NIST 800-171: 110 requirements, and the ones that actually fail people.

NIST Special Publication 800-171 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations — is published by the National Institute of Standards and Technology. On its own it is guidance. It becomes binding when a contract clause references it, and for the defense industrial base that clause is DFARS 252.204-7012, which has required “adequate security” defined as the implementation of 800-171 since 31 December 2017.

That timing matters more than most coverage admits. Companies frequently describe 800-171 as something CMMC brought in. It is the reverse: 800-171 has been a contractual requirement for years, self-attested and largely unverified, and CMMC exists because self-attestation was not producing compliance. When people say CMMC “added” requirements at Level 2, what it added was an assessment. The 110 requirements were already yours.

The trigger is the information, not the size of the company. If Controlled Unclassified Information is processed, stored or transmitted on your systems in the performance of a DoD contract, 800-171 applies to the systems that touch it. A two-person machine shop handling CUI drawings is in scope on the same terms as a prime, which is the single most under-appreciated fact in the defense supply chain.

NIST published NIST SP 800-171 Revision 3 in May 2024. It reorganizes the standard into 17 families and 97 requirements, and introduces organization-defined parameters — values the organization sets rather than inherits. Read on its own, Revision 3 is the current version of the publication.

For DoD work it is not the version that counts. The Department has not authorized Revision 3 for assessments, SPRS scoring or certification; DoD contracts continue to be assessed against Revision 2 and its 110 requirements, held in place by a class deviation issued in 2024. An interim rule to move CMMC assessments onto Revision 3 was on the Department’s regulatory agenda for July 2026 and has not been finalized as at 23 August 2026.

The practical instruction is therefore unusually simple, and worth stating plainly because a lot of published advice gets it backwards: build to Revision 2. If a consultant is scoping your program against 97 requirements and organization-defined parameters, they are working to a standard your assessor will not use. Track Revision 3, because the transition is coming and the delta is manageable if you know it — but do not implement to it yet.

DFARS 252.204-7019 and 252.204-7020 require a self-assessment against 800-171 and the posting of the resulting score to the Supplier Performance Risk System, SPRS. The scoring method starts at 110 — every requirement implemented — and subtracts points for each one that is not. Deductions are weighted by impact: 5 points for the requirements whose absence exposes the network most directly, 3 points for significant exposure, and 1 point for the rest.

Because the weights are uneven, the floor is not zero. A company that has implemented nothing scores −203. Negative scores are common, they are visible to contracting officers, and they are visible to primes assessing you as a subcontractor. This is the mechanism that quietly turned a compliance exercise into a competitive one: your score is a number a customer can compare against another supplier’s.

Two things follow. First, an honest low score is safer than an optimistic high one — the score is an attestation, and a knowingly false attestation is a False Claims Act exposure, a theory the Department of Justice has already used against contractors. Second, the score is a point-in-time claim about a live environment. It decays. The gap between the number in SPRS and the state of the network is exactly the gap continuous monitoring exists to close.

The cleanest way to hold the two apart: 800-171 is the standard, CMMC is the verification. CMMC Level 2 does not invent security requirements — it is the same 110 requirements from Revision 2, assessed and given a status that DoD records. CMMC Level 1 is a different and much smaller set, the 15 basic safeguarding requirements from FAR 52.204-21, and applies where only Federal Contract Information is involved. CMMC Level 3 adds 24 requirements selected from NIST SP 800-172 on top of Level 2.

So the honest answer to “should we wait for CMMC to settle before doing 800-171?” is no, and not for motivational reasons. The reform review announced in July 2026 is a review of how compliance is verified and how much that verification costs. Nothing in the memo suspends DFARS 252.204-7012, and the Department has been explicit that it is reducing certification burden rather than lowering the security baseline. A company that spends the pause implementing 800-171 is ready for whatever the task force recommends. A company that spends it waiting is not.

For how the levels differ and which one a given contract will demand, see CMMC levels. For what an assessment involves once you are in one, see the CMMC audit.

CUI does not stop at your boundary. It goes to the design partner, the test house, the machine shop, the logistics provider — and each of those is a system you are required to flow requirements down to and are not permitted to inspect. What you get back is an attestation and, if you ask well, an SPRS score.

An attestation is a claim about a network on the day it was written. Between that day and the incident, the supplier stands up a new remote access gateway, exposes an RDP port during a migration, lets a certificate lapse, or is acquired by a company with a different security culture. None of that reaches you through the attestation process, and all of it is visible from outside.

That is the case for monitoring the defense supply chain continuously rather than annually: not to replace the paperwork, which is contractually required, but to know when the paperwork has stopped being true. RiskXchange rates suppliers from the outside, without their cooperation, and tells you when something changes — supplier risk management covers how that works in practice.