NIST SP 800-171 Rev 2

What it is

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. NIST SP 800-171 Rev 2 defines 110 security requirements across 14 practice families that nonfederal organizations must implement to protect CUI.

• Published: February 2020
• Current version: Rev 2 (Rev 3 published May 2024 — see Rev 3 transition guide)

Source: NIST SP 800-171 Rev 2 (opens in a new tab)

Who must comply

DoD contractors and subcontractors who handle CUI under contracts containing DFARS 252.204-7012.

Source: DFARS 252.204-7012 (opens in a new tab)

The 14 Practice Families

Source: NIST SP 800-171 Rev 2, Table 1 (opens in a new tab)

SPRS Scoring

The DoD Assessment Methodology assigns a weighted point value to each of the 110 practices. The maximum score is +110 (all practices implemented). Unimplemented practices reduce the score, with the minimum possible score being -203.

Score formula: Start at +110. For each unimplemented practice, subtract its weighted value (varies by practice, 1–5 points). The resulting score is entered into SPRS.

Prime contractor minimum: Many DoD solicitations require a minimum SPRS score of 88 for bid eligibility. This is not a regulatory floor — it is a solicitation-level requirement that varies by program.

Source: DoD NIST SP 800-171 Assessment Methodology v1.2.1 (opens in a new tab)
SPRS portal: sprs.csd.disa.mil (opens in a new tab)

Practice family depth

The 14 families vary significantly in implementation complexity. The most complex for digital-native organizations:

Access Control (AC) — 22 practices

AC is the highest-practice family and generates the most CMMC and 800-171 findings. Key requirements:

• AC.1.001: Limit system access to authorized users, processes, and devices — requires active account management and periodic access reviews
• AC.2.007: Employ the principle of least privilege — requires role-based access with documented justification for privileged access
• AC.3.012: Protect wireless access using authentication and encryption — requires WPA3 or equivalent with certificate-based authentication for enterprise Wi-Fi
• AC.3.017: Separate the duties of individuals to reduce the risk of malevolent activity — requires role separation in configuration management, access administration, and audit review

System and Communications Protection (SC) — 16 practices

SC addresses network security and encryption. Common gaps:

• SC.3.177: Employ FIPS-validated cryptography — requires explicit FIPS 140-2 or 140-3 validated modules, not just AES-256 in general
• SC.3.183: Deny network communications traffic by default — requires default-deny posture on all network boundaries
• SC.3.187: Establish and manage cryptographic keys — requires documented key management practices with rotation schedules

Audit and Accountability (AU) — 9 practices

AU is frequently under-implemented in organizations that have logging but not systematic audit review:

• AU.2.041: Ensure that the actions of individual users can be uniquely traced — shared accounts violate this requirement
• AU.3.045: Review and update logged events — requires documented annual review of the audit event list
• AU.3.046: Alert in the event of an audit logging process failure — requires monitoring of the audit subsystem itself

SPRS scoring in detail

The DoD Assessment Methodology assigns specific point weights to each practice. Not all practices are weighted equally — the weighting reflects the DoD's assessment of each practice's risk impact.

High-value practices (5 points each, typically):

• Multi-factor authentication for privileged accounts (IA.3.083)
• Employ FIPS-validated cryptography (SC.3.177)
• Perform periodic risk assessments (RA.2.141)
• Monitor the information system for indicators of compromise (SI.3.219)

Standard practices (1–3 points): Most of the 110 practices fall in the 1–3 point range.

Score reporting requirements:

Source: DFARS 252.204-7021(c) (opens in a new tab)

Relationship to CMMC Level 2

CMMC Level 2 requires implementation of all 110 practices from NIST SP 800-171 Rev 2. The practices are identical — CMMC Level 2 is the certification mechanism that verifies their implementation.

The difference between a NIST 800-171 self-assessment and a CMMC Level 2 C3PAO assessment is not in the requirements but in the rigor and independence of the verification. Self-assessments are accepted for non-critical programs; C3PAO assessments are required for critical CUI programs.

Source: CMMC Model v2.0, Level 2 (opens in a new tab)

Assessment methodology

The DoD Assessment Methodology defines three types of assessment:

Self-assessments use the same methodology: for each of the 110 practices, the contractor determines whether the practice is fully implemented, partially implemented, or not implemented. Partially implemented practices do not receive credit — only full implementation counts.

Preparing for assessment

The DoD Assessment Methodology includes Objective Evaluation Criteria for each of the 110 practices. These are the specific questions an assessor will ask and the evidence they will request. Before conducting a self-assessment or submitting to SPRS, organizations should:

1. Map evidence. For each practice, identify the artifact that proves implementation (policy document, configuration screenshot, scan result, tool output).
2. Identify gaps. Practices with no evidence are almost certainly not implemented. Document them in a POA&M.
3. Remediate gaps. Use REAEGIS to prioritize by SPRS point value — address highest-value practices first.
4. Sign and submit. A company official must attest the accuracy of the score in SPRS.

How REAEGIS Supports NIST 800-171 Rev 2

Related guides

• CMMC Guide — CMMC Level 2 certification requirements
• NIST 800-171 Rev 3 — Rev 3 transition guide and delta analysis
• RAMPART Engine — How RAMPART gates map to 800-171 practice families