NIST SP 800-171ASupported in OneClickComply

Pass every NIST 800-171A assessment objective with evidence ready

NIST SP 800-171A is the NIST publication that explains how to assess the 110 security requirements in NIST SP 800-171 Rev. 2. Published in June 2018, it splits each requirement into determination statements, 320 assessment objectives in total, and lists the examine, interview and test methods an assessor uses. NIST has since withdrawn it in favour of SP 800-171A Rev. 3, but CMMC still relies on the June 2018 edition.

See the NIST 800-171A requirements

NIST 800-171A Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs NIST 800-171A

Is NIST 800-171A right for your organisation?

Defence contractors and subcontractors that store, process or transmit controlled unclassified information (CUI) need it, because CMMC Level 2 assessments score each requirement against its 800-171A objectives. Internal teams use it for self-assessments and SPRS scoring, and C3PAOs and assessors use it to decide whether each requirement is met. It matters most in the months before a CMMC Level 2 self-assessment or certification assessment.

It is usually required by customers, partners or schemes rather than by law.

Issued by: National Institute of Standards and Technology (NIST)
Published: June 2018
Assesses: NIST SP 800-171 Rev. 2, 110 requirements in 14 families
Assessment objectives: 320 determination statements
Assessment methods: Examine, interview and test
NIST status: Withdrawn 14 May 2024, superseded by SP 800-171A Rev. 3
Still used by: CMMC Level 2 assessments under 32 CFR Part 170
Type: Guidance (contractual)
Region: United States, US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

OneClickComply maps the 320 SP 800-171A assessment objectives in its control library, so you can see which objectives your evidence already covers and where gaps remain. Evidence collected automatically from your connected tools is linked to the objectives it supports, and the same controls count towards NIST 800-171, CMMC and ISO 27001. SP 800-171A support is available on request.

Requirements covered

320 assessment objectives (determination statements) across the 110 NIST SP 800-171 Rev. 2 requirements in 14 families, each with examine, interview and test methods.

Already working towards another framework?

ISO 270015% of NIST 800-171A overlaps
SOC 266% of NIST 800-171A overlaps
NIST CSF43% of NIST 800-171A overlaps
GDPR3% of NIST 800-171A overlaps

Evidence you collect once counts towards every framework it applies to.

Manual NIST 800-171A vs. OneClickComply

Manual NIST 800-171A

Working through 320 objectives in spreadsheets, one determination statement at a time
Chasing screenshots and exports from every system to prove each objective
Guessing what an assessor will want to examine, interview or test
Evidence that goes stale between the self-assessment and the real assessment
Repeating the same work for CMMC, NIST 800-171 and other frameworks

With OneClickComply

Every objective tracked in one place, with clear status per requirement
Evidence gathered from your connected tools and linked to the objectives it proves
Expert guidance from in-house auditors on what each objective expects
Continuous monitoring keeps evidence current and flags drift early
Controls mapped once and reused across CMMC, NIST 800-171 and ISO 27001

Capabilities

Everything you need for NIST 800-171A

All 320 SP 800-171A assessment objectives mapped in the control library

Evidence collected automatically and linked to each assessment objective

Gap view showing which objectives are met, partly met or missing

AutoComplete policies and System Security Plan content built from your environment

Continuous monitoring that alerts you when a control drifts before assessment

Ask an Auditor guidance on how assessors read each objective

How it works

Three steps to NIST 800-171A compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-171A and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-171A-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

NIST SP 800-171A requirements

The 110 NIST SP 800-171 Rev. 2 requirements, with the number of SP 800-171A assessment objectives each contains (320 in total).

Reference	Requirement
3.1.1	Authorized Access Control (6 objectives)
3.1.2	Transaction & Function Control (2 objectives)
3.1.3	Control CUI Flow (5 objectives)
3.1.4	Separation of Duties (3 objectives)
3.1.5	Least Privilege (4 objectives)
3.1.6	Non-Privileged Account Use (2 objectives)
3.1.7	Privileged Functions (4 objectives)
3.1.8	Unsuccessful Logon Attempts (2 objectives)
3.1.9	Privacy & Security Notices (2 objectives)
3.1.10	Session Lock (3 objectives)
3.1.11	Session Termination (2 objectives)
3.1.12	Control Remote Access (4 objectives)
3.1.13	Remote Access Confidentiality (2 objectives)
3.1.14	Remote Access Routing (2 objectives)
3.1.15	Privileged Remote Access (4 objectives)
3.1.16	Wireless Access Authorization (2 objectives)
3.1.17	Wireless Access Protection (2 objectives)
3.1.18	Mobile Device Connection (3 objectives)
3.1.19	Encrypt CUI on Mobile (2 objectives)
3.1.20	External Connections (6 objectives)
3.1.21	Portable Storage Use (3 objectives)
3.1.22	Control Public Information (5 objectives)
3.2.1	Role-Based Risk Awareness (4 objectives)
3.2.2	Role-Based Training (3 objectives)
3.2.3	Insider Threat Awareness (2 objectives)
3.3.1	System Auditing (6 objectives)
3.3.2	User Accountability (2 objectives)
3.3.3	Event Review (3 objectives)
3.3.4	Audit Failure Alerting (3 objectives)
3.3.5	Audit Correlation (2 objectives)
3.3.6	Reduction & Reporting (2 objectives)
3.3.7	Authoritative Time Source (3 objectives)
3.3.8	Audit Protection (6 objectives)
3.3.9	Audit Management (2 objectives)
3.4.1	System Baselining (6 objectives)
3.4.2	Security Configuration Enforcement (2 objectives)
3.4.3	System Change Management (4 objectives)
3.4.4	Security Impact Analysis (1 objective)
3.4.5	Access Restrictions for Change (8 objectives)
3.4.6	Least Functionality (2 objectives)
3.4.7	Nonessential Functionality (15 objectives)
3.4.8	Application Execution Policy (3 objectives)
3.4.9	User-Installed Software (3 objectives)
3.5.1	Identification (3 objectives)
3.5.2	Authentication (3 objectives)
3.5.3	Multifactor Authentication (4 objectives)
3.5.4	Replay-Resistant Authentication (1 objective)
3.5.5	Identifier Reuse (2 objectives)
3.5.6	Identifier Handling (2 objectives)
3.5.7	Password Complexity (4 objectives)
3.5.8	Password Reuse (2 objectives)
3.5.9	Temporary Passwords (1 objective)
3.5.10	Cryptographically-Protected Passwords (2 objectives)
3.5.11	Obscure Feedback (1 objective)
3.6.1	Incident Handling (7 objectives)
3.6.2	Incident Reporting (6 objectives)
3.6.3	Incident Response Testing (1 objective)
3.7.1	Perform Maintenance (1 objective)
3.7.2	System Maintenance Control (4 objectives)
3.7.3	Equipment Sanitization (1 objective)
3.7.4	Media Inspection (1 objective)
3.7.5	Nonlocal Maintenance (2 objectives)
3.7.6	Maintenance Personnel (1 objective)
3.8.1	Media Protection (4 objectives)
3.8.2	Media Access (1 objective)
3.8.3	Media Disposal (2 objectives)
3.8.4	Media Markings (2 objectives)
3.8.5	Media Accountability (2 objectives)
3.8.6	Portable Storage Encryption (1 objective)
3.8.7	Removable Media (1 objective)
3.8.8	Shared Media (1 objective)
3.8.9	Protect Backups (1 objective)
3.9.1	Screen Individuals (1 objective)
3.9.2	Personnel Actions (3 objectives)
3.10.1	Limit Physical Access (4 objectives)
3.10.2	Monitor Facility (4 objectives)
3.10.3	Escort Visitors (2 objectives)
3.10.4	Physical Access Logs (1 objective)
3.10.5	Manage Physical Access (3 objectives)
3.10.6	Alternative Work Sites (2 objectives)
3.11.1	Risk Assessments (2 objectives)
3.11.2	Vulnerability Scan (5 objectives)
3.11.3	Vulnerability Remediation (2 objectives)
3.12.1	Security Control Assessment (2 objectives)
3.12.2	Plan of Action (3 objectives)
3.12.3	Security Control Monitoring (1 objective)
3.12.4	System Security Plan (8 objectives)
3.13.1	Boundary Protection (8 objectives)
3.13.2	Security Engineering (6 objectives)
3.13.3	Role Separation (3 objectives)
3.13.4	Shared Resource Control (1 objective)
3.13.5	Public-Access System Separation (2 objectives)
3.13.6	Network Communication by Exception (2 objectives)
3.13.7	Split Tunneling (1 objective)
3.13.8	Data in Transit (3 objectives)
3.13.9	Connections Termination (3 objectives)
3.13.10	Key Management (2 objectives)
3.13.11	CUI Encryption (1 objective)
3.13.12	Collaborative Device Control (3 objectives)
3.13.13	Mobile Code (2 objectives)
3.13.14	Voice over Internet Protocol (2 objectives)
3.13.15	Communications Authenticity (1 objective)
3.13.16	Data at Rest (1 objective)
3.14.1	Flaw Remediation (6 objectives)
3.14.2	Malicious Code Protection (2 objectives)
3.14.3	Security Alerts & Advisories (3 objectives)
3.14.4	Update Malicious Code Protection (1 objective)
3.14.5	System & File Scanning (3 objectives)
3.14.6	Monitor Communications for Attacks (3 objectives)
3.14.7	Identify Unauthorized Use (2 objectives)

Always check the official NIST 800-171A text for the exact wording.

NIST 800-171A FAQs

What is NIST SP 800-171A?

NIST SP 800-171A is the assessment guide for NIST SP 800-171 Rev. 2. Published by NIST in June 2018, it turns each of the 110 security requirements for protecting controlled unclassified information into specific determination statements, called assessment objectives, 320 in total. For each requirement it also lists the examine, interview and test methods and the objects an assessor might review, so organisations and assessors can judge consistently whether a requirement is satisfied.

What is the difference between NIST 800-171 and 800-171A?

NIST SP 800-171 says what you must do; SP 800-171A says how that is checked. SP 800-171 Rev. 2 contains the 110 security requirements for protecting CUI. SP 800-171A breaks those requirements into 320 assessment objectives and describes the methods used to assess them. You implement the controls in 800-171 and prove them against the objectives in 800-171A.

How many assessment objectives are in NIST 800-171A?

The June 2018 edition of NIST SP 800-171A contains 320 assessment objectives across the 110 requirements of NIST SP 800-171 Rev. 2. Some requirements have a single objective, such as maintaining physical access logs, while others have many, such as restricting nonessential programs, functions, ports, protocols and services, which has 15. Each objective is a determination statement that must be found satisfied.

Is NIST SP 800-171A still used now that Rev. 3 exists?

Yes, for CMMC. NIST withdrew the June 2018 SP 800-171A on 14 May 2024 and replaced it with SP 800-171A Rev. 3, which assesses SP 800-171 Rev. 3. However, the CMMC rule at 32 CFR Part 170 incorporates SP 800-171 Rev. 2 and SP 800-171A June 2018 by reference, so defence contractors preparing for CMMC Level 2 still assess against the original 320 objectives.

How does NIST 800-171A relate to CMMC Level 2?

CMMC Level 2 uses NIST SP 800-171A as its assessment method. The CMMC rule points to the June 2018 edition for the assessment objectives, and a requirement is only scored as met when all of its applicable objectives are satisfied. Whether you complete a Level 2 self-assessment or a C3PAO certification assessment, the evidence you gather should be organised against the 320 SP 800-171A objectives.

Who has to comply with NIST SP 800-171A?

No one complies with SP 800-171A directly; it is an assessment guide rather than a set of obligations. Defence contractors bound by DFARS clauses and CMMC Level 2 are assessed using it, so in practice any organisation handling CUI for the US Department of Defense needs to meet its objectives. Assessors and C3PAOs use it to reach their findings.

How long does it take to prepare for an 800-171A based assessment?

It depends on how much of NIST SP 800-171 Rev. 2 you already have in place, how many systems are in scope and how well your evidence is documented. Organisations starting from scratch usually need to implement controls, write a System Security Plan and gather evidence for all 320 objectives, which takes longer than reviewing an existing programme. A gap assessment against the objectives is the best first step.

Does OneClickComply support NIST SP 800-171A?

Yes, on request. NIST SP 800-171A is mapped in OneClickComply's control library, covering the 320 assessment objectives across the 110 NIST SP 800-171 Rev. 2 requirements. Contact us to enable it. Evidence collected from your connected tools links to the objectives it supports and also counts towards CMMC, NIST 800-171 and ISO 27001. OneClickComply does not issue CMMC certifications.

Related standards

All standards

Get NIST 800-171A ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.