Term
NIST 800-171
The security control catalog that governs how contractors must protect sensitive but unclassified government information on their own systems.
NIST 800-171 lays out the specific security controls a company has to have in place to protect Controlled Unclassified Information on its own, non-government systems. It is the rulebook CMMC compliance is actually measured against, so if a contract requires you to safeguard CUI, this standard applies whether or not a formal CMMC certification is also required. Working through it is a real project, covering access control, incident response, and system monitoring among other areas, so treat it as infrastructure to build before you need it, not paperwork to produce after a solicitation asks for it.
In a sentence
"The contractor shall implement the security requirements specified in NIST SP 800-171 to protect covered defense information." That single sentence can mean months of security work behind the scenes, so read it as an early flag to assess your systems, not a box you check at proposal time.
Also called
- NIST SP 800-171
- 800-171 controls
- CUI security controls
Terms like this show up in every federal notice. We translate them in place, on every notice in your trade.