NIST SP 800-171 Rev. 2Supported in OneClickComply

Meet all 110 NIST 800-171 Rev. 2 requirements for DoD contracts

NIST SP 800-171 Rev. 2 is the February 2020 edition of NIST's standard for protecting Controlled Unclassified Information (CUI) held in non-federal systems, setting 110 security requirements across 14 families. NIST replaced it with Revision 3 in May 2024, but the US Department of Defense deliberately kept Revision 2 as the version its contractors must meet. It is also the basis of CMMC Level 2.

See the NIST 800-171 Rev. 2 requirements

NIST 800-171 Rev. 2 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs NIST 800-171 Rev. 2

Is NIST 800-171 Rev. 2 right for your organisation?

Any defence contractor or subcontractor whose contract includes DFARS 252.204-7012 and who handles CUI must implement Rev. 2, document it in a system security plan and post a self-assessment score in SPRS under DFARS 252.204-7019. This applies right through the supply chain, including UK and other non-US suppliers. Organisations pursuing CMMC Level 2 are assessed against the same 110 requirements.

It is usually required by customers, partners or schemes rather than by law.

Issued by: National Institute of Standards and Technology (NIST)
Published: February 2020, updated January 2021
Status: Superseded by NIST SP 800-171 Rev. 3 (May 2024), but still the version the DoD requires
Requirements: 110 security requirements in 14 families
Contract basis: DFARS 252.204-7012, with DoD class deviation 2024-O0013 fixing the version at Rev. 2
Assessment route: DoD Assessment Methodology self-assessment scored in SPRS, or CMMC Level 2 assessment
Applies to: DoD contractors and subcontractors that handle CUI
Type: Standard (contractual)
Region: United States, US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

NIST SP 800-171 Rev. 2 is mapped in OneClickComply's control library and available on request, so you can work against the 110 requirements alongside frameworks you already use, such as ISO 27001 or Cyber Essentials. Once enabled, automated evidence collection, continuous monitoring and AutoComplete policy generation support your system security plan and plan of action, and our in-house audit team can help you prepare a credible SPRS score.

Requirements covered

110 security requirements (3.1.1 to 3.14.7) in 14 families, from Access Control (22 requirements) to System and Information Integrity (7), plus assumed non-federal organisation (NFO) controls in Appendix E.

Already working towards another framework?

ISO 270019% of NIST 800-171 Rev. 2 overlaps
SOC 266% of NIST 800-171 Rev. 2 overlaps
NIST CSF52% of NIST 800-171 Rev. 2 overlaps
GDPR4% of NIST 800-171 Rev. 2 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual NIST 800-171 Rev. 2 vs. OneClickComply

Manual NIST 800-171 Rev. 2

Tracking 110 requirements and 320 assessment objectives in spreadsheets
Writing and maintaining a system security plan by hand
Chasing screenshots for MFA, logging and encryption evidence
Guessing whether your SPRS score would survive a DoD review
Duplicating work for CMMC, ISO 27001 and customer questionnaires

With OneClickComply

Requirements tracked centrally with clear ownership and status
Policies generated from your real environment to support the SSP
Evidence collected automatically from connected tools
Expert guidance from our in-house audit team before you score
One control set mapped across frameworks, so evidence is reused

Capabilities

Everything you need for NIST 800-171 Rev. 2

All 110 Rev. 2 requirements mapped to controls you can track by family

Automated evidence collection from cloud, identity and device tools

AutoComplete policies to support your system security plan

Continuous monitoring with alerts when CUI controls drift

OneClickFix for supported misconfigurations, logged as evidence

Evidence reused across CMMC, ISO 27001 and Cyber Essentials

How it works

Three steps to NIST 800-171 Rev. 2 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-171 Rev. 2 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-171 Rev. 2-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

NIST SP 800-171 Rev. 2 requirements

All 110 NIST SP 800-171 Rev. 2 security requirements across the 14 families; titles are accurate short forms, as the official text states each requirement as a full sentence.

Reference	Requirement
3.1.1	Limit system access to authorised users, processes and devices
3.1.2	Limit system access to permitted transactions and functions
3.1.3	Control the flow of CUI
3.1.4	Separation of duties
3.1.5	Least privilege
3.1.6	Non-privileged accounts for non-security functions
3.1.7	Prevent and audit privileged functions by non-privileged users
3.1.8	Limit unsuccessful logon attempts
3.1.9	Privacy and security notices
3.1.10	Session lock with pattern-hiding displays
3.1.11	Automatic session termination
3.1.12	Monitor and control remote access sessions
3.1.13	Cryptographic protection of remote access sessions
3.1.14	Route remote access through managed access control points
3.1.15	Authorise remote privileged commands and security-relevant access
3.1.16	Authorise wireless access
3.1.17	Protect wireless access with authentication and encryption
3.1.18	Control connection of mobile devices
3.1.19	Encrypt CUI on mobile devices
3.1.20	Control connections to external systems
3.1.21	Limit portable storage use on external systems
3.1.22	Control CUI on publicly accessible systems
3.2.1	Security awareness of risks and applicable policies
3.2.2	Role-based security training
3.2.3	Insider threat awareness
3.3.1	Create and retain system audit logs
3.3.2	Trace actions to individual users
3.3.3	Review and update logged events
3.3.4	Alert on audit logging process failure
3.3.5	Correlate audit record review, analysis and reporting
3.3.6	Audit record reduction and report generation
3.3.7	Authoritative time source for timestamps
3.3.8	Protect audit information and tools
3.3.9	Limit management of audit logging to privileged users
3.4.1	Baseline configurations and system inventories
3.4.2	Security configuration settings
3.4.3	Track, review and approve system changes
3.4.4	Security impact analysis of changes
3.4.5	Access restrictions for change
3.4.6	Least functionality
3.4.7	Restrict nonessential programs, functions, ports and services
3.4.8	Application execution policy (deny-by-exception or permit-by-exception)
3.4.9	Control and monitor user-installed software
3.5.1	Identify users, processes and devices
3.5.2	Authenticate users, processes and devices
3.5.3	Multi-factor authentication
3.5.4	Replay-resistant authentication
3.5.5	Prevent reuse of identifiers
3.5.6	Disable identifiers after inactivity
3.5.7	Password complexity
3.5.8	Prohibit password reuse
3.5.9	Temporary passwords with immediate change
3.5.10	Store and transmit only cryptographically protected passwords
3.5.11	Obscure authentication feedback
3.6.1	Operational incident-handling capability
3.6.2	Track, document and report incidents
3.6.3	Test incident response capability
3.7.1	Perform system maintenance
3.7.2	Control maintenance tools, techniques and personnel
3.7.3	Sanitise equipment removed for off-site maintenance
3.7.4	Check maintenance media for malicious code
3.7.5	Multi-factor authentication for non-local maintenance
3.7.6	Supervise maintenance personnel without access authorisation
3.8.1	Protect system media containing CUI
3.8.2	Limit access to CUI on system media
3.8.3	Sanitise or destroy media before disposal or reuse
3.8.4	Mark media with CUI markings and distribution limits
3.8.5	Control access to media during transport
3.8.6	Cryptographic protection of CUI on digital media in transport
3.8.7	Control use of removable media
3.8.8	Prohibit portable storage devices with no identifiable owner
3.8.9	Protect confidentiality of backup CUI
3.9.1	Screen individuals before granting access
3.9.2	Protect CUI during personnel terminations and transfers
3.10.1	Limit physical access to systems and equipment
3.10.2	Protect and monitor the physical facility
3.10.3	Escort and monitor visitors
3.10.4	Maintain physical access audit logs
3.10.5	Control and manage physical access devices
3.10.6	Safeguard CUI at alternate work sites
3.11.1	Periodically assess risk
3.11.2	Scan for vulnerabilities
3.11.3	Remediate vulnerabilities
3.12.1	Periodically assess security controls
3.12.2	Plans of action to correct deficiencies
3.12.3	Monitor security controls on an ongoing basis
3.12.4	System security plans
3.13.1	Monitor, control and protect communications at system boundaries
3.13.2	Secure architectural designs and engineering principles
3.13.3	Separate user functionality from system management
3.13.4	Prevent unauthorised information transfer via shared resources
3.13.5	Subnetworks for publicly accessible components
3.13.6	Deny network traffic by default
3.13.7	Prevent split tunnelling for remote devices
3.13.8	Cryptographic protection of CUI in transmission
3.13.9	Terminate network connections after inactivity
3.13.10	Establish and manage cryptographic keys
3.13.11	FIPS-validated cryptography for CUI
3.13.12	Collaborative computing devices
3.13.13	Control and monitor mobile code
3.13.14	Control and monitor Voice over IP
3.13.15	Protect the authenticity of communications sessions
3.13.16	Protect CUI at rest
3.14.1	Identify, report and correct system flaws
3.14.2	Protection from malicious code
3.14.3	Monitor security alerts and advisories
3.14.4	Update malicious code protection
3.14.5	Periodic and real-time malware scans
3.14.6	Monitor systems to detect attacks
3.14.7	Identify unauthorised use of systems

Always check the official NIST 800-171 Rev. 2 text for the exact wording.

NIST 800-171 Rev. 2 FAQs

What is NIST SP 800-171 Rev. 2?

NIST SP 800-171 Rev. 2 is a US standard from the National Institute of Standards and Technology that defines 110 security requirements for protecting Controlled Unclassified Information in non-federal systems. Published in February 2020 and updated in January 2021, it groups the requirements into 14 families, including access control, audit and accountability, incident response and system and communications protection.

Is NIST 800-171 Rev. 2 still valid now that Rev. 3 exists?

Yes, for DoD contracts. NIST withdrew Rev. 2 when it published Rev. 3 in May 2024, but the Department of Defense issued class deviation 2024-O0013 requiring contractors under DFARS 252.204-7012 to meet Rev. 2 instead. CMMC Level 2 is also built on Rev. 2. Defence suppliers should keep working to Rev. 2 until the DoD formally changes the requirement.

Who must comply with NIST SP 800-171 Rev. 2?

Defence contractors and subcontractors whose contracts include DFARS 252.204-7012 and who process, store or transmit Controlled Unclassified Information must comply. The clause flows down the supply chain, so it can apply to small suppliers and to non-US companies, including UK firms, that handle CUI for US defence programmes.

What happens if a contractor does not comply?

Non-compliance can cost contracts. The DoD can find a contractor in breach of DFARS 252.204-7012, decline to award work where no current SPRS score is posted, or withhold CMMC status. Knowingly misrepresenting compliance has also led to False Claims Act cases brought by the US Department of Justice.

How is NIST 800-171 Rev. 2 compliance assessed?

Most contractors perform a self-assessment using the DoD Assessment Methodology, which starts at 110 points and deducts weighted values for each unmet requirement. The score is posted in the Supplier Performance Risk System (SPRS) under DFARS 252.204-7019. The DoD can also perform Medium or High assessments, and CMMC Level 2 adds formal assessment against the same requirements.

How does NIST 800-171 Rev. 2 relate to CMMC Level 2?

CMMC Level 2 uses the 110 requirements of NIST SP 800-171 Rev. 2 as its practices, so implementing Rev. 2 is the core of CMMC Level 2 readiness. CMMC adds the assessment and certification process, including self-assessment or third-party C3PAO assessment depending on the contract, and annual affirmation of continued compliance.

How does NIST 800-171 Rev. 2 compare with ISO 27001?

They overlap substantially but are not interchangeable. ISO 27001 is a certifiable management system standard with a risk-based Annex A, while NIST 800-171 Rev. 2 prescribes specific safeguards for CUI, such as FIPS-validated encryption and multi-factor authentication. An ISO 27001 certificate does not satisfy DFARS requirements on its own, but much of the evidence can be reused.

Does OneClickComply support NIST SP 800-171 Rev. 2?

NIST SP 800-171 Rev. 2 is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, you can track all 110 requirements, collect evidence automatically and reuse controls from frameworks you already follow. OneClickComply does not issue certifications or post SPRS scores on your behalf.

Related standards

All standards

Get NIST 800-171 Rev. 2 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.