NIST SP 800-171 Rev 3
NIST SP 800-171 — CUI Protection / Federal Contractors
NIST SP 800-171 Rev 3 defines security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems. It is the foundation for CMMC 2.0 Level 2 — mandatory for all DoD contractors. Any organization deploying AI systems that handle CUI must demonstrate 800-171 compliance.
Buyer fit
- DoD contractors and subcontractors
- Organizations handling Controlled Unclassified Information (CUI)
- CMMC 2.0 Level 2 compliance candidates
- Federal civilian agencies
Coverage areas
- Access control and CUI flow management (3.1.x)
- Audit logging and user accountability (3.3.x)
- Configuration management and security baselines (3.4.x)
- Multi-factor authentication (3.5.3)
- Risk assessment and vulnerability management (3.11.x)
- System and information integrity (3.14.x)
- AI system risk in CUI environments
Executive questions
- Do any of your AI systems process or have access to CUI?
- Is multi-factor authentication enforced for all system access?
- Are audit logs retained and reviewed for all CUI-touching systems?
- Have you conducted a formal 800-171 self-assessment (SPRS score)?
- Are your AI model training datasets free of unauthorized CUI?
- What is your timeline for CMMC 2.0 Level 2 certification?
Monitoring signals
- Open 800-171 control gaps
- MFA coverage rate
- Audit log retention compliance
- Vulnerability remediation SLA adherence
- CMMC assessment timeline
Executive output expectations
Framework detail pages explain what a premium buyer should expect from delivery, not inflated promises about certification or legal outcomes.
Report outputs
- 800-171 control gap analysis by family
- SPRS score estimate and gap-to-target roadmap
- CUI flow mapping for AI systems
- CMMC 2.0 readiness assessment
- MFA and access control findings
- Federal contractor AI risk executive briefing
Why this page exists
- Support buyer education before the first sales call
- Give founders a consistent structure for future framework pages
- Make it easy to add deeper proof and downloadable assets later