NIST SP 800-171 compliance
If your contract involves Controlled Unclassified Information (CUI), NIST SP 800-171 is the security standard your systems are held to. We build the program that meets it: scope, controls, documentation, and evidence, with as much of that evidence as possible drawn directly from your systems.
Where the requirement comes from
Defense contracts. DFARS 252.204-7012 requires 800-171 on any system that processes, stores or transmits covered defense information, and DoD contracts also require a current self-assessment score in SPRS. DoD holds contractors to Revision 2 of the standard by class deviation, even though NIST has since published Revision 3. These obligations come from the contract clause itself and apply whatever the status of CMMC.
Civilian-agency contracts. In June 2026 the FAR Council proposed a government-wide CUI rule that would extend 800-171 to civilian-agency contractors at Revision 3, with 72-hour incident reporting. It is a proposed rule, not yet in force, but it signals where civilian contracts are heading.
Contractors serving both. If you work for defense and civilian agencies, you may soon answer to two revisions of the same standard at once. We plan the program so the work carries across both rather than being done twice.
What we do
- Scoping. We find where CUI actually lives and draw the boundary around it, kept small on purpose. A smaller boundary means fewer systems to secure, document and evidence.
- Gap assessment. We test your environment against all 110 requirements and the 320 assessment objectives NIST uses to evaluate them, and tell you exactly which ones are open.
- System security plan and POA&M. We write the SSP from your running environment, so it describes what is actually configured, and build a plan of action for anything still open.
- SPRS score. We calculate your score using the DoD assessment methodology and document how each point was reached, so the number you submit can be defended.
- Evidence. Wherever a system can prove an objective on its own, we collect the evidence from the system. Where it cannot, we tell you up front which objectives need a person, and help you put that work in place.
Why our approach is different
Most 800-171 work produces documents that describe a system and then go stale. We treat compliance as a property of the system itself, verified from its real configuration. We call this Compliance as Infrastructure™. Our published research classifies every 800-171A assessment objective by whether a system can produce the evidence for it, and it is the same classification we work from on engagements.