NIST 800-171 Compliance for Defense Contractors

What NIST 800-171 is and who must comply

NIST SP 800-171 is the security standard for controlled unclassified information (CUI) held by contractors, and DoD makes it mandatory through DFARS 252.204-7012: "The Contractor shall implement NIST SP 800-171" on covered contractor information systems ¹. If your contract includes 7012 and you handle covered defense information, you must comply, whether or not CMMC appears in the contract.

CMMC Level 2 uses the same requirements. 32 CFR 170.14 says the Level 2 requirements are identical to NIST SP 800-171 Rev 2 ³. So NIST 800-171 compliance and CMMC Level 2 are the same work; CMMC adds the assessment and affirmation layer. The CMMC overview explains how the two fit, and what counts as CUI.

During the CMMC Phase 2 suspension, DoD CIO says it will enforce cybersecurity compliance with NIST SP 800-171 Rev 2 ⁴. The pause did not reduce this obligation.

NIST 800-171 Rev 3 vs Rev 2: which one applies

DoD still requires Rev 2. NIST published Rev 3 in May 2024 and lists Rev 2 as withdrawn on May 14, 2024, but NIST withdrawing a document does not change what a DoD contract requires ²⁶.

Three things keep Rev 2 in force for defense contractors:

• The CMMC rule ties Level 2 to Rev 2 by name ³.
• DoD Class Deviation 2024-O0013, issued May 2, 2024, told contracting officers that contractors subject to DFARS 7012 must comply with Rev 2, as reported by Crowell and Moring ¹⁰.
• DoD CIO's suspension guidance says DoD will enforce Rev 2 during the pause ⁴.

What changes in Rev 3: 97 requirements instead of 110, 17 families instead of 14 (adding Planning, System and Services Acquisition, and Supply Chain Risk Management), and organization-defined parameters that let the agency set values such as time periods ⁸⁷. DoD published its own values for those parameters in April 2025, according to Holland and Knight ¹¹.

DoD has not yet set a date to move to Rev 3. Its regulatory agenda lists a pending interim final rule (RIN 0790-AM01) to set a deadline and transition period from Rev 2 to Rev 3. It was slated for July 2026 but had not been published as of October 2026 ⁹. The schedule may change; check the DoD CIO CMMC page and the Federal Register for the rule ⁴. Until then, build to Rev 2, and note where your Rev 2 work already lines up with Rev 3.

DFARS 252.204-7012, 7019 and 7020: what each clause requires

Three DFARS clauses carry most of the NIST 800-171 obligations, and a fourth adds CMMC.

DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) ¹

• Implement NIST SP 800-171 on covered contractor information systems.
• Report cyber incidents to DoD within 72 hours of discovery through dibnet.dod.mil, using a DoD-approved medium assurance certificate.
• Preserve images of affected systems and related data for at least 90 days after the report.
• Make sure any cloud service holding covered defense information meets security equivalent to the FedRAMP Moderate baseline. Our GCC High guide covers cloud choices.

DFARS 252.204-7019 (Notice of NIST SP 800-171 DoD Assessment Requirements) ⁵

• A solicitation provision. To be considered for award, you must have a current NIST SP 800-171 DoD Assessment, no more than three years old, posted in SPRS for each covered system.

DFARS 252.204-7020 (NIST SP 800-171 DoD Assessment Requirements) ¹²

• Defines the Basic Assessment (your self-assessment, low confidence), plus Medium and High assessments done by the government.
• Requires you to give the government access for Medium and High assessments.
• Bars you from awarding covered subcontracts unless the subcontractor has at least a current Basic Assessment.

DFARS 252.204-7021 adds the CMMC level requirement and annual affirmation ¹³. During the Phase 2 suspension, DFARS 252.204-7012 remains in effect and all Phase 1 self-assessment requirements stay in place ¹⁴⁴.

The 72-hour incident report is easy to miss under pressure. Our incident response guide covers the first steps.

SPRS score: how it is calculated

Your SPRS score starts at 110 and loses 5, 3 or 1 points for each requirement not met, so it can go below zero ¹⁵. The CMMC rule uses the same method for Level 2 self-assessments and C3PAO assessments ¹⁵.

Partial credit applies in two places ¹⁵:

• Multifactor authentication: 5 points off if no users have MFA, 3 off if only remote and privileged users have it.
• Encryption of CUI: 3 points off if encryption is used but not FIPS-validated, 5 off if it is not used at all.

The score goes into SPRS with the assessment date. Primes check it before awarding subcontracts, because 7020 bars them from flowing covered work to a company without a current assessment ¹². An accurate low score with a credible plan is better than a high score you cannot support: a wrong SPRS score is a statement to the government, and the False Claims Act applies to false statements. Honeywell Aerospace agreed to pay $2,042,518 in a September 2026 cybersecurity False Claims Act settlement tied to these obligations, as reported by Secureframe ¹⁶.

System security plan and POA&M: what they must contain

Two documents sit at the center of NIST 800-171 compliance: the system security plan (SSP) and the plan of action and milestones (POA&M).

System security plan (requirement 3.12.4). NIST SP 800-171 Rev 2 requires an SSP that describes ⁶:

• The system boundary: what is in scope.
• The environments of operation: where and how the system runs.
• How each security requirement is implemented.
• Relationships with or connections to other systems.

Under CMMC, the SSP must also document any outside service provider's role, with a service description and customer responsibility matrix ¹⁷. The SSP can never be placed on a CMMC POA&M; you must have it before any assessment ¹⁸.

Plan of action (requirement 3.12.2). NIST SP 800-171 Rev 2 requires plans of action to correct deficiencies and reduce or eliminate vulnerabilities ⁶. A usable POA&M lists, for each open requirement: the gap, the fix, who owns it, the resources needed, milestones and a target date. For CMMC, a POA&M is allowed only with a score of at least 88, only for 1-point items, and must be closed within 180 days ¹⁸.

Templates help with format but not content. Any SSP or POA&M template, including the ones NIST offers with its publications, still has to describe your actual systems. The CMMC compliance services guide explains what a consultant should hand you.

NIST 800-171 assessment and compliance help

A NIST 800-171 assessment checks each requirement against its assessment objectives in NIST SP 800-171A, using three methods: examine documents and settings, interview people, and test how systems behave ¹⁹. For Rev 2 work, use the June 2018 SP 800-171A. NIST published SP 800-171A Rev 3 in May 2024 to go with Rev 3 ²⁰.

Where to go next:

• Run a self-assessment against all 110 requirements and their objectives, then post your Basic Assessment score in SPRS ⁵.
• If you are far from 110, start with a gap assessment; see CMMC compliance services.
• Budget using DoD's own estimates in our CMMC cost guide.
• If you expect a third-party assessment later, read the C3PAO assessment guide.
• For the technical controls, many contractors use managed security services for monitoring and patching.

This page summarizes what the rules say. Confirm your own obligations with counsel or your contracting officer.