---
title: What are the NIST SP 800-171 Requirements?
description: What are the requirements? Who came up with it? Does my organization have to comply? Find out.
---

[CyberSaint Blog | Expert Thought ](https://www.cybersaint.io/blog)

# [What are the NIST SP 800-171 Requirements?](https://www.cybersaint.io/blog/does-nist-sp-800-171-apply-to-my-organization)

 Written by [Alison Furneaux](https://www.cybersaint.io/blog/author/alison-furneaux) | August 6, 2017

## What are the NIST SP 800-171 requirements?

**The National Institute for Standards and Technology ([NIST](https://www.cybersaint.io/blog/nist-cybersecurity-framework-assessment-tool)) released its Special Publication 800-171, addressing the protection of Controlled Unclassified Information (CUI) in non-federal information systems.**

***The goal?*  Ensure that all systems that store, process, or transmit CUI are secured and hardened. **

[**Full DFARS NIST SP 800-171 Overview on our WebPage: The Definitive DFARS Guide**](https://content.cybersaint.io/the-definitive-guide-to-dfars-compliance-and-nist-sp-800-171)

*Here’s some background:*

*April 2013.* The Information Security Oversight Office (ISOO), the organization exercising Executive Agent responsibilities for the CUI program, issued a memorandum that directed the heads of government agencies on how to manage CUI.  

*September 2016.* In consultation with the Office of Management and Budget and affected agencies, ISOO released a notice detailing guidance for implementing the CUI program and the phased implementation deadlines. Another notice was issued in June 2017, giving recommendations for implementation.

[*What is CUI exactly?*](https://www.cybersaint.io/glossary/what-is-cui) CUI is the information that supports the business functions or missions of the government, affecting the national security interests of the country.* More on who deals with CUI is below...*

**NIST SP 800-171 is the outline of technical policies that enforce compliance with the memorandum for non-federal information systems.**

## NIST SP 800-171 Control Groups 

*There are 14 control groups that make up NIST SP [800-171](https://www.cybersaint.io/blog/reading-between-the-lines-of-nist-sp-800-171-rev-2-and-800-171b-drafts):*

1. *Access Control*
2. *Audit and Accountability*
3. *Awareness and Training*
4. *Configuration Management*
5. *Identification and Authentication*
6. *Incident Response*
7. *Maintenance*
8. *Media Protection*
9. *Physical Protection*
10. *Personnel Security*
11. *Risk Assessment*
12. *Security Assessment*
13. *System and Communications Protection*
14. *System and Information Integrity*

## Which non-federal organizations must comply with NIST SP 800-171?

If an organization stores, processes, or [transmits CUI](https://www.cybersaint.io/glossary/what-is-cui), then it must comply. Non-compliant organizations risk business with the federal or state agencies that they have contracts with. Therefore, any individual business or government contractor that does business with a government agency is part of that group. Don't comply and contacts could be dropped, with customer agencies finding new compliant contractors.

Non-federal organizations such as universities and manufacturers who work with major contractors, defense contractors, and other government contractors, often times deal with CUI whether they know it or not. 

1. *If you are a small manufacturer who deals with prime government contractors, you are most likely in contact with CUI.*
2. *If you are a government contractor that doesn't deal with classified information, chances are you’re still dealing with CUI. *
3. *If you are a higher education institution or healthcare institution that is using federal data for research, you might have to deal with CUI as part of your contract.*

If you're starting to get concerned about the **cost, time, and energy** that will go into this project, take a breath. Our CyberStrong platform gives our customers a roadmap to compliance. The platform makes managing compliance more time efficient and recommends the next steps that have the **largest impact** on your overall CyberStrong score for the **lowest cost** for your company. Chances are, you already have a foundation of security measures in place to build on. 

**Manage your compliance journey efficiently and securely from one platform, and continuously manage, mitigate, and improve your cyber posture in real-time.**

[View full post](https://www.cybersaint.io/blog/does-nist-sp-800-171-apply-to-my-organization)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Alison Furneaux"
  },
  "dateModified" : "2024-01-26T21:37:23.879Z",
  "datePublished" : "2017-08-06T12:51:02Z",
  "headline" : "What are the NIST SP 800-171 Requirements?",
  "image" : {
    "@type" : "ImageObject",
    "height" : 667,
    "url" : "https://www.cybersaint.io/hubfs/images/blog/CyberStrong_blog_How%20Were%20Making%20DFARS%20Compliance%20Affordable%20and%20Efficient.jpg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://www.cybersaint.io/blog/does-nist-sp-800-171-apply-to-my-organization",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://www.cybersaint.io/hubfs/Logo%20and%20wordmark_Color_Medium-1.png",
      "width" : 164.33963
    },
    "name" : "CyberSaint Blog | Expert Thought"
  }
}
```