Protect CUI and achieve NIST 800-171 compliance faster

NIST Special Publication 800-171 "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" defines security requirements for contractors and other organizations that handle Controlled Unclassified Information (CUI). It contains 110 security controls organized into 14 families, derived from NIST 800-53 but tailored for non-federal systems.

Any organization that handles Controlled Unclassified Information (CUI) as part of a federal contract must comply with NIST 800-171. This primarily affects defense contractors, subcontractors, and suppliers in the Defense Industrial Base (DIB) subject to DFARS clause 252.204-7012. The requirement flows down to all tiers of the supply chain that handle CUI.

CUI is information that requires safeguarding or dissemination controls pursuant to federal law, regulations, or government-wide policies, but is not classified. In defense contracting, CUI often includes technical data, engineering drawings, manufacturing specifications, and other sensitive but unclassified information marked as CUI or with legacy markings like FOUO, SBU, or LES.

SPRS (Supplier Performance Risk System) is the DoD database where contractors must submit their NIST 800-171 self-assessment scores. Contractors calculate their score by starting with 110 points (full compliance) and subtracting weighted values for each unimplemented control. Scores must be submitted before contract award and updated when compliance status changes.

SPRS scores start at 110 (fully compliant) and subtract points for each unimplemented control. Controls are weighted by risk: 5 points (highest risk), 3 points (medium), or 1 point (lower risk). For example, not implementing multi-factor authentication (5 points) has greater impact than missing a training procedure (1 point). The minimum possible score is -203.

NIST 800-171 is a set of security requirements that contractors self-attest to meeting. CMMC (Cybersecurity Maturity Model Certification) adds third-party assessment and certification. CMMC Level 2 is directly based on NIST 800-171's 110 controls. Organizations compliant with 800-171 are positioned for CMMC Level 2 when certification becomes required.

The SSP is a required document that describes your system boundary, how CUI is protected, and how each NIST 800-171 control is implemented. It serves as the primary documentation for compliance. Evidr generates SSPs automatically based on your control implementations, including boundary diagrams, control descriptions, and interconnection details.

A Plan of Action and Milestones (POA&M) documents security weaknesses (controls not yet fully implemented), planned remediation activities, and target completion dates. POA&Ms are required when you cannot fully implement all 110 controls. They must include specific milestones, resources, and completion dates for each identified gap.