Government and Compliance IT Solutions
NIST 800-171 Compliance Guide (2026)
Published April 7, 2026 · Hatty AI · 14 min read
Full implementation guide for NIST SP 800-171 — 110 controls, 14 families, SSP/POA&M documentation, SPRS scoring, and the step-by-step path to protecting CUI.
Why NIST 800-171 Matters for Federal Contractors
If your business handles Controlled Unclassified Information (CUI) for the U.S. Department of Defense or any federal agency, NIST SP 800-171 is not a suggestion — it is the baseline security standard your organization must meet to remain eligible for contracts.
Unlike a certification program, NIST 800-171 is a set of 110 security controls organized into 14 families. There is no pass/fail exam — compliance is demonstrated through documentation, self-assessment scoring, and the ability to prove your security posture to auditors or contracting officers.
This guide explains exactly what NIST 800-171 requires, how to implement it, and what the government considers compliant. If you are looking for the contract clause that triggers these requirements, see our DFARS 252.204-7012 Guide. For a side-by-side comparison with CMMC, see our Federal Compliance Comparison Guide.
What Is NIST SP 800-171?
NIST Special Publication 800-171 was developed by the National Institute of Standards and Technology to define the security requirements for protecting CUI in non-federal systems and organizations. The current version is Revision 2 (Rev 2), though Revision 3 has been published and will eventually replace it.
Key facts about the framework:
- 110 security controls across 14 control families
- Applies to any non-federal system that processes, stores, or transmits CUI
- Required by DFARS 252.204-7012 in DoD contracts
- Forms the basis of CMMC Level 2 certification
- No certification body — compliance is self-assessed and documented
The 14 Control Families
Each control family addresses a specific domain of cybersecurity. The number of controls varies by family, with Access Control having the most at 22 controls.
| Family | Controls | What It Covers |
|---|---|---|
| Access Control | 22 | Who can access systems and data, session limits, remote access |
| Awareness and Training | 3 | Security training for users and administrators |
| Audit and Accountability | 9 | Logging, monitoring, and audit trail protection |
| Configuration Management | 9 | Baseline configurations, change control, least functionality |
| Identification and Authentication | 11 | Multi-factor authentication, password policies, device identification |
| Incident Response | 3 | Incident handling, reporting, and testing procedures |
| Maintenance | 6 | System maintenance controls, remote maintenance safeguards |
| Media Protection | 9 | Media access, marking, storage, transport, and sanitization |
| Personnel Security | 2 | Screening, termination, and transfer procedures |
| Physical Protection | 6 | Facility access, visitor controls, monitoring physical access |
| Risk Assessment | 3 | Vulnerability scanning, risk analysis, and remediation |
| Security Assessment | 4 | Periodic assessments, corrective actions, continuous monitoring |
| System and Communications Protection | 16 | Encryption, boundary protection, session authenticity |
| System and Information Integrity | 7 | Flaw remediation, malicious code protection, system monitoring |
Required Documentation
The government does not accept verbal assurances. To be considered compliant, your organization must maintain three core documents:
System Security Plan (SSP)
The SSP is your primary compliance document. It describes your system boundaries, the environment where CUI is processed, and how each of the 110 controls is implemented. A weak or missing SSP is the single most common reason contractors fail assessments.
Plan of Action and Milestones (POA&M)
The POA&M documents any controls that are not yet fully implemented, along with specific remediation plans and target completion dates. Having a POA&M is not a failure — it shows the government you have identified gaps and have a plan to close them.
SPRS Score
The Supplier Performance Risk System (SPRS) score is a numerical representation of your compliance posture. Scores range from -203 (no controls implemented) to 110 (all controls fully implemented). Your score must be submitted to the SPRS portal, and contracting officers can — and do — check it before awarding contracts.
SPRS Scoring Quick Reference
- 110 = Perfect score, all controls implemented
- Above 70 = Strong posture, competitive for most contracts
- Below 0 = Significant gaps, likely disqualifying for new awards
- -203 = No controls implemented (worst possible score)
What NIST 800-171 Covers (And What It Does Not)
Understanding the boundaries of NIST 800-171 prevents costly misunderstandings:
| NIST 800-171 Covers | NIST 800-171 Does NOT Cover |
|---|---|
| Technical security controls (encryption, MFA, access control) | Contract obligations (that is DFARS) |
| Administrative safeguards (policies, procedures, training) | Certification requirements (that is CMMC) |
| Risk management practices | Legal enforcement mechanisms |
| Incident response planning | Incident reporting timelines (that is DFARS 7012) |
For the contract clause that makes NIST 800-171 mandatory, read our DFARS 252.204-7012 Guide. For the certification layer that validates your implementation, see our complete compliance comparison.
Implementation Timeline
The timeline depends on your current security maturity. Organizations with existing IT policies and managed infrastructure typically move faster than those starting from scratch.
| Phase | Duration | Key Activities |
|---|---|---|
| Gap Assessment | 2-4 weeks | Evaluate current controls against all 110 requirements |
| SSP Creation | 2-6 weeks | Document system boundaries, data flows, and control implementations |
| Remediation | 1-6 months | Implement missing controls, deploy tools, update policies |
| SPRS Submission | 1-2 weeks | Calculate score, submit to SPRS portal |
| Continuous Monitoring | Ongoing | Regular reviews, vulnerability scans, POA&M updates |
Get Compliant with Hatty AI
Hatty AI provides end-to-end NIST 800-171 implementation for federal contractors — from initial gap assessment through SSP creation, remediation, and SPRS submission. We work with small businesses and subcontractors who need to get compliant quickly without hiring a full-time compliance team.
Ready to Get NIST 800-171 Compliant?
We help contractors implement all 110 controls, create audit-ready documentation, and submit competitive SPRS scores. Financing available.
Schedule a Compliance Consultation(210) 227-3444 — Talk to a compliance specialist today
Related: DFARS 252.204-7012 Guide · NIST vs CMMC vs DFARS Comparison · NIST 800-171 Services · NIST 800-171 Checklist
Frequently asked questions
What is NIST SP 800-171?
It is the baseline security standard for protecting Controlled Unclassified Information (CUI) handled for the DoD or federal agencies. It comprises 110 security controls in 14 families.
Is NIST 800-171 a certification?
No. The post says there is no pass/fail exam. Compliance is shown through documentation, self-assessment scoring and the ability to prove your security posture to auditors or contracting officers.
What documentation does NIST 800-171 require?
The post has a required documentation section, which centers on the System Security Plan and supporting policies and procedures.
Free review
Get a free review from an engineer
Tell us where your team loses the most time. Our engineers review your current setup and send back a prioritized plan for automation, software and security.
- Reviewed by an engineer, not a bot
- Prioritized by time saved and risk reduced
- No obligation and no pressure
Prefer to talk? Call (210) 227-3444 or book a strategy session.