What this publication is
NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, provides federal agencies with recommended security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) when that information resides in nonfederal systems and organizations. As the NIST Computer Security Resource Center (CSRC) explains, these requirements are designed for inclusion in contractual vehicles or other agreements between federal agencies and nonfederal organizations.
The requirements apply to the components of nonfederal systems that process, store, or transmit CUI, as well as to the components that provide security protection for them. Keep the category clear: SP 800-171 is a NIST publication of security requirements, not an off-the-shelf software product and not a federal cloud marketplace Authorization.
Edition covered: Revision 3, Final 14 May 2024
The current NIST publication pin is Revision 3, Final, dated 14 May 2024 (Date Published May 2024). The digital object identifier is 10.6028/NIST.SP.800-171r3. On the CSRC publications page, Revision 3 supersedes Revision 2.
The companion publication has a different role. NIST SP 800-171A is the assessment-procedures publication, not a second set of security requirements. CSRC lists SP 800-171A Rev. 3 as the publication part that sits beside Revision 3. A program rule can still cite an earlier assessment-procedures edition.
CUI, in one screen
CUI is unclassified information that a law, regulation, or Government-wide policy requires or permits an agency to handle with safeguard controls or dissemination controls. The Department of War CMMC About page points at 32 CFR 2002.4 for that theme. It also points at the official CUI registry for categories.
Where it sits
The publication is about nonfederal systems that handle CUI, or that protect the components that handle it. FISMA sits in the federal agency lane. Contractors and suppliers meet a different lane: CUI on nonfederal systems, and the CMMC contractual assessment program.
A review of pieces of a NIST special publication is not that program. It is not a FedRAMP Authorization either.
The contract can lag the NIST Final
The NIST publication of Revision 3 does not, by itself, rewrite every agreement that still cites Revision 2. The CMMC About page and 32 CFR 170.14 still frame Level 2 security requirements as NIST SP 800-171 Revision 2. The habit is to check the agreement and the program text for the revision that is actually assessed.
Evidence, without a worksheet
A useful conversation names the owner of a requirement on a synthetic system. The conversation also names the artifact that an assessor reads. A banner with the words NIST compliant is not that conversation.
SP 800-172 is a separate publication of enhanced requirements. It does not replace SP 800-171. If a contract cites SP 800-172, that citation stays separate.
Two dates, two sentences
NIST published Revision 3 on 14 May 2024. The contract or program text is where the team verifies whether the assessment still uses Revision 2. Those are different sentences.
At work, the team opens one contract clause or an internal Supplier Performance Risk System note with the contracts owner.
CMMC, FedRAMP, and NIST are not one badge
| Phrase people use | Literacy correction |
|---|---|
| We are CMMC, FedRAMP, and NIST compliant, as one blob. | CMMC is the Department of War contractor assessment program for the protection of Federal Contract Information and CUI. FedRAMP is the federal cloud Authorization program for cloud products and services used by agencies. SP 800-171 is the NIST set of recommended security requirements for CUI in nonfederal systems. Implementation of pieces of a NIST special publication is not program Status and is not a FedRAMP Authorization. |
| 800-171 Rev. 3 is what CMMC Level 2 assesses today. | The CMMC About page and 32 CFR 170.14 frame Level 2 security requirements as NIST SP 800-171 Revision 2. NIST also published SP 800-171 Rev. 3 (Final, 14 May 2024). The edition in a contract or program can lag the latest NIST Final. Revision 2 and Revision 3 are not one edition. |
| CMMC Phase II is mandatory everywhere now. | Phase II requirements were scheduled for 10 November 2026. The Department of War suspended them on 13 July 2026. Phase I self-assessment requirements remain. The habit is to re-open the official CMMC hub before a timeline is treated as current. Later reform-task-force dates are unknown until that page states otherwise. |
Common misconceptions
We implemented NIST, so CMMC and FedRAMP are done.
A NIST special publication, a contractor assessment program, and a federal cloud Authorization program are three different things. Implementation of pieces of SP 800-171 does not issue CMMC Status. It does not issue a FedRAMP Authorization.
Revision 3 automatically replaced Revision 2 inside every Department of War contract yesterday.
CSRC marks Revision 2 as superseded by the NIST Final. A contract or program can still incorporate Revision 2 by reference. CMMC Level 2 still points at Revision 2. The habit is to read the agreement.
SP 800-171 is a product to buy.
It is a NIST publication of recommended security requirements for agencies to use in agreements. A vendor brochure is not the publication. It is not an assessment result.
SP 800-171A is a different set of security requirements.
SP 800-171A is the assessment-procedures companion. The security requirements are in SP 800-171. The two publications stay separate. The habit is to check which edition of the companion a program still cites.
CHECK THE CATEGORY
When Meridian Space & Robotics reviews a defense subcontractor agreement that references NIST SP 800-171, which statement describes the edition and companion rules accurately?
Glossary and nearby pages
Use the agency page in the sources for the authoritative text.