NIST SP 800-171

What is NIST SP 800-171?

NIST SP 800-171 is a document of guidelines published by the National Institute of Standards and Technology (NIST) in 2015, with compliance required as of December 31, 2017. The purpose of the guidelines is to “ensure that sensitive federal information remains confidential when stored in nonfederal information systems and organizations.”

As a DoD contractor, you are subject to oversight and regulations that you would otherwise avoid in traditional business transactions.

Enforcement of these regulations is handled directly by the Department of Defense, making compliance absolutely mandatory.

Understanding NIST 800-171

All regulations outlined in 800-171 can be summed up in two broad categories — administrative and technical.  NIST Special Publication (SP800-171 or simply 800-171), “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations”, covers security standards and controls to provide guidance for the safeguard of controlled unclassified information (CUI) and classified defense information (CDI).

Put simply, 800-171 is a set of standards that define how to safeguard and distribute material deemed sensitive but not classified.

For some government agencies, most notably the Department of Defense (DOD), General Services Administration (GSA) and National Aeronautics and Space Administration (NASA), a revised set of rules for NIST compliances took effect on December 31, 2017, requiring anyone who works with CUI from those agencies to implement specific security measures for how they handle data and report non-compliance to the agencies CIO.

Under federal regulations, such as DFARS clause 252.204-7012, every affected company and agency is now required to assess and document their compliance in handling this info in more than a dozen areas, from the way their networks are configured, to the way any and all media is protected, to the way employees receive access to the NIST 800-171 standard.

Prior to these requirements, every agency had a unique set of rules for data handling, safeguarding and disposing of this material. These inconsistent standards posed a challenge – and a potential security concern – when information needed to be shared, especially when multiple contractors become part of the process.

Additional resource includes Supplier Performance Risk System (SPRS), "the authoritative source to retrieve supplier and product Performance Information (PI) assessments for the DoD acquisition community to use in identifying, assessing, and monitoring unclassified performance.” Be sure to gain access SPRS application as well.

Start Your Journey to Compliance

Back to Top