NIST 800-171 Checklist: Revision 3 Requirements by Family, With Evidence

A NIST 800-171 checklist lists the security requirements for protecting controlled unclassified information (CUI) on your systems and the evidence that each one is met. This checklist follows Revision 3, which NIST published in May 2024: 97 requirements in 17 families. If you are a defense contractor, CMMC Level 2 still assesses the 110 requirements of Revision 2: when we checked on October 10, 2026, the Department of War CIO's CMMC pages said the Department enforces Revision 2.

Our CMMC compliance services scope where CUI lives, build these controls and write the System Security Plan; we are not a C3PAO and certify no one. For the standard in brief, see our NIST SP 800-171 glossary entry, and for the Revision 2 families that CMMC scores, see CMMC Level 2 requirements. This is general information, not legal advice.

What does NIST 800-171 compliance mean?

It means the systems that process, store or transmit CUI meet the security requirements in NIST SP 800-171, and you can prove it. NIST writes the requirements; contracts make them binding. In defense work, DFARS 252.204-7012 required contractors to implement them by December 31, 2017, and that clause remains in effect. The CMMC program then checks them against Revision 2: during the Phase II suspension, Level 2 means a self-assessment every three years with an affirmation every year, and no new contract can require the rule's third-party C3PAO assessment.

Keep the two ideas apart. Compliance is the state of your systems. An assessment, whether your own, a government-led review or a C3PAO's, is a check of that state on a date.

Which revision should your checklist follow?

If you hold defense contracts, score your self-assessment against Revision 2: 32 CFR part 170 names it, and the Department says it enforces it during the Phase II suspension. Revision 3 is still worth reading: it is NIST's current version, and its additions, such as a supply chain risk management plan, are sound practice. If you implement it now, the Department's CMMC FAQ says to use the organization-defined parameter values in its April 2025 memo and to close any gaps between the two revisions, because assessments stay on Revision 2 until the class deviation that keeps Revision 2 is withdrawn. Keep one numbering scheme in your System Security Plan, and map any Revision 3 work back to the Revision 2 requirement it supports.

How do you scope CUI before you start?

1. Find the CUI. Read each contract and its flow-down clauses, look for CUI markings on drawings and specifications, and ask the prime in writing what you will receive.
2. Map where it goes. Revision 3 asks you to identify and document where CUI is processed and stored and on which system components (03.04.11), and to keep a component inventory (03.04.10).
3. Draw the boundary. Under 32 CFR 170.19, assets that process, store or transmit CUI are assessed against all Level 2 requirements; security tools that protect them are assessed against the requirements relevant to what they do; contractor risk managed assets and specialized assets, such as test equipment, are documented in the SSP with limited or no assessment; and assets that cannot process, store or transmit CUI, for example because they are physically or logically separated from CUI assets, and that provide no security protection for them are out of scope. An enclave that keeps CUI with a few people and systems often gives the smallest scope.
4. Write it down in the System Security Plan, with the network diagram and asset inventory beside it.

NIST 800-171 Rev. 3 checklist by family

Copy this table into a spreadsheet, add columns for owner, status and evidence location, and work family by family. Requirement numbers and titles are NIST's; withdrawn numbers are skipped, and NIST's dashes in some titles are shown here as commas.

What changed from Rev. 2 to Rev. 3?

• Structure. Seventeen families instead of fourteen, with Planning, System and Services Acquisition, and Supply Chain Risk Management added, and some Revision 2 requirements withdrawn or merged. The old System Security Plan requirement, for example, is now part of 03.15.02.
• Parameters. Many requirements now contain organization-defined parameters, such as how quickly security updates must be installed (03.14.01). NIST says that if an agency does not set a value, the organization must.
• Precision. Some requirements now say exactly what is expected. 03.05.03, for example, requires multifactor authentication for access to both privileged and non-privileged accounts.

NIST publishes a change analysis spreadsheet that compares the two revisions line by line, and an August 2025 small business primer, SP 1318, that introduces Revision 3 for owners.

How do you assess NIST 800-171 compliance?

SP 800-171A sets out the assessment procedures. Its assessment methods are examine (reviewing documents and configurations), interview (talking with the people involved) and test (exercising a mechanism to compare actual with expected behavior). Each requirement is broken into assessment objectives, and each objective is found satisfied or other than satisfied, so your evidence has to cover every objective, not only the headline requirement.

For a CMMC Level 2 self-assessment, the rule specifies the June 2018 SP 800-171A and the scoring method in 32 CFR 170.24: start at 110, subtract 5, 3 or 1 points for each requirement not met, and the total can fall below zero. Results go into SPRS, a senior official affirms them, and the evidence must be kept for six years.

Who maintains the checklist, and how often?

The system owner keeps it, with named owners for each family. Update it whenever the boundary, a system or a provider changes, and on the review frequencies you set for your organization-defined parameters. For CMMC, the rhythm is fixed: an affirmation every year and a Level 2 self-assessment every three years.

How does NetSys help with NIST 800-171?

We start from the data: where CUI arrives, who opens it, where it is stored and where it goes next. From there we draw an enclave boundary, run a gap assessment with a scored, prioritized remediation plan, and implement the requirements inside the boundary, from identity and MFA to logging and incident response. The System Security Plan is written from the configuration we deployed, open items go on a plan of action within the limits the CMMC rule allows, and evidence is organized by requirement. Cloud services that hold CUI must be FedRAMP Moderate authorized or equivalent, so we help you choose between commercial Microsoft 365, GCC and GCC High based on the data you hold. Agreements run month to month.

Not sure what your contracts require? Book a call and we will review the clauses and your CUI flow with you.

Frequently asked questions

What is NIST SP 800-171 compliance?

Meeting the security requirements in NIST Special Publication 800-171 on every system that processes, stores or transmits CUI, and keeping the evidence to prove it. Defense contracts require it through DFARS 252.204-7012, and CMMC Level 2 checks it against the 110 requirements of Revision 2.

Is NIST 800-171 the same as CMMC?

No. NIST SP 800-171 is the set of requirements; CMMC is the Defense Department program that verifies them. During the Phase II suspension, contracts may require only CMMC Level 1 or Level 2 self-assessments, while DFARS 252.204-7012 continues to require the security requirements themselves.

How many controls are in NIST 800-171?

Revision 3 has 97 requirements in 17 families. Revision 2 has 110 in 14 families, and those 110 are the ones CMMC Level 2 scores. NIST calls them security requirements; each is derived from controls in NIST SP 800-53.

Is there a NIST 800-171 checklist in Excel?

NIST publishes the Revision 3 requirements as a dataset in its Cybersecurity and Privacy Reference Tool, and the Revision 2 requirements as a downloadable spreadsheet. The family table above also copies cleanly into a spreadsheet, one row per requirement.

Does NIST 800-171 apply to small businesses?

Yes, when a contract requires it; company size is no exemption. NIST's SP 1318 primer is written for small businesses starting with Revision 3, and an enclave keeps the scope, and the cost, proportional to the CUI you actually hold.

Sources and further reading

• NIST SP 800-171 Rev. 3, May 2024: the 17 families, requirement numbers and titles, organization-defined parameters and the change analysis, checked October 2026.
• NIST SP 800-171A Rev. 3, May 2024: assessment methods and objectives, checked October 2026.
• NIST SP 800-171 Rev. 2: withdrawn May 14, 2024, still the CMMC Level 2 baseline, checked October 2026.
• NIST SP 1318, Small Business Primer for SP 800-171 Rev. 3, August 2025, checked October 2026.
• Department of War CIO: About CMMC: Revision 2 enforced during the Phase II suspension, checked October 10, 2026.
• CMMC Program FAQs, revised July 13, 2026 (PDF): Revision 3 organization-defined parameters and the Revision 2 class deviation, checked October 2026.
• 32 CFR Part 170, CMMC Program, eCFR: scoping, scoring and evidence retention, checked October 2026.