Openlane
NIST 800-171 logo

NIST 800-171 compliance

Track each of the 110 requirements that protect CUI on one record, with the POA&M items and evidence a self-assessment or a C3PAO will read.

No credit card. 30-day free trial.

110 requirements, each with an owner and proof

Give each of the 110 requirements an owner, an implementation narrative, and evidence, so the system security plan describes what your team does.

CUI safeguarding

Track each of the 110 Revision 2 requirements as a control with an owner and a written implementation, and record where CUI lives in your platform and asset inventory.

  • All 14 requirement families
  • CUI systems and assets in the registry

Access control requirements

Attach evidence for least privilege, multifactor authentication, and session controls to the requirements that call for them, and run recurring access reviews to keep it current.

  • Evidence for MFA and session controls (3.5.3, 3.1.11)
  • Recurring access reviews

Audit and accountability

Keep audit log evidence, review records, and retention decisions on the record for the AU family, so a reviewer can see logs were generated, protected, and reviewed.

  • Log review records with dates
  • Retention decisions documented

Configuration and integrity

Document configuration baselines and change control as controls, and attach the change records and integrity check results that show them operating.

  • Baseline and change control evidence
  • Integrity checks recorded as evidence

Incident response

Keep incident procedures as policies, track each incident and its remediation with an owner and a date, and record lessons learned against the requirement.

  • Incident records with owners and dates
  • Procedures linked to the IR requirements

CMMC Level 2 readiness

Track implementation status for each requirement to inform your SPRS self-assessment, keep POA&M items with milestones, and organize evidence the way a C3PAO will ask for it.

  • Implementation status per requirement
  • POA&M items with milestones
  • Evidence organized per requirement
Part of Compliance

Know where your 110 requirements stand

Give every requirement an owner, an implementation, and evidence before your next self-assessment.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

NIST 800-171 basics

What is NIST 800-171?

NIST Special Publication 800-171 sets security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems. Revision 2 contains 110 requirements derived from NIST 800-53 and is the basis for CMMC Level 2. Revision 3, published in May 2024, restructures the requirements; check your contract for which revision applies.

What is Controlled Unclassified Information (CUI)?

CUI is unclassified information that federal law, regulation, or government-wide policy requires to be safeguarded or dissemination-controlled. Examples include export-controlled technical data, certain personally identifiable information, and controlled technical information on defense contracts. CUI is marked with designation indicators defined by the CUI Registry.

Who needs to comply with NIST 800-171?

Any organization that processes, stores, or transmits CUI on behalf of the federal government. In practice that means defense contractors and subcontractors in the Defense Industrial Base and other organizations whose federal contracts involve CUI. The obligation comes through the contract, such as DFARS 252.204-7012.

What are the 14 requirement families?

Revision 2 organizes its 110 requirements into 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

CMMC and assessment

What is the relationship between NIST 800-171 and CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's mechanism for verifying that contractors meet NIST 800-171. CMMC Level 2 maps to the 110 Revision 2 requirements. Depending on the contract, Level 2 is met by a self-assessment or by an assessment from a CMMC Third-Party Assessment Organization (C3PAO).

What is the Supplier Performance Risk System (SPRS)?

SPRS is the DoD system where contractors submit their NIST 800-171 self-assessment score. The Basic Assessment scoring method starts at 110 and deducts points for each unimplemented requirement. The score must be current when you bid and updated when your implementation status changes.

What is a System Security Plan (SSP) for 800-171?

An SSP documents how your organization implements each of the 110 requirements: the system boundary, where CUI lives, the implementation of each requirement, and any planned or compensating controls. It is required for CMMC assessments and must be kept current.

What happens if you cannot implement all requirements?

Document the gap in a Plan of Action and Milestones (POA&M) with the proposed remediation, the timeline, and any compensating controls. CMMC allows POA&Ms only for certain requirements and for a limited period, so an open gap can affect contract awards and assessment results.

Openlane for NIST 800-171

How does Openlane help with NIST 800-171 compliance?

Openlane gives each of the 110 requirements an owner, an implementation narrative, and evidence, on one record that also holds your risks and open items. Your self-assessment and a C3PAO assessment read the same source; the result is theirs to determine.

Can Openlane help prepare for a CMMC assessment?

Openlane maps the 110 requirements to CMMC Level 2 practices, keeps the implementation narrative and evidence for each on one record, and tracks POA&M items with owners and dates. Your evidence and SSP inputs are organized before the C3PAO arrives; the assessment result is theirs to determine.

Does Openlane calculate SPRS scores?

Openlane does not calculate the score. Track implementation status for each of the 110 requirements to inform your SPRS self-assessment, then compute and submit the score through the DoD assessment methodology. The record shows which requirements are implemented and which carry an open POA&M item.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection