Who Needs to Comply with NIST SP 800-171?
Learn who must comply with NIST SP 800-171, from prime contractors to subcontractors, and how handling Controlled Unclassified Information (CUI) affects your requirements.
This is Post #3 of our NIST 800 Compliance Overview Series
If you missed the earlier posts, start here to get the full picture:
NIST SP 800-171 is the gold standard for protecting Controlled Unclassified Information (CUI) in the hands of government and defense contractors. Derived from the comprehensive publication NIST SP 800-53, it provides the framework for CMMC compliance for organizations that process, store, or transmit sensitive, unclassified information on behalf of the U.S. government.
Mandatory compliance with NIST SP 800-171 will start showing up in contracts on November 10th, 2025. That means that your compliance will determine whether or not you are eligible to even bid on the contract.
An Overview of NIST SP 800-171
Officially titled, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations , NIST SP 800-171 was developed in 2015 in order to standardize security across supply chains. Rather than imposing the entire comprehensive catalog of NIST SP 800-53 controls on the private sector, NIST tailored this subset of requirements necessary to protect the confidentiality of CUI in a non-federal environment.
The NIST SP 800-171 publication outlines the required security standards and practices to be followed by non-federal organizations that handle federal CUI. 110 security requirements, organized into 14 distinct security-related families (control domains) make up the framework designed to safeguard critical defense and government information. These controls constitute the security baseline that must be met to achieve adequate security for CUI.
NIST is a cybersecurity standard, not a law. Applicability is only enforceable for defense contractors and subcontractors through the DFARS clause 252.204-7012. That clause is what actually makes compliance with NIST SP 800-171 a requirement. It is enforceable because it is included as part of the contract, not because the NIST document itself has legal authority.
Who is required to comply with NIST SP 800-171?
Compliance with NIST SP 800-171 is not voluntary. It is a direct contractual mandate for all private, non-federal entities handling CUI for the federal government. Demonstrating implementation is an essential prerequisite for securing and retaining federal contracts across all agencies including DoD, NASA, and GSA, when CUI is involved.
Key organizations required to comply include:
- Prime contractors and subcontractors working with the DoD
- Universities and research institutions conducting federally sponsored research that involves CUI (technical data, patents, sensitive logistics information)
- Non-DoD contractors working with other federal agencies (ex. Department of Energy, Department of Homeland Security, NASA) whose contracts mandate CUI protection standards
- Healthcare institutions collaborating with the U.S. government (ex. serving veterans through the VA)
- Aerospace and aviation companies that contract with NASA
- Law firms working on government cases or sensitive legal matters
- Financial institutions managing financial data for government agencies or delivering financial services to the government
- Manufacturers of products for government use , such as military equipment
Any entity required to achieve CMMC Level 2 must fully implement NIST SP 800-171 as part of the certification process.
How to Know if You Handle CUI
Controlled Unclassified Information (CUI) refers to information created by the federal government that requires protection despite being unclassified. Examples include email, electronic files, drawings, blueprints, proprietary company or contractor information, physical records, etc.
In defense, CUI may include:
- Privileged Safety Information
- DoD Critical Infrastructure Security Information
- Controlled Technical Information
- Unclassified Controlled Nuclear Information
The National CUI Registry lists all categories of sensitive information protected by NIST SP 800-171.
Contracts and DFARS Clause 252.204-7012
The core enforcement mechanism for 800-171 stems from the Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.204-7012. The Federal Acquisition Regulation (FAR) governs all acquisitions and contracting procedures associated with the U.S. government. DFARS is a supplement to FAR, specifically covering the regulations for the Department of Defense. It enforces cybersecurity standards across its entire supply chain, the Defense Industrial Base (DIB).
Titled, Safeguarding Covered Defense Information and Cyber Incident Reporting , DFARS Clause 252.204-7012 mandates:
-
NIST SP 800-171: Contractors must fully implement NIST SP 800-171 and provide adequate security for all CUI residing on their information systems.
-
Cyber Incident Reporting: Contractors are required to report any cyber incident that affects their system to the DoD within 72 hours of occurrence. This strict deadline allows the DoD to assess potential damage to national security assets quickly.
-
Flow-Down Requirement: The prime contractor must include the entire clause in all subcontracts when the performance of the subcontract involves CUI. This flow-down ensures all security protections are consistently applied throughout the multi-tiered supply chain.
When the DFARS Clause 252.204-7012 is present in a contract, the contractor is legally obligated to implement the entire 800-171 framework on the information systems that handle CUI.
What happens if you don’t comply?
Failure to comply with NIST SP 800-171 is considered a breach of contract with the federal government. The consequences can be severe.
Contractual Penalties and Loss of Business
The DoD or other federal agency can terminate a contract for non-compliance. A non-compliant company cannot achieve CMMC Level 2 certification to bid on government jobs and will be disqualified from all future CUI-related work.
Legal and Financial Liabilities
If a contractor certifies compliance, but then has critical, unaddressed security gaps, the federal government can pursue action under the False Claims Act. Financial penalties can include fines, plus any damages the government sustained.
Reputational and Operational Damage
Being identified as non-compliant destroys trust within the federal supply chain, making it impossible to win future contracts. The company’s own operations are also unnecessarily exposed, leading to potential cyberattacks, data loss, and system downtime.
NIST SP 800-171 is the minimum requirement for staying in business with the federal government.
Preparing for Compliance
Some operations may initially view the NIST SP 800-171 requirements for government contracts as being too complicated. Getting into compliance and maintaining that status begins with a thorough assessment of the organization’s systems and network that touch CUI.
To prepare for compliance:
- Take time to thoroughly study the NIST SP 800-171 publication to understand the requirements.
- Classify your data to appropriately protect it.
- Implement strong access controls.
- Educate your employees about cyber control.
- Audit activity to promptly detect and respond to security threats.
- Develop a comprehensive incident response plan.
- Manage third party risks by evaluating the security practices of subcontractors and establishing clear guidelines for data protection.
- Maintain detailed records of your compliance efforts.
- Engage compliance experts.
The cost, time, and energy related to achieving compliance can seem overwhelming. If you’re still unsure if NIST SP 800-171 applies to your business or if you need help meeting and maintaining compliance, speak with one of our compliance advisors today.
