NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems
Source: NIST SP 800-171r3 (US Government work, public domain) | Chapters: 8
When to use
Reach for this pack when scoping, implementing, or assessing security requirements for Controlled Unclassified Information on nonfederal systems — typically under federal contracts or agreements. It is the right starting point for mapping the 17 requirement families, filling organization-defined parameters, writing or reviewing a system security plan, tracking deficiencies in POA&Ms, isolating CUI components, or understanding how 800-171 was tailored from the SP 800-53 moderate baseline.
Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.
How to Use This Skill
- Without arguments — load the core frameworks below.
- With a topic — ask about CUI scope, a family (e.g., access control, incident response, supply chain), ODPs, SSP, POA&M, media sanitization, MFA, or SCRM; I read the relevant chapter.
- With a chapter — ask for
ch01throughch08.
Supporting files: glossary.md, patterns.md, cheatsheet.md.
Core Frameworks & Mental Models
Purpose and applicability
SP 800-171r3 gives federal agencies recommended security requirements to protect CUI confidentiality when that information resides in nonfederal systems and no category-specific safeguarding instrument already prescribes controls. Requirements apply only to components that process, store, or transmit CUI (or protect those components). Organizations operating systems on behalf of a federal agency are under FISMA, not this nonfederal CUI set.
Derivation and tailoring
Starting from SP 800-53 controls in the SP 800-53B moderate baseline, NIST removed items that are primarily a federal responsibility, unrelated to CUI confidentiality, adequately covered elsewhere, or not applicable. Assumptions include: CUI has the same value in federal and nonfederal custody; safeguards should be consistent; confidentiality impact is no less than moderate; nonfederal orgs may use external providers.
Seventeen requirement families
| Family | Focus |
|---|---|
| Access Control | Accounts, least privilege, remote/mobile/wireless, flow control |
| Awareness and Training | Literacy + role-based training |
| Audit and Accountability | Logging, review, time stamps, log protection |
| Configuration Management | Baselines, change control, least functionality, inventory |
| Identification and Authentication | Unique ID, MFA, authenticators, passwords |
| Incident Response | Handling capability, plan, test, train, report |
| Maintenance | Tools, nonlocal sessions, personnel |
| Media Protection | Store, mark, transport, sanitize, backup crypto |
| Personnel Security | Screening, termination/transfer |
| Physical Protection | Facility access, monitoring, alternate sites, transmission lines |
| Risk Assessment | Assess risk, vulnerability monitoring, risk response |
| Security Assessment and Monitoring | Assess controls, POA&M, continuous monitoring, exchanges |
| System and Communications Protection | Boundaries, crypto, deny-by-default, sessions |
| System and Information Integrity | Patching, malware, alerts, monitoring, retention |
| Planning | Policies, system security plan, rules of behavior |
| System and Services Acquisition | Security engineering, unsupported components, external services |
| Supply Chain Risk Management | SCRM plan, acquisition strategies, supplier requirements |
Organization-defined parameters (ODPs)
Many requirements contain assignment/selection operations. Agencies (or consortia) should set values; if they do not, the nonfederal organization must assign values to complete the requirement. Once set, ODP values are part of the requirement and drive consistent assessment.
Requirement structure
Each requirement has a normative statement, an informative discussion (not a scope expansion), and references to source SP 800-53 controls plus supporting publications. Example pattern: cryptographic protection types are assigned via ODP; discussion recommends FIPS-validated cryptography.
Scoping and exceptions
Isolate CUI components into separate security domains (physical and/or logical) to avoid over-hardening the entire enterprise. Document enduring limitations (e.g., specialized systems) in the SSP (03.15.02). Manage temporary deficiencies through POA&Ms (03.12.02).
Assessment companion
SP 800-171A provides assessment procedures. This pack explains what the requirements mean; 171A explains how to assess them.
Chapter Index
| # | Section | Key content |
|---|---|---|
| ch01 | CUI Scope, Fundamentals, and Structure | Applicability, tailoring, 17 families, ODPs, SSP/POA&M exception paths |
| ch02 | Access Control + Identification & Authentication | Accounts, least privilege, remote/mobile, MFA, authenticators |
| ch03 | Awareness, Personnel, Physical | Training, screening, offboarding, facility and alternate-site controls |
| ch04 | Audit + Configuration Management | Logging lifecycle, baselines, change control, allow-by-exception software |
| ch05 | Incident Response, Maintenance, Media | IR plan/capability, nonlocal maintenance, media sanitization and backup crypto |
| ch06 | Risk, Assessment & Monitoring, Planning | Risk response, POA&M, continuous monitoring, SSP, rules of behavior |
| ch07 | Communications Protection + Integrity | Boundaries, cryptography, patching, malware, system monitoring |
| ch08 | Acquisition + Supply Chain Risk Management | Security engineering, external services, SCRM plan and supplier flow-down |
Topic Index
- Access control / least privilege → ch02
- Alternate work site → ch03
- Audit logging / time stamps → ch04
- Authenticator / password management → ch02
- Backup confidentiality / media crypto → ch05, ch07
- Boundary protection / deny by default → ch07
- Configuration baseline / change control → ch04
- Continuous monitoring → ch06
- Cryptographic protection / key management → ch07
- CUI definition and scope → ch01
- External system services / cloud providers → ch08
- Flaw remediation / patching → ch07
- Incident response plan / handling → ch05
- Information exchange agreements → ch06
- Information flow enforcement → ch02
- Malicious code protection → ch07
- Media sanitization / marking / transport → ch05
- Multi-factor authentication (MFA) → ch02
- Nonlocal maintenance → ch05
- Organization-defined parameters (ODPs) → ch01, ch06
- Personnel screening / termination → ch03
- Physical access control → ch03
- Plan of action and milestones (POA&M) → ch06
- Remote / wireless / mobile access → ch02
- Risk assessment / vulnerability scanning → ch06
- Rules of behavior → ch06
- Security assessment → ch06
- Security engineering principles → ch08
- Supply chain risk management (SCRM) → ch08
- System security plan (SSP) → ch01, ch06
- Tailoring from SP 800-53 → ch01
- Training (literacy and role-based) → ch03
- Unsupported / end-of-life components → ch08
Supporting Files
- glossary.md — key 800-171 / CUI terms with chapter references
- patterns.md — implementation patterns (When / How / Trade-offs)
- cheatsheet.md — decision rules, family map, tells & smells
Scope & Limits
This pack covers NIST SP 800-171 Revision 3 (final 2024-05-14, DOI 10.6028/NIST.SP.800-171r3) — purpose, fundamentals, and the 17 security requirement families as synthesized reference notes. It does not cover: SP 800-171A assessment procedures in full; SP 800-53 control catalog detail beyond provenance; CMMC level scoring or assessment guides; DFARS solicitation clauses as legal advice; classified information (EO 13526) controls; or sector-specific CUI category instruments that supersede the moderate baseline. US Government public domain work; no copyright restrictions on the source document. No source-material download link is published.
