NIST SP 800-171 Compliance Guide for Federal Contractors

NIST Special Publication 800-171 is the cybersecurity standard that governs how federal contractors protect Controlled Unclassified Information (CUI) on their company-owned systems. If you handle CUI — which includes sensitive but not classified information like export-controlled technical data, contractor confidential information, law enforcement data, or privacy information — you are required to implement 110 security controls and demonstrate compliance.

Non-compliance with NIST 800-171 violates DFARS 252.204-7012, creates False Claims Act exposure if you self-certify compliance inaccurately, and is the primary barrier to CMMC Level 2 certification (required for most DoD contracts involving CUI by 2026).

---

What Is CUI?

Controlled Unclassified Information (CUI) is information the federal government creates or possesses that requires safeguarding but is not classified. CUI categories include:

• Technical data: Export-controlled defense technical information (ITAR, EAR)
• Privacy information: Personally Identifiable Information (PII) from federal programs
• Law enforcement sensitive: Investigative or operational information
• Procurement sensitive: Source selection information, cost data
• Critical infrastructure: Information about federal facilities, systems

If your contract includes DFARS 252.204-7012 or FAR 52.204-21, you are likely handling CUI and must implement 800-171 controls.

---

The 110 Controls: 14 Control Families

NIST 800-171 organizes its 110 security requirements into 14 control families:

---

High-Impact Controls: Where Most Organizations Fail

Certain controls are consistently the most difficult to implement and the most frequently failed in assessments:

Access Control (AC.1.001): Limit Information System Access

Principle of least privilege — users only have access to the systems and data they need for their job. In practice, this means:

• Reviewing all user access rights periodically
• Removing access for departed employees immediately
• No shared accounts

Identification and Authentication (IA.3.083): Multi-Factor Authentication

MFA is required for all user access to CUI systems and for all remote access. This single control blocks the majority of credential-based attacks. If you are not using MFA across all systems that hold CUI, this is your first priority.

System and Communications Protection (SC.3.177): Encrypt CUI at Rest and in Transit

All CUI must be encrypted when stored and when transmitted. This requires:

• Encryption at rest (BitLocker or equivalent for endpoints)
• Encrypted email or file transfer for CUI transmission
• TLS 1.2+ for all CUI in transit over networks

Audit and Accountability (AU.2.041): Audit System Access

Log all access to systems containing CUI, protect logs from tampering, review logs regularly. Without audit logging, you cannot detect or investigate security incidents.

Incident Response (IR.2.092 and .093): Incident Response Capability and Reporting

You must have an incident response plan AND report cybersecurity incidents affecting CUI to DoD within 72 hours. Many small contractors have no incident response plan at all — this is a compliance failure and a practical security risk.

---

The System Security Plan (SSP)

NIST 800-171 requires every contractor processing CUI to maintain a System Security Plan (SSP) documenting:

• Which systems in your environment contain CUI
• How you implement (or plan to implement) each of the 110 controls
• Your Plans of Action & Milestones (POA&Ms) for controls not yet implemented

The SSP is your primary compliance document. DCAA and government auditors review SSPs. Under CMMC, a C3PAO assessor will compare your SSP to your actual implementation.

Key SSP elements:

• System boundary definition (which systems, networks, users are in scope)
• For each control: implementation status (Implemented/Not Implemented/Planned) and implementation description
• POA&M: for each unimplemented control, target completion date and responsible owner

---

SPRS: Supplier Performance Risk System

The Supplier Performance Risk System (SPRS) is DoD's database where contractors must self-report their NIST 800-171 compliance score.

DFARS 252.204-7019 requires contractors to assess their NIST 800-171 implementation and enter a summary score in SPRS before being awarded a DoD contract involving CUI.

Scoring methodology (NIST 800-171 Assessment Methodology):

• Start at 110 points
• Deduct points for each unimplemented or partially implemented control (deduction amounts vary by control)
• Maximum score: 110; minimum possible score: -203
• Enter score in SPRS with a system assessment date

Why this matters: DoD contracting officers check SPRS scores before award. A very low score (or no score) can delay or prevent award. A score you entered without genuinely assessing your systems is a False Claims Act risk.

---

The DOJ Cyber Fraud Initiative

The Department of Justice's Civil Cyber-Fraud Initiative (announced 2021) uses the False Claims Act to pursue contractors who knowingly misrepresent their cybersecurity practices. Cases have resulted in multi-million dollar settlements against contractors who:

• Self-certified NIST 800-171 compliance without implementing the controls
• Submitted inaccurate SPRS scores
• Received government contracts relying on false cybersecurity representations

Submitting an optimistic SPRS score without genuine control implementation is a significant legal risk, not just a compliance concern.

---

Path to Compliance: A Practical Sequence

Step 1: Define Your CUI Boundary

What systems in your environment actually handle CUI? Endpoint laptops? File servers? Cloud storage? Email? Define the boundary before doing anything else — implementing controls across your entire network when CUI is on two servers is wasteful.

Step 2: Conduct a Gap Assessment

For each of the 110 controls, assess: implemented, partially implemented, or not implemented. Be honest. This assessment becomes your SSP and SPRS score.

Step 3: Remediate High-Priority Gaps

Prioritize controls with high point values in the NIST scoring methodology and controls that are foundational to security: MFA, encryption, audit logging, patch management, incident response.

Step 4: Document in the SSP

Write or update your System Security Plan to reflect your actual implementation state for all 110 controls.

Step 5: Enter SPRS Score

Calculate your score using the NIST 800-171 Assessment Methodology and enter it in SPRS with the assessment date.

Step 6: Remediate Remaining Gaps

Continue closing POA&M items. Schedule periodic reassessments as your control implementation matures.

---

Key Takeaways

• 110 controls across 14 families — NIST 800-171 governs CUI protection in contractor information systems.
• MFA, encryption, audit logging, and incident response are the most critical and most commonly failed controls.
• System Security Plan (SSP) is the primary compliance document — must document implementation status for all 110 controls.
• SPRS score must be self-reported before DoD contract award — inaccurate scores create False Claims Act exposure.
• DOJ Cyber Fraud Initiative actively pursues contractors who misrepresent cybersecurity compliance — honest assessment and documentation is essential.
• CUI boundary definition comes first — implementing controls only where CUI actually resides is more efficient than protecting your entire environment unnecessarily.

Find DoD contracts and cybersecurity federal opportunities on RFxNerd →