’s be real—most are bleeding time and money in ways they don’t even notice. With the new administration

February 11, 2025

People in business attire talk while sitting around a glass table in desk chairs.

Project Managagement

Project Success: Growth Mindset Strategies for 2025

The start of a new year often inspires reflection and goal-setting. While individuals set resolutions to improve themselves, project teams and leaders can also embrace

January 2, 2025

Cartoon illustration of a toilet transformed into a grill and cooler combo, with a grill grate on the bowl and ice in the tank demonstrating the value of effective requirements gathering.

Project Managagement

How Thoughtful Requirements Gathering Prevents Project Misfires

Imagine you’ve been tasked as the project lead on an effort to conduct requirements gathering and ultimately create a new “Grill/Cooler Combo” product. You’ve done

December 4, 2024

We Treat Client Successes as Our Own

"The diversity of skills and expertise of the Alluvionic team proved invaluable in helping ITI tackle new government flow-downs and certifications. From tailored gap analysis to compliance efforts, Alluvionic’s custom and comprehensive approach has helped place ITI in a solid position to continue growing its business."

"I'm impressed with how thorough your process is. Also the support received after has been wonderful. Helping us to understand a topic that nobody in our organization was familiar with."

“We appreciate and value the expertise and project management experience Alluvionic brings to the table.”

"Team is excellent to work with and demonstrates superior technical knowledge. We have never been disappointed when working with them over the past 5 years."

"The team was fantastic and made our lives easier!"

"Really appreciate the patience and extra effort working with our exact need."

“The knowledge and professionalism provided by every Alluvionic employee is second to none.”

"Ricardo and the team at Alluvionic are top-notch engineers. System Innovation Group has worked closely with the team and found that they always come through even when given what may be considered unrealistic goals. I strongly recommend them for all your mechanical and program management support requirements."

"We at ITI know we can always count on Alluvionic to assist us in preparing for new flowdowns and certifications that are ever-changing in the aerospace defense industry. The Alluvionic team is knowledgeable, responsive, and committed to continual process improvement."

Download Our Project Assurance^® Checklist

It’s simple. A project that gets off on the right foot is likely to take a successful journey. So why do so many projects fail? Use this checklist to assure your project succeeds from the beginning.

Whether you need project management, process improvement, cybersecurity, product development, training, or government services, Alluvionic has the expertise to provide Peace of Mind and Project Assurance^®.