NIST SP 800-171

United States

vRev 3

30 domains

88 controls

Protecting Controlled Unclassified Information in Nonfederal Systems

Verified

NIST SP 800-171 is a compliance framework from United States with 30 domains and 88 controls that map to 8 other frameworks. The largest domains are System and Communications Protection (7 controls), NIST SP 800-171: Access Control & Identity (6 controls), NIST SP 800-171: System & Communications Protection (6 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (30)

Access Control

3 controls

Controls in the Access Control domain of NIST SP 800-171 — 3 controls
Code	Title	Description
171-AC-1	Access Control Policy and Procedures	Limit access to authorised users, processes acting on behalf of users, and devices and document the rules that govern th...
171-AC-2	Least Privilege and Separation of Duties	Apply least privilege and separation of duties to user accounts, administrative roles, and system processes that act on...
171-AC-3	Remote Access and Mobile Devices	Authorise, monitor, and control remote access sessions and mobile device connections that handle controlled unclassified...

Access Control Assessment

4 controls

Controls in the Access Control Assessment domain of NIST SP 800-171 — 4 controls
Code	Title	Description
3.1.20	External Connections Control	Assess that the organization verifies and controls connections to and use of external systems.
A.03.01.01	Account Management Assessment	Assess that the organization defines and manages account types, conditions for group and role membership, account approv...
A.03.01.05	Least Privilege Assessment	Assess that the organization employs the principle of least privilege, allowing only authorized accesses for users and p...
A.03.01.12	Remote Access Assessment	Assess that the organization establishes usage restrictions, configuration and connection requirements, and implementati...

Audit and Accountability

2 controls

Controls in the Audit and Accountability domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-AU-1	Audit Event Capture	Create, protect, and retain system audit records to the extent necessary to enable monitoring, analysis, investigation,...
171-AU-2	Audit Review and Analysis	Review and analyse system audit records at a defined cadence for indications of inappropriate or unusual activity and re...

Audit and Accountability Assessment

2 controls

Controls in the Audit and Accountability Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
A.03.03.01	Event Logging Assessment	Assess that the organization identifies the types of events that the system is capable of logging, specifies the events...
SP800-171-3.5.2	Authenticate identities before access	Authenticate (or verify) the identities of users, processes, or devices as a prerequisite to allowing access to organiza...

Awareness and Training

1 controls

Controls in the Awareness and Training domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-AT-1	Security Awareness and Role-Based Training	Provide basic security awareness to all users and role-based training to those with significant security responsibilitie...

Configuration Management

2 controls

Controls in the Configuration Management domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-CM-1	Baseline Configuration and Inventory	Establish and maintain baseline configurations and inventories of systems that process, store, or transmit controlled un...
SP800-171-3.5.1	Identify system users, processes, and devices	Identify information system users, processes acting on behalf of users, or devices.

Configuration Management Assessment

3 controls

Controls in the Configuration Management Assessment domain of NIST SP 800-171 — 3 controls
Code	Title	Description
3.4.6	Least Functionality	Assess that the organization employs the principle of least functionality by configuring organizational systems to provi...
A.03.04.01	Baseline Configuration Assessment	Assess that the organization develops, documents, and maintains under configuration control a current baseline configura...
A.03.04.02	Configuration Settings Assessment	Assess that the organization establishes and documents configuration settings for system components that reflect the mos...

Identification and Authentication

2 controls

Controls in the Identification and Authentication domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-IA-1	Identification and Authentication	Identify users, processes, and devices and authenticate their identities as a prerequisite to allowing access to systems...
171-IA-2	Multi-Factor Authentication	Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privil...

Identification and Authentication Assessment

2 controls

Controls in the Identification and Authentication Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.5.3	Multi Factor Authentication	Assess that the organization uses multi factor authentication for local and network access to privileged accounts and fo...
A.03.05.03	Multi Factor Authentication Assessment	Assess that the organization implements multi factor authentication for access to privileged accounts and for network ac...

Incident Response

2 controls

Controls in the Incident Response domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-IR-1	Incident Handling Capability	Establish an operational incident handling capability that includes preparation, detection, analysis, containment, recov...
171-IR-2	Incident Reporting	Track, document, and report incidents to designated officials and external authorities as required by contract and regul...

Incident Response Assessment

1 controls

Controls in the Incident Response Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.06.01	Incident Handling Assessment	Assess that the organization implements an incident handling capability that includes preparation, detection and analysi...

Maintenance

1 controls

Controls in the Maintenance domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-MA-1	Maintenance Authorisation and Control	Perform maintenance on systems and require that maintenance activities are authorised, monitored, and conducted by appro...

Maintenance Assessment

1 controls

Controls in the Maintenance Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.07.04	Maintenance Tools Assessment	Assess that the organization approves, controls, and monitors maintenance tools used to maintain the system that process...

Media Protection

1 controls

Controls in the Media Protection domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-MP-1	Media Protection	Protect system media that contain controlled unclassified information during storage, transport, and disposal, including...

Media Protection Assessment

2 controls

Controls in the Media Protection Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.8.3	Media Sanitization	Assess that the organization sanitizes or destroys system media containing CUI before disposal or release for reuse.
A.03.08.03	Media Sanitization Assessment	Assess that the organization sanitizes or destroys system media containing CUI before disposal or release for reuse.

NIST SP 800-171: Access Control & Identity

6 controls

Managing access to information systems (NIST SP 800-171)

Controls in the NIST SP 800-171: Access Control & Identity domain of NIST SP 800-171 — 6 controls
Code	Title	Description
SP800-171-3.5.10	Store and transmit only encrypted passwords	Store and transmit only cryptographically-protected representations of passwords.
SP800-171-3.5.4	Replay-resistant authentication	Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
SP800-171-3.6.1	Operational incident-handling capability	Establish an operational incident-handling capability including preparation, detection, analysis, containment, recovery,...
SP800-171-3.6.2	Track, document, and report incidents	Track, document, and report incidents to appropriate officials and authorities both internal and external to the organiz...
SP800-171-3.6.3	Test incident response capability	Test the organizational incident response capability.
SP800-171-3.7.1	Perform system maintenance	Perform maintenance on organizational information systems.

NIST SP 800-171: Audit & Accountability

5 controls

Audit logging and accountability measures (NIST SP 800-171)

Controls in the NIST SP 800-171: Audit & Accountability domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.13.16	Protect confidentiality of CUI at rest	Protect the confidentiality of CUI at rest.
SP800-171-3.14.1	Identify, report, and correct flaws	Identify, report, and correct information and information system flaws in a timely manner.
SP800-171-3.14.2	Malicious code protection	Provide protection from malicious code at appropriate locations within organizational information systems.
SP800-171-3.14.3	Monitor security alerts and advisories	Monitor information system security alerts and advisories and take appropriate actions in response.
SP800-171-3.14.6	Monitor systems and traffic for attacks	Monitor the information system, including inbound and outbound communications traffic, to detect attacks and indicators...

NIST SP 800-171: Configuration Management

5 controls

Managing system configurations securely (NIST SP 800-171)

Controls in the NIST SP 800-171: Configuration Management domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.12.3	Continuously monitor controls	Monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.
SP800-171-3.13.1	Monitor and protect communications at boundaries	Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of in...
SP800-171-3.13.11	Employ FIPS-validated cryptography	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
SP800-171-3.13.6	Deny network traffic by default	Deny network communications traffic by default and allow network communications traffic by exception (deny all, permit b...
SP800-171-3.13.8	Encrypt CUI in transmission	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protec...

NIST SP 800-171: Incident Response

5 controls

Detecting and responding to security incidents (NIST SP 800-171)

Controls in the NIST SP 800-171: Incident Response domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.11.1	Periodically assess risk	Periodically assess the risk to organizational operations, assets, and individuals resulting from the operation of syste...
SP800-171-3.11.2	Scan for vulnerabilities	Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting...
SP800-171-3.11.3	Remediate vulnerabilities	Remediate vulnerabilities in accordance with assessments of risk.
SP800-171-3.12.1	Periodically assess security controls	Periodically assess the security controls in organizational information systems to determine if the controls are effecti...
SP800-171-3.12.2	Plans of action for deficiencies	Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organi...

NIST SP 800-171: Risk Assessment & Management

5 controls

Identifying and managing cybersecurity risks (NIST SP 800-171)

Controls in the NIST SP 800-171: Risk Assessment & Management domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.10.1	Limit physical access	Limit physical access to organizational information systems, equipment, and the respective operating environments to aut...
SP800-171-3.10.3	Escort and monitor visitors	Escort visitors and monitor visitor activity.
SP800-171-3.10.6	Safeguard CUI at alternate work sites	Enforce safeguarding measures for CUI at alternate work sites such as telework sites.
SP800-171-3.9.1	Screen individuals before CUI access	Screen individuals prior to authorizing access to information systems containing CUI.
SP800-171-3.9.2	Protect CUI during personnel actions	Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminat...

NIST SP 800-171: System & Communications Protection

6 controls

Protecting systems and communications (NIST SP 800-171)

Controls in the NIST SP 800-171: System & Communications Protection domain of NIST SP 800-171 — 6 controls
Code	Title	Description
SP800-171-3.7.2	Control maintenance tools and personnel	Provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
SP800-171-3.7.5	MFA for nonlocal maintenance	Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and termi...
SP800-171-3.8.1	Protect system media containing CUI	Protect (physically control and securely store) information system media containing CUI, both paper and digital.
SP800-171-3.8.3	Sanitize or destroy media before disposal	Sanitize or destroy information system media containing CUI before disposal or release for reuse.
SP800-171-3.8.6	Encrypt CUI on digital media during transport	Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless...
SP800-171-3.8.7	Control removable media	Control the use of removable media on information system components.

Personnel Security Assessment

2 controls

Controls in the Personnel Security Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.9.2	Personnel Transfer and Termination	Assess that the organization ensures organizational systems containing CUI are protected during and after personnel acti...
A.03.09.02	Personnel Termination Assessment	Assess that on termination of individual employment the organization disables system access, terminates authenticators,...

Physical Protection

1 controls

Controls in the Physical Protection domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-PE-1	Physical Access Authorisations	Limit physical access to systems, equipment, and operating environments that handle controlled unclassified information...

Physical Protection Assessment

1 controls

Controls in the Physical Protection Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
3.10.6	Alternate Work Site Safeguards	Assess that the organization enforces safeguarding measures for CUI at alternate work sites.

Physical and Environmental Protection Assessment

1 controls

Controls in the Physical and Environmental Protection Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.10.01	Physical Access Authorization Assessment	Assess that the organization limits physical access to the system, equipment, and the respective operating environments...

Planning

1 controls

Controls in the Planning domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.15.01	System Security Plan Assessment	Assess that the organization develops a system security plan that describes the system boundary, environment of operatio...

Risk Assessment

6 controls

Controls in the Risk Assessment domain of NIST SP 800-171 — 6 controls
Code	Title	Description
171-RA-1	Risk Assessment	Periodically assess risk to systems and the controlled unclassified information they process, store, and transmit, and u...
171-RA-2	Vulnerability Scanning and Remediation	Scan for vulnerabilities in systems and applications at a defined cadence and remediate identified vulnerabilities withi...
3.11.1	Risk Assessments	Assess that the organization periodically assesses the risk to organizational operations, organizational assets, and ind...
3.11.2	Vulnerability Scanning	Assess that the organization scans for vulnerabilities in organizational systems and applications periodically and when...
A.03.11.01	Risk Assessment Process	Assess that the organization periodically assesses the risk to organizational operations, organizational assets, and ind...
A.03.11.02	Vulnerability Monitoring Assessment	Assess that the organization monitors and scans for vulnerabilities in the system and hosted applications on a defined f...

Security Assessment

2 controls

Controls in the Security Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.12.1	Security Control Assessment	Assess that the organization periodically assesses the security controls in organizational systems to determine if the c...
A.03.12.01	Security Control Assessments	Assess that the organization periodically assesses the security requirements for organizational systems to determine if...

System and Communications Protection

7 controls

Controls in the System and Communications Protection domain of NIST SP 800-171 — 7 controls
Code	Title	Description
171-SC-1	Boundary Protection	Monitor and control communications at the external boundary of systems and at key internal boundaries that separate cont...
171-SC-2	Encryption of Controlled Unclassified Information	Implement validated encryption to protect the confidentiality of controlled unclassified information in transit and at r...
3.13.11	Cryptographic Protection	Assess that the organization employs FIPS validated cryptography when used to protect the confidentiality of CUI.
3.13.5	Network Segmentation	Assess that the organization implements subnetworks for publicly accessible system components that are physically or log...
3.13.8	Transmission Confidentiality	Assess that the organization implements cryptographic mechanisms to prevent unauthorized disclosure of CUI during transm...
A.03.13.11	Cryptographic Protection of CUI at Rest	Assess that the organization employs FIPS validated cryptography when used to protect the confidentiality of CUI.
SP800-171-3.5.3	Multifactor authentication for privileged/network access	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privile...

System and Information Integrity

6 controls

Controls in the System and Information Integrity domain of NIST SP 800-171 — 6 controls
Code	Title	Description
171-SI-1	Flaw Remediation	Identify, report, and correct system flaws in a timely manner, including operating systems, applications, and firmware c...
171-SI-2	Malicious Code Protection	Provide protection from malicious code at appropriate locations in systems and update protections in response to new thr...
3.14.1	Flaw Remediation	Assess that the organization identifies, reports, and corrects system flaws in a timely manner.
3.14.6	Monitoring for Attacks	Assess that the organization monitors organizational systems including inbound and outbound communications traffic to de...
A.03.14.01	Flaw Remediation Assessment	Assess that the organization identifies, reports, and corrects system flaws in a timely manner.
A.03.14.06	System Monitoring Assessment	Assess that the organization monitors the system to detect attacks and indicators of potential attacks and unauthorized...

Your Compliance Coverage

If you comply with NIST SP 800-171, you already cover:

NIST SP 800-53 Rev 5

40%

35 controls mapped

Compare →

NIST SP 800-207

10%

9 controls mapped

Compare →

ACSC Essential Eight

4 controls mapped

Compare →

+ 5 more: ISO 22301:2019 (2%), ISO 31000:2018 (2%)

See all 8 mapped frameworks ↓

Maps to 8 other frameworks

88 total controls

NIST SP 800-53 Rev 5

35 source controls mapped|35 target controls covered

40%

NIST SP 800-207

9 source controls mapped|28 target controls covered

10%

ACSC Essential Eight

4 source controls mapped|15 target controls covered

ISO 22301:2019

2 source controls mapped|2 target controls covered

ISO 31000:2018

2 source controls mapped|1 target controls covered

ISO/IEC 23894:2023

2 source controls mapped|2 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

ISO 13485:2016

1 source controls mapped|1 target controls covered

Compare NIST SP 800-171 with NIST SP 800-53 Rev 5

What is NIST SP 800-171 and who does it apply to?

NIST SP 800-171 is a compliance framework from United States with 30 domains and 88 controls. Protecting Controlled Unclassified Information in Nonfederal Systems It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-171 actually require?

NIST SP 800-171 has 88 controls organised across 30 domains. The largest domains are System and Communications Protection (7 controls), NIST SP 800-171: Access Control & Identity (6 controls), NIST SP 800-171: System & Communications Protection (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-171 do I already cover?

NIST SP 800-171 maps to 8 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (40% coverage), NIST SP 800-207 (10% coverage), ACSC Essential Eight (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-171?

Start your NIST SP 800-171 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-171 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 88 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required