NIST 800-171 Compliance
for SoCal DoD contractors.

NIST Special Publication 800-171 is the National Institute of Standards and Technology framework for Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations. It defines 110 security requirements organized into 14 control families — Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. Required by DFARS 252.204-7012 for any DoD contractor handling CUI.

Any Department of Defense contractor or subcontractor that processes, stores, or transmits Controlled Unclassified Information must comply. The requirement is triggered by the DFARS 252.204-7012 clause, which has been in DoD contracts since December 2017. The clause flows down to subcontractors at all tiers. Beyond DoD, several federal agencies (NASA, GSA, DHS) and increasingly some commercial primes flow down NIST 800-171 to suppliers. SoCal manufacturers, aerospace suppliers, engineering services firms, and IT vendors serving DoD all typically have this requirement.

NIST 800-171 is the underlying control framework — 110 security requirements and 14 control families. CMMC (Cybersecurity Maturity Model Certification) is the DoD verification mechanism that audits whether contractors actually implement NIST 800-171. CMMC Level 2 IS NIST 800-171, verified through third-party assessment. CMMC Level 3 adds 24 controls from NIST 800-172 for highest-risk environments. NIST 800-171 has been required since DFARS 252.204-7012 took effect in 2017. CMMC adds certification rigor on top of the existing requirement. The control implementation work is the same regardless of which verification path applies.

SPRS (Supplier Performance Risk System) is the DoD-mandated scoring system for NIST 800-171 self-assessment. Contractors calculate a score starting at 110 and subtract points for each control not fully implemented — most controls deduct 5 points if missing, certain critical controls deduct 5 points and others deduct 3 points based on subtractive weighting. Perfect score is 110. Scores can go negative. DFARS 252.204-7019 and 7020 require contractors to post current SPRS scores before DoD contract award. Most SoCal defense suppliers start in the 30-70 range and work toward 110 over a 6-18 month implementation period.

NIST 800-171 Revision 3 was finalized by NIST in May 2024. Rev 3 restructured the 110 controls and updated several requirements to align with NIST 800-53 Rev 5. The DFARS contracting clause still references Rev 2 as of mid-2026, so most active DoD compliance work continues under Rev 2. When DFARS updates to require Rev 3 (timing not yet announced), contractors will have a transition window. WCC's practice tracks both Rev 2 (current contracting baseline) and Rev 3 (future state) so transition planning is built in from day one.

The 14 control families are Access Control (22 controls), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16), and System and Information Integrity (7). Total: 110 controls. Each control has assessment objectives in NIST 800-171A — multiple objectives per control. CMMC Level 2 assessment evaluates all 320+ assessment objectives derived from the 110 controls.

NIST 800-53 is the comprehensive control catalog used by federal agencies for internal systems — over 1000 controls across 20 families with multiple baselines (Low, Moderate, High). NIST 800-171 is the subset applicable to nonfederal organizations handling CUI — 110 controls derived from the moderate baseline of NIST 800-53. NIST 800-171 is meant to be implementable by contractors and suppliers, while NIST 800-53 is meant for federal agencies with dedicated security programs. Both reference the same underlying control concepts; NIST 800-171 is the contractor-facing version.

NIST 800-171 compliance preparation involves four phases. Phase 1: gap assessment against all 110 controls, current SPRS score calculation. Phase 2: SSP (System Security Plan) authorship documenting how each control is implemented or planned. Phase 3: POA&M (Plan of Action and Milestones) for controls not yet implemented with remediation timelines. Phase 4: control implementation work including MFA, encryption, audit logging, network segmentation, incident response procedures, and security training. Implementation typically runs 6 to 18 months. Ongoing maintenance includes annual SPRS refresh, control monitoring, and evidence collection — often combined with vCISO services for designated leadership.