NIST SP 800-171

United States

vRev 3

30 domains

93 controls

Protecting Controlled Unclassified Information in Nonfederal Systems

Verified

NIST SP 800-171 is a compliance framework from United States with 30 domains and 93 controls that map to 190 other frameworks. The largest domains are System and Communications Protection (7 controls), Access Control Assessment (6 controls), NIST SP 800-171: Access Control & Identity (6 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (30)

Access Control

3 controls

Controls in the Access Control domain of NIST SP 800-171 — 3 controls
Code	Title	Description
171-AC-1	Access Control Policy and Procedures	Limit access to authorised users, processes acting on behalf of users, and devices and document the rules that govern th...
171-AC-2	Least Privilege and Separation of Duties	Apply least privilege and separation of duties to user accounts, administrative roles, and system processes that act on...
171-AC-3	Remote Access and Mobile Devices	Authorise, monitor, and control remote access sessions and mobile device connections that handle controlled unclassified...

Access Control Assessment

6 controls

Controls in the Access Control Assessment domain of NIST SP 800-171 — 6 controls
Code	Title	Description
3.1.1	All security policies and operational procedures that are identified in Requirement 3 are: • Documented. • Kept up to date. • In use. • Known to all affected parties	All security policies and operational procedures that are identified in Requirement 3 are: • Documented. • Kept up to da...
3.1.2	Roles and responsibilities for performing activities in Requirement 3 are documented, assigned, and understood	Roles and responsibilities for performing activities in Requirement 3 are documented, assigned, and understood
3.1.20	External Connections Control	Assess that the organization verifies and controls connections to and use of external systems.
A.03.01.01	Account Management Assessment	Assess that the organization defines and manages account types, conditions for group and role membership, account approv...
A.03.01.05	Least Privilege Assessment	Assess that the organization employs the principle of least privilege, allowing only authorized accesses for users and p...
A.03.01.12	Remote Access Assessment	Assess that the organization establishes usage restrictions, configuration and connection requirements, and implementati...

Audit and Accountability

2 controls

Controls in the Audit and Accountability domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-AU-1	Audit Event Capture	Create, protect, and retain system audit records to the extent necessary to enable monitoring, analysis, investigation,...
171-AU-2	Audit Review and Analysis	Review and analyse system audit records at a defined cadence for indications of inappropriate or unusual activity and re...

Audit and Accountability Assessment

3 controls

Controls in the Audit and Accountability Assessment domain of NIST SP 800-171 — 3 controls
Code	Title	Description
3.3.1	SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process	SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecov...
A.03.03.01	Event Logging Assessment	Assess that the organization identifies the types of events that the system is capable of logging, specifies the events...
SP800-171-3.5.2	Authenticate identities before access	Authenticate (or verify) the identities of users, processes, or devices as a prerequisite to allowing access to organiza...

Awareness and Training

1 controls

Controls in the Awareness and Training domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-AT-1	Security Awareness and Role-Based Training	Provide basic security awareness to all users and role-based training to those with significant security responsibilitie...

Configuration Management

2 controls

Controls in the Configuration Management domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-CM-1	Baseline Configuration and Inventory	Establish and maintain baseline configurations and inventories of systems that process, store, or transmit controlled un...
SP800-171-3.5.1	Identify system users, processes, and devices	Identify information system users, processes acting on behalf of users, or devices.

Configuration Management Assessment

4 controls

Controls in the Configuration Management Assessment domain of NIST SP 800-171 — 4 controls
Code	Title	Description
3.4.1	PAN is masked when displayed (the BIN and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can	PAN is masked when displayed (the BIN and last four digits are the maximum number of digits to be displayed), such that...
3.4.6	Least Functionality	Assess that the organization employs the principle of least functionality by configuring organizational systems to provi...
A.03.04.01	Baseline Configuration Assessment	Assess that the organization develops, documents, and maintains under configuration control a current baseline configura...
A.03.04.02	Configuration Settings Assessment	Assess that the organization establishes and documents configuration settings for system components that reflect the mos...

Identification and Authentication

2 controls

Controls in the Identification and Authentication domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-IA-1	Identification and Authentication	Identify users, processes, and devices and authenticate their identities as a prerequisite to allowing access to systems...
171-IA-2	Multi-Factor Authentication	Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privil...

Identification and Authentication Assessment

2 controls

Controls in the Identification and Authentication Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.5.3	Multi Factor Authentication	Assess that the organization uses multi factor authentication for local and network access to privileged accounts and fo...
A.03.05.03	Multi Factor Authentication Assessment	Assess that the organization implements multi factor authentication for access to privileged accounts and for network ac...

Incident Response

2 controls

Controls in the Incident Response domain of NIST SP 800-171 — 2 controls
Code	Title	Description
171-IR-1	Incident Handling Capability	Establish an operational incident handling capability that includes preparation, detection, analysis, containment, recov...
171-IR-2	Incident Reporting	Track, document, and report incidents to designated officials and external authorities as required by contract and regul...

Incident Response Assessment

2 controls

Controls in the Incident Response Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.6.1	Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.	Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclos...
A.03.06.01	Incident Handling Assessment	Assess that the organization implements an incident handling capability that includes preparation, detection and analysi...

Maintenance

1 controls

Controls in the Maintenance domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-MA-1	Maintenance Authorisation and Control	Perform maintenance on systems and require that maintenance activities are authorised, monitored, and conducted by appro...

Maintenance Assessment

1 controls

Controls in the Maintenance Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.07.04	Maintenance Tools Assessment	Assess that the organization approves, controls, and monitors maintenance tools used to maintain the system that process...

Media Protection

1 controls

Controls in the Media Protection domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-MP-1	Media Protection	Protect system media that contain controlled unclassified information during storage, transport, and disposal, including...

Media Protection Assessment

2 controls

Controls in the Media Protection Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.8.3	Media Sanitization	Assess that the organization sanitizes or destroys system media containing CUI before disposal or release for reuse.
A.03.08.03	Media Sanitization Assessment	Assess that the organization sanitizes or destroys system media containing CUI before disposal or release for reuse.

NIST SP 800-171: Access Control & Identity

6 controls

Managing access to information systems (NIST SP 800-171)

Controls in the NIST SP 800-171: Access Control & Identity domain of NIST SP 800-171 — 6 controls
Code	Title	Description
SP800-171-3.5.10	Store and transmit only encrypted passwords	Store and transmit only cryptographically-protected representations of passwords.
SP800-171-3.5.4	Replay-resistant authentication	Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
SP800-171-3.6.1	Operational incident-handling capability	Establish an operational incident-handling capability including preparation, detection, analysis, containment, recovery,...
SP800-171-3.6.2	Track, document, and report incidents	Track, document, and report incidents to appropriate officials and authorities both internal and external to the organiz...
SP800-171-3.6.3	Test incident response capability	Test the organizational incident response capability.
SP800-171-3.7.1	Perform system maintenance	Perform maintenance on organizational information systems.

NIST SP 800-171: Audit & Accountability

5 controls

Audit logging and accountability measures (NIST SP 800-171)

Controls in the NIST SP 800-171: Audit & Accountability domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.13.16	Protect confidentiality of CUI at rest	Protect the confidentiality of CUI at rest.
SP800-171-3.14.1	Identify, report, and correct flaws	Identify, report, and correct information and information system flaws in a timely manner.
SP800-171-3.14.2	Malicious code protection	Provide protection from malicious code at appropriate locations within organizational information systems.
SP800-171-3.14.3	Monitor security alerts and advisories	Monitor information system security alerts and advisories and take appropriate actions in response.
SP800-171-3.14.6	Monitor systems and traffic for attacks	Monitor the information system, including inbound and outbound communications traffic, to detect attacks and indicators...

NIST SP 800-171: Configuration Management

5 controls

Managing system configurations securely (NIST SP 800-171)

Controls in the NIST SP 800-171: Configuration Management domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.12.3	Continuously monitor controls	Monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.
SP800-171-3.13.1	Monitor and protect communications at boundaries	Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of in...
SP800-171-3.13.11	Employ FIPS-validated cryptography	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
SP800-171-3.13.6	Deny network traffic by default	Deny network communications traffic by default and allow network communications traffic by exception (deny all, permit b...
SP800-171-3.13.8	Encrypt CUI in transmission	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protec...

NIST SP 800-171: Incident Response

5 controls

Detecting and responding to security incidents (NIST SP 800-171)

Controls in the NIST SP 800-171: Incident Response domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.11.1	Periodically assess risk	Periodically assess the risk to organizational operations, assets, and individuals resulting from the operation of syste...
SP800-171-3.11.2	Scan for vulnerabilities	Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting...
SP800-171-3.11.3	Remediate vulnerabilities	Remediate vulnerabilities in accordance with assessments of risk.
SP800-171-3.12.1	Periodically assess security controls	Periodically assess the security controls in organizational information systems to determine if the controls are effecti...
SP800-171-3.12.2	Plans of action for deficiencies	Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organi...

NIST SP 800-171: Risk Assessment & Management

5 controls

Identifying and managing cybersecurity risks (NIST SP 800-171)

Controls in the NIST SP 800-171: Risk Assessment & Management domain of NIST SP 800-171 — 5 controls
Code	Title	Description
SP800-171-3.10.1	Limit physical access	Limit physical access to organizational information systems, equipment, and the respective operating environments to aut...
SP800-171-3.10.3	Escort and monitor visitors	Escort visitors and monitor visitor activity.
SP800-171-3.10.6	Safeguard CUI at alternate work sites	Enforce safeguarding measures for CUI at alternate work sites such as telework sites.
SP800-171-3.9.1	Screen individuals before CUI access	Screen individuals prior to authorizing access to information systems containing CUI.
SP800-171-3.9.2	Protect CUI during personnel actions	Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminat...

NIST SP 800-171: System & Communications Protection

6 controls

Protecting systems and communications (NIST SP 800-171)

Controls in the NIST SP 800-171: System & Communications Protection domain of NIST SP 800-171 — 6 controls
Code	Title	Description
SP800-171-3.7.2	Control maintenance tools and personnel	Provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
SP800-171-3.7.5	MFA for nonlocal maintenance	Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and termi...
SP800-171-3.8.1	Protect system media containing CUI	Protect (physically control and securely store) information system media containing CUI, both paper and digital.
SP800-171-3.8.3	Sanitize or destroy media before disposal	Sanitize or destroy information system media containing CUI before disposal or release for reuse.
SP800-171-3.8.6	Encrypt CUI on digital media during transport	Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless...
SP800-171-3.8.7	Control removable media	Control the use of removable media on information system components.

Personnel Security Assessment

2 controls

Controls in the Personnel Security Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.9.2	Personnel Transfer and Termination	Assess that the organization ensures organizational systems containing CUI are protected during and after personnel acti...
A.03.09.02	Personnel Termination Assessment	Assess that on termination of individual employment the organization disables system access, terminates authenticators,...

Physical Protection

1 controls

Controls in the Physical Protection domain of NIST SP 800-171 — 1 controls
Code	Title	Description
171-PE-1	Physical Access Authorisations	Limit physical access to systems, equipment, and operating environments that handle controlled unclassified information...

Physical Protection Assessment

1 controls

Controls in the Physical Protection Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
3.10.6	Alternate Work Site Safeguards	Assess that the organization enforces safeguarding measures for CUI at alternate work sites.

Physical and Environmental Protection Assessment

1 controls

Controls in the Physical and Environmental Protection Assessment domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.10.01	Physical Access Authorization Assessment	Assess that the organization limits physical access to the system, equipment, and the respective operating environments...

Planning

1 controls

Controls in the Planning domain of NIST SP 800-171 — 1 controls
Code	Title	Description
A.03.15.01	System Security Plan Assessment	Assess that the organization develops a system security plan that describes the system boundary, environment of operatio...

Risk Assessment

6 controls

Controls in the Risk Assessment domain of NIST SP 800-171 — 6 controls
Code	Title	Description
171-RA-1	Risk Assessment	Periodically assess risk to systems and the controlled unclassified information they process, store, and transmit, and u...
171-RA-2	Vulnerability Scanning and Remediation	Scan for vulnerabilities in systems and applications at a defined cadence and remediate identified vulnerabilities withi...
3.11.1	Risk Assessments	Assess that the organization periodically assesses the risk to organizational operations, organizational assets, and ind...
3.11.2	Vulnerability Scanning	Assess that the organization scans for vulnerabilities in organizational systems and applications periodically and when...
A.03.11.01	Risk Assessment Process	Assess that the organization periodically assesses the risk to organizational operations, organizational assets, and ind...
A.03.11.02	Vulnerability Monitoring Assessment	Assess that the organization monitors and scans for vulnerabilities in the system and hosted applications on a defined f...

Security Assessment

2 controls

Controls in the Security Assessment domain of NIST SP 800-171 — 2 controls
Code	Title	Description
3.12.1	Security Control Assessment	Assess that the organization periodically assesses the security controls in organizational systems to determine if the c...
A.03.12.01	Security Control Assessments	Assess that the organization periodically assesses the security requirements for organizational systems to determine if...

System and Communications Protection

7 controls

Controls in the System and Communications Protection domain of NIST SP 800-171 — 7 controls
Code	Title	Description
171-SC-1	Boundary Protection	Monitor and control communications at the external boundary of systems and at key internal boundaries that separate cont...
171-SC-2	Encryption of Controlled Unclassified Information	Implement validated encryption to protect the confidentiality of controlled unclassified information in transit and at r...
3.13.11	Cryptographic Protection	Assess that the organization employs FIPS validated cryptography when used to protect the confidentiality of CUI.
3.13.5	Network Segmentation	Assess that the organization implements subnetworks for publicly accessible system components that are physically or log...
3.13.8	Transmission Confidentiality	Assess that the organization implements cryptographic mechanisms to prevent unauthorized disclosure of CUI during transm...
A.03.13.11	Cryptographic Protection of CUI at Rest	Assess that the organization employs FIPS validated cryptography when used to protect the confidentiality of CUI.
SP800-171-3.5.3	Multifactor authentication for privileged/network access	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privile...

System and Information Integrity

6 controls

Controls in the System and Information Integrity domain of NIST SP 800-171 — 6 controls
Code	Title	Description
171-SI-1	Flaw Remediation	Identify, report, and correct system flaws in a timely manner, including operating systems, applications, and firmware c...
171-SI-2	Malicious Code Protection	Provide protection from malicious code at appropriate locations in systems and update protections in response to new thr...
3.14.1	Flaw Remediation	Assess that the organization identifies, reports, and corrects system flaws in a timely manner.
3.14.6	Monitoring for Attacks	Assess that the organization monitors organizational systems including inbound and outbound communications traffic to de...
A.03.14.01	Flaw Remediation Assessment	Assess that the organization identifies, reports, and corrects system flaws in a timely manner.
A.03.14.06	System Monitoring Assessment	Assess that the organization monitors the system to detect attacks and indicators of potential attacks and unauthorized...

Your Compliance Coverage

If you comply with NIST SP 800-171, you already cover:

NIST SP 800-53 Rev 5

40%

37 controls mapped

Compare →

NIST SP 800-207

10%

9 controls mapped

Compare →

ACSC Essential Eight

4 controls mapped

Compare →

+ 187 more: TSA Pipeline Cybersecurity Directives (2%), PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments (2%)

See all 190 mapped frameworks ↓

Maps to 190 other frameworks

93 total controls

NIST SP 800-53 Rev 5

37 source controls mapped|40 target controls covered

40%

NIST SP 800-207

9 source controls mapped|28 target controls covered

10%

ACSC Essential Eight

4 source controls mapped|15 target controls covered

TSA Pipeline Cybersecurity Directives

2 source controls mapped|1 target controls covered

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

2 source controls mapped|2 target controls covered

OWASP Top 10:2025

2 source controls mapped|1 target controls covered

OWASP DevSecOps Maturity Model (DSOMM)

2 source controls mapped|2 target controls covered

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

2 source controls mapped|2 target controls covered

NIST SP 800-146

2 source controls mapped|1 target controls covered

NIST SP 800-145

2 source controls mapped|1 target controls covered

NIST SP 800-144

2 source controls mapped|1 target controls covered

MTCS (Singapore)

2 source controls mapped|2 target controls covered

ISMAP (Japan)

2 source controls mapped|1 target controls covered

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems

2 source controls mapped|3 target controls covered

HITECH Act

2 source controls mapped|2 target controls covered

Ghana Cybersecurity Act

2 source controls mapped|3 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

2 source controls mapped|2 target controls covered

FISMA

2 source controls mapped|2 target controls covered

FedRAMP Rev 5

2 source controls mapped|3 target controls covered

BSI IT-Grundschutz

2 source controls mapped|6 target controls covered

TISAX - Trusted Information Security Assessment Exchange

2 source controls mapped|3 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

2 source controls mapped|2 target controls covered

ISO 27018

2 source controls mapped|2 target controls covered

ISO 27017

2 source controls mapped|2 target controls covered

Belgium CyberFundamentals

2 source controls mapped|6 target controls covered

Annex 11 to EU GMP - Computerised Systems

2 source controls mapped|2 target controls covered

South Korea ISMS-P

2 source controls mapped|2 target controls covered

NIST SP 800-190

2 source controls mapped|2 target controls covered

ISO 22301:2019

2 source controls mapped|2 target controls covered

ISO 31000:2018

2 source controls mapped|1 target controls covered

ISO/IEC 23894:2023

2 source controls mapped|2 target controls covered

ISO/IEC 27010:2015

1 source controls mapped|1 target controls covered

Voluntary Principles on Security and Human Rights (VPs)

1 source controls mapped|1 target controls covered

Virginia CDPA

1 source controls mapped|1 target controls covered

Vietnam PDPD

1 source controls mapped|1 target controls covered

Vietnam Law on Cybersecurity (No. 24/2018/QH14)

1 source controls mapped|1 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

1 source controls mapped|2 target controls covered

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

1 source controls mapped|1 target controls covered

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements

1 source controls mapped|1 target controls covered

Uruguay DPL

1 source controls mapped|1 target controls covered

UK Gambling Commission - Cyber Resilience Requirements

1 source controls mapped|1 target controls covered

UK GDPR (UK General Data Protection Regulation)

1 source controls mapped|1 target controls covered

Turkey KVKK

1 source controls mapped|1 target controls covered

Trinidad and Tobago Data Protection Act 2011

1 source controls mapped|1 target controls covered

Texas Data Privacy Act

1 source controls mapped|1 target controls covered

TEFCA - Trusted Exchange Framework and Common Agreement

1 source controls mapped|1 target controls covered

Tanzania Personal Data Protection Act (Draft)

1 source controls mapped|1 target controls covered

Taiwan PDPA

1 source controls mapped|1 target controls covered

Singapore Cybersecurity Act 2018

1 source controls mapped|1 target controls covered

Protective Security Policy Framework (PSPF) Release 2024

1 source controls mapped|1 target controls covered

PSD2 SCA

1 source controls mapped|2 target controls covered

Qatar DPL

1 source controls mapped|2 target controls covered

Privacy Act 2020

1 source controls mapped|1 target controls covered

Privacy Act 1988 (Australia)

1 source controls mapped|1 target controls covered

POPIA

1 source controls mapped|1 target controls covered

Peru DPL

1 source controls mapped|2 target controls covered

Personal Data Act (personopplysningsloven)

1 source controls mapped|1 target controls covered

PDPA Thailand

1 source controls mapped|1 target controls covered

PDPA Singapore

1 source controls mapped|1 target controls covered

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

1 source controls mapped|1 target controls covered

Pakistan Personal Data Protection Bill 2023

1 source controls mapped|1 target controls covered

OSFI B-13

1 source controls mapped|3 target controls covered

Oregon Consumer Privacy Act

1 source controls mapped|1 target controls covered

Open Banking Security

1 source controls mapped|2 target controls covered

Oman National Cybersecurity Framework

1 source controls mapped|1 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

1 source controls mapped|1 target controls covered

NIST SP 800-122

1 source controls mapped|1 target controls covered

NIS2 Directive Implementing Acts

1 source controls mapped|1 target controls covered

Nigeria Open Banking Regulatory Framework (CBN, 2023)

1 source controls mapped|1 target controls covered

Nigeria Data Protection Regulation (NDPR)

1 source controls mapped|1 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

1 source controls mapped|4 target controls covered

Nebraska Data Privacy Act

1 source controls mapped|4 target controls covered

New Jersey Data Privacy Act

1 source controls mapped|2 target controls covered

New Hampshire Data Privacy Act

1 source controls mapped|1 target controls covered

Nevada Gaming Control Board Cybersecurity Requirements

1 source controls mapped|1 target controls covered

NERC CIP

1 source controls mapped|1 target controls covered

Montana Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Monetary Authority of Singapore Technology Risk Management Guidelines

1 source controls mapped|1 target controls covered

Minnesota Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Mexico LFPDPPP

1 source controls mapped|1 target controls covered

Mauritius DPA

1 source controls mapped|1 target controls covered

Maryland Online Data Privacy Act of 2024

1 source controls mapped|2 target controls covered

Malaysia PDPA 2010

1 source controls mapped|2 target controls covered

Liechtenstein DPA

1 source controls mapped|1 target controls covered

LGPD

1 source controls mapped|1 target controls covered

Ley Orgánica de Protección de Datos Personales (LOPDP)

1 source controls mapped|1 target controls covered

Law No. 172-13 on the Protection of Personal Data

1 source controls mapped|1 target controls covered

Laos Law on Prevention and Combating Cybercrime (2015)

1 source controls mapped|1 target controls covered

South Korea PIPA

1 source controls mapped|2 target controls covered

Kentucky Consumer Data Protection Act

1 source controls mapped|2 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

1 source controls mapped|1 target controls covered

Jamaica Data Protection Act 2020

1 source controls mapped|2 target controls covered

Iowa Consumer Data Protection Act

1 source controls mapped|2 target controls covered

Indonesia PDP Law

1 source controls mapped|2 target controls covered

Indiana Consumer Data Protection Act

1 source controls mapped|1 target controls covered

India DPDP Act

1 source controls mapped|1 target controls covered

India CERT-In Cyber Security Directions 2022

1 source controls mapped|1 target controls covered

IEEE 1686

1 source controls mapped|1 target controls covered

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)

1 source controls mapped|1 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

1 source controls mapped|1 target controls covered

HKMA SPM

1 source controls mapped|1 target controls covered

HKMA Cyber Resilience Assessment Framework (C-RAF)

1 source controls mapped|1 target controls covered

GLBA

1 source controls mapped|2 target controls covered

FIRST CSIRT Services Framework and Standards

1 source controls mapped|1 target controls covered

Family Educational Rights and Privacy Act (FERPA)

1 source controls mapped|1 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

1 source controls mapped|2 target controls covered

ISO/IEC 27400:2022

1 source controls mapped|1 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

1 source controls mapped|3 target controls covered

NIST Cybersecurity Framework 2.0

1 source controls mapped|3 target controls covered

ISO 27019

1 source controls mapped|3 target controls covered

PCI PIN Security

1 source controls mapped|3 target controls covered

SOC for Cybersecurity - Cybersecurity Risk Management Examination

1 source controls mapped|1 target controls covered

Bahrain PDPL

1 source controls mapped|2 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

1 source controls mapped|2 target controls covered

APRA CPS 234

1 source controls mapped|2 target controls covered

ISO 22320:2018

1 source controls mapped|3 target controls covered

API 1164

1 source controls mapped|3 target controls covered

Telecommunications Sector Security Reforms (TSSR)

1 source controls mapped|1 target controls covered

IEC 62443

1 source controls mapped|3 target controls covered

PCI SSF

1 source controls mapped|3 target controls covered

Saudi Arabia PDPL

1 source controls mapped|2 target controls covered

Barbados Data Protection Act 2019

1 source controls mapped|1 target controls covered

ISO 20000-1

1 source controls mapped|1 target controls covered

NIST SP 1800-32

1 source controls mapped|3 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

1 source controls mapped|3 target controls covered

PCI P2PE

1 source controls mapped|3 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

1 source controls mapped|1 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

1 source controls mapped|3 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

1 source controls mapped|1 target controls covered

UK Open Banking Standard

1 source controls mapped|1 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

1 source controls mapped|1 target controls covered

FFIEC IT Examination Handbook

1 source controls mapped|3 target controls covered

EASA Part-IS - Information Security in Aviation

1 source controls mapped|3 target controls covered

ISO 28001:2007 Supply Chain Security Management

1 source controls mapped|1 target controls covered

UK Telecommunications (Security) Act 2021

1 source controls mapped|1 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

1 source controls mapped|2 target controls covered

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

1 source controls mapped|2 target controls covered

AICPA Privacy Management Framework (PMF)

1 source controls mapped|1 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

1 source controls mapped|2 target controls covered

Canada ITSG-33 - IT Security Risk Management

1 source controls mapped|1 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

1 source controls mapped|1 target controls covered

COSO Internal Control - Integrated Framework (2013)

1 source controls mapped|1 target controls covered

APPI

1 source controls mapped|2 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

1 source controls mapped|1 target controls covered

APRA CPS 230 Operational Risk Management

1 source controls mapped|1 target controls covered

SOC 2

1 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

1 source controls mapped|1 target controls covered

ITIL 4

1 source controls mapped|1 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

SLSA

1 source controls mapped|1 target controls covered

SIG (Shared Assessments)

1 source controls mapped|1 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

1 source controls mapped|1 target controls covered

PTES

1 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

1 source controls mapped|1 target controls covered

OWASP SAMM

1 source controls mapped|1 target controls covered

OWASP MASVS

1 source controls mapped|1 target controls covered

OWASP ASVS

1 source controls mapped|1 target controls covered

OpenSSF Scorecard

1 source controls mapped|1 target controls covered

O-RAN WG11 Security Specification

1 source controls mapped|1 target controls covered

NIST SP 800-92

1 source controls mapped|1 target controls covered

NIST SP 800-88

1 source controls mapped|1 target controls covered

NIST SP 800-66

1 source controls mapped|1 target controls covered

NIST SP 800-63-4

1 source controls mapped|1 target controls covered

NIST SP 800-61

1 source controls mapped|1 target controls covered

NIST SP 800-137

1 source controls mapped|1 target controls covered

NIST SP 800-123

1 source controls mapped|1 target controls covered

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)

1 source controls mapped|1 target controls covered

NIST Privacy Framework

1 source controls mapped|1 target controls covered

NAIC Insurance Data Security Model Law (MDL-668)

1 source controls mapped|1 target controls covered

MITRE D3FEND

1 source controls mapped|1 target controls covered

MITRE ATT&CK

1 source controls mapped|1 target controls covered

MDS2 (Medical Device)

1 source controls mapped|1 target controls covered

MARS-E

1 source controls mapped|2 target controls covered

ICH E6(R3) - Good Clinical Practice

1 source controls mapped|1 target controls covered

HL7 FHIR Security Framework

1 source controls mapped|2 target controls covered

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6

1 source controls mapped|1 target controls covered

GHG Protocol

1 source controls mapped|1 target controls covered

FDA 21 CFR Part 11

1 source controls mapped|1 target controls covered

ISO/IEC 27011:2024

1 source controls mapped|1 target controls covered

Canada Artificial Intelligence and Data Act (AIDA)

1 source controls mapped|1 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

1 source controls mapped|1 target controls covered

ISO 27799

1 source controls mapped|1 target controls covered

ISO 27043

1 source controls mapped|1 target controls covered

IEC 62351 - Power Systems Communication Security

1 source controls mapped|1 target controls covered

ISO 13485

1 source controls mapped|1 target controls covered

Sigstore - Software Artifact Signing and Verification

1 source controls mapped|1 target controls covered

ISO/SAE 21434

1 source controls mapped|1 target controls covered

MARS-E - Minimum Acceptable Risk Standards for Exchanges

1 source controls mapped|1 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

1 source controls mapped|1 target controls covered

ISO 13485:2016

1 source controls mapped|1 target controls covered

Compare NIST SP 800-171 with NIST SP 800-53 Rev 5

What is NIST SP 800-171 and who does it apply to?

NIST SP 800-171 is a compliance framework from United States with 30 domains and 93 controls. Protecting Controlled Unclassified Information in Nonfederal Systems It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-171 actually require?

NIST SP 800-171 has 93 controls organised across 30 domains. The largest domains are System and Communications Protection (7 controls), Access Control Assessment (6 controls), NIST SP 800-171: Access Control & Identity (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-171 do I already cover?

NIST SP 800-171 maps to 190 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (40% coverage), NIST SP 800-207 (10% coverage), ACSC Essential Eight (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-171?

Start your NIST SP 800-171 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-171 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 93 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required