NIST SP 800-171 · Protecting CUI
Protect controlled information across its working environment.
SP 800-171 defines requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems. Its scope covers systems that process, store, or transmit CUI and components that protect those systems.
Implementation planning
Know the boundary and the required revision.
Map the CUI environment
Document where CUI enters, moves, is stored, and leaves. Identify the people, systems, and services that handle or protect it.
Plan against the agreement
NIST’s current publication is Revision 3. The applicable contract or agreement determines the required revision; current CMMC Level 2 guidance references Revision 2.
Record implementation
Identify responsible owners, implementation details, organization-defined parameters, and evidence. Keep open gaps and remediation work visible.
References: SP 800-171 Revision 3 · Official CMMC guidance.
Assessments & evidence
Evaluate the requirement through its assessment objectives.
SP 800-171A supplies the assessment methodology and procedures associated with SP 800-171. Use the assessment publication that matches your applicable revision to organize evidence, evaluate implementation, and identify work that remains.
Related references