Sign in Get started

Government / NIST

Available now

NIST SP 800-171 · Rev. 2

NIST SP 800-171 Rev. 2 protects Controlled Unclassified Information (CUI) on nonfederal systems. Its 100+ requirements, grouped into families, are the scope of CMMC Level 2 and the price of admission for DoD supply-chain work.

100+

requirements tracked

Premium

Access

Add-on from $49/mo

Start your 14-day free Pro trial with NIST SP 800-171 See pricing

Scope

How much of the standard Keel models

Models its declared scope in full

Keel authors every leaf requirement in the scope declared below, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.

Authored in Keel
100+ requirements
In Keel’s scored scope
100+ leaf requirements

Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework

Who it is for

Who needs NIST SP 800-171?

  • Contractors and subcontractors handling CUI for the Department of Defense
  • Companies preparing for CMMC Level 2 assessment
  • Teams that need an SSP, a POA&M, and an SPRS score they can defend

What Keel does

How Keel helps with NIST SP 800-171

  • Every requirement in every family as a trackable framework
  • Gaps surfaced for your POA&M, and coverage shared with SOC 2 and CIS
  • A living readiness view so your SSP and score stay current

Collect once, comply everywhere

NIST SP 800-171 shares canonical controls with NIST SP 800-53, FedRAMP Rev5 Class C and FedRAMP Rev5 Class D and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding NIST SP 800-171 rarely means starting from scratch.

Shares canonical controls with

  • ISO/IEC 27001 shares canonical controls
  • CIS Critical Security Controls shares canonical controls
  • PCI DSS shares canonical controls
  • SOC 2 shares canonical controls
  • SOX (Sarbanes-Oxley) Section 404 shares canonical controls
  • NIST Cybersecurity Framework shares canonical controls
  • NIST SP 800-53 shares canonical controls
  • FedRAMP Rev5 Class B shares canonical controls
  • FedRAMP Rev5 Class C shares canonical controls
  • FedRAMP Rev5 Class D shares canonical controls
  • FedRAMP 20x shares canonical controls
  • FedRAMP Consolidated Rules shares canonical controls
  • HIPAA shares canonical controls
  • GDPR shares canonical controls
  • COPPA shares canonical controls
  • Google Play Families no shared canonical controls
  • Amazon Appstore Child-Directed Apps no shared canonical controls
  • Apple App Store Kids Category no shared canonical controls
  • PIPEDA shares canonical controls
  • ISO 9001 shares canonical controls
  • AI Governance Essentials no shared canonical controls
  • ISO/IEC 42001 shares canonical controls
  • NIST AI Risk Management Framework no shared canonical controls
  • EU AI Act no shared canonical controls
  • ESG Essentials shares canonical controls
  • US Employment Law - Federal Baseline shares canonical controls

A framework is lit when at least one canonical control satisfies both NIST SP 800-171 and that framework. Unlit means none of them do, which is an absence rather than a judgment about that standard.

Related reading: Our deep-dive on NIST SP 800-171

Questions about NIST SP 800-171 in Keel

What does NIST 800-171 compliance mean for a contractor?

It means the systems where you process, store or transmit Controlled Unclassified Information meet the security requirements of NIST Special Publication 800-171. In defense work the obligation usually arrives through DFARS clause 252.204-7012, which applies 800-171 to covered contractor information systems that are not operated on the Government’s behalf. CMMC Level 2 is how the Department of Defense checks it, and the CMMC rule at 32 CFR 170.14(c)(3) makes the Level 2 requirements identical to those in Rev. 2.

What are the NIST 800-171 control families?

Rev. 2 groups its requirements into Access Control (3.1), Awareness and Training (3.2), Audit and Accountability (3.3), Configuration Management (3.4), Identification and Authentication (3.5), Incident Response (3.6), Maintenance (3.7), Media Protection (3.8), Personnel Security (3.9), Physical Protection (3.10), Risk Assessment (3.11), Security Assessment (3.12), System and Communications Protection (3.13) and System and Information Integrity (3.14). Within each family, the basic requirements come from FIPS 200 and the derived requirements come from NIST SP 800-53 controls in the moderate baseline, tailored to what protects the confidentiality of CUI. Appendix D of the publication gives informal mappings from each requirement to SP 800-53 and ISO/IEC 27001 controls.

What are the SSP and the POA&M in NIST 800-171?

Both come from the Security Assessment family. Requirement 3.12.4 asks for a system security plan that describes the system boundary, its operating environment, how each requirement is implemented and its connections to other systems. Requirement 3.12.2 asks for plans of action that correct deficiencies and reduce or eliminate vulnerabilities, usually kept as a plan of action and milestones (POA&M). The publication puts enduring exceptions in the SSP and individual or temporary deficiencies in the plans of action. Keel scores both as requirements like any other. It does not write the SSP document for you.

How does Keel help with NIST 800-171 compliance?

Each requirement is scored against the controls you map to it. The dashboard’s requirement table lists every requirement by its own reference with a status of covered, in progress, gap, unaddressed or not applicable, and filtering it to gap and unaddressed gives you the starting list for your plans of action. A printable readiness report carries the same counts. Evidence attached to a control counts everywhere that control is mapped, so work done for 800-171 also shows up under the other frameworks it shares controls with.

Crosswalks for NIST SP 800-171: NIST SP 800-171 vs CIS Critical Security Controls crosswalk · NIST SP 800-171 vs COPPA crosswalk · NIST SP 800-171 vs ESG Essentials crosswalk · NIST SP 800-171 vs FedRAMP 20x crosswalk · NIST SP 800-171 vs FedRAMP Consolidated Rules crosswalk · NIST SP 800-171 vs FedRAMP Rev5 Class B crosswalk · NIST SP 800-171 vs FedRAMP Rev5 Class C crosswalk · NIST SP 800-171 vs FedRAMP Rev5 Class D crosswalk · NIST SP 800-171 vs GDPR crosswalk · NIST SP 800-171 vs HIPAA crosswalk · NIST SP 800-171 vs ISO 9001 crosswalk · NIST SP 800-171 vs ISO/IEC 27001 crosswalk · NIST SP 800-171 vs ISO/IEC 42001 crosswalk · NIST SP 800-171 vs NIST Cybersecurity Framework crosswalk · NIST SP 800-171 vs NIST SP 800-53 crosswalk · NIST SP 800-171 vs PCI DSS crosswalk · NIST SP 800-171 vs PIPEDA crosswalk · NIST SP 800-171 vs SOC 2 crosswalk · NIST SP 800-171 vs SOX (Sarbanes-Oxley) Section 404 crosswalk · NIST SP 800-171 vs US Employment Law - Federal Baseline crosswalk

Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks