Short answer: NIST SP 800-171 and CMMC aren’t competing standards. NIST SP 800-171 is the list of security requirements for protecting Controlled Unclassified Information (CUI) in contractor systems. CMMC is the Department of Defense program that verifies whether a contractor actually meets those requirements. For CUI, CMMC Level 2 uses the same 110 requirements as NIST SP 800-171 Rev. 2. If you’ve implemented 800-171 properly, you’ve done most of the work CMMC Level 2 checks.
What is NIST SP 800-171?
NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, is a publication from the National Institute of Standards and Technology. Revision 2 contains 110 security requirements in 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
NIST writes the requirements. It doesn’t enforce them, assess contractors, or issue certificates. For a family-by-family walkthrough, see CMMC Level 2 requirements.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) program is codified at 32 CFR Part 170. It sets three levels and defines how each one is assessed:
| CMMC level | Protects | Requirements | Assessment |
|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 requirements from FAR 52.204-21 | Annual self-assessment |
| Level 2 | CUI | 110 requirements of NIST SP 800-171 Rev. 2 | Self-assessment or third-party (C3PAO) assessment, depending on the contract, every 3 years |
| Level 3 | CUI in the highest-priority programs | Level 2 plus 24 selected requirements from NIST SP 800-172 | Government assessment by DCMA DIBCAC |
Every level also requires an annual affirmation in the Supplier Performance Risk System (SPRS) by a senior official of the company. See CMMC Level 1 vs. Level 2 for which one applies to you.
How do they fit together?
Think of it as three layers:
- The contract clause creates the obligation. DFARS 252.204-7012 requires contractors that handle covered defense information (which includes CUI) to implement NIST SP 800-171, report cyber incidents to DoD within 72 hours, and flow the requirements down to subcontractors.
- NIST SP 800-171 defines the requirements. It’s the technical and procedural baseline: what controls must be in place.
- CMMC verifies them. CMMC adds assessment, scoring, and affirmation rules so DoD has confidence the requirements are really implemented, instead of relying on self-attestation alone.
Two more DFARS clauses connect the layers. DFARS 252.204-7019 and 7020 required a current NIST SP 800-171 assessment score in SPRS; in new solicitations, 7019 no longer appears and 7020 is replaced by DFARS 252.240-7997, which covers DoD-led assessments (see what an SPRS score is). DFARS 252.204-7021 is the clause that puts a CMMC level requirement into a contract.
What’s actually different between them?
| NIST SP 800-171 (under DFARS 7012) | CMMC Level 2 | |
|---|---|---|
| Source | NIST publication, required by contract clause | DoD program rule (32 CFR Part 170) |
| Requirements | 110 (Rev. 2) | Same 110 |
| Proof | Self-assessment score in SPRS (Basic), or a DoD Medium/High assessment | Self-assessment or C3PAO assessment, plus annual affirmation |
| Plans of action | Gaps documented in a plan of action | Limited POA&M allowed for conditional status; items must close within 180 days |
| Scoring | DoD Assessment Methodology (−203 to 110) | Same scoring basis |
| Who assesses | You (Basic) or DoD (Medium/High) | You, an authorized C3PAO, or DIBCAC (Level 3) |
The biggest practical difference is verification. Under DFARS 7012 alone, a contractor could document gaps in a plan of action and still report a score. CMMC tightens that: to achieve conditional Level 2 status, you need at least 80% of the possible score, only certain lower-weighted requirements can sit on a POA&M, and open items must close within 180 days.
Where does the CMMC Phase II suspension leave this?
In July 2026, DoD suspended CMMC Phase II, which would have required third-party (C3PAO) Level 2 certification in many contracts starting November 2026 (what the suspension means). The suspension changed the timing of mandatory third-party certification. It didn’t remove NIST SP 800-171.
If your contract includes DFARS 252.204-7012 and you handle CUI, you must still implement the 110 requirements, keep a current SPRS score, and meet any CMMC self-assessment and affirmation requirements in your contract. Check the DoD CIO CMMC page for current program status.
Which revision of NIST 800-171 applies?
NIST published Revision 3 in May 2024, but DoD contracts still require Revision 2. DoD issued a class deviation in May 2024 that keeps DFARS 252.204-7012 tied to Rev. 2, and CMMC Level 2 is assessed against Rev. 2. See NIST SP 800-171 Rev. 3: what changed.
CMMC vs. FedRAMP: what’s the difference?
Contractors often confuse the two because both involve NIST-based controls and DoD data. They cover different things:
| CMMC | FedRAMP | |
|---|---|---|
| Applies to | Defense contractors and subcontractors | Cloud service providers selling to federal agencies |
| Protects | FCI and CUI in contractor systems | Federal data in cloud services |
| Control basis | FAR 52.204-21, NIST SP 800-171, NIST SP 800-172 | NIST SP 800-53 baselines (Low, Moderate, High) |
| Outcome | CMMC status in SPRS | FedRAMP authorization |
They meet in one place: the cloud services you use for CUI. DFARS 252.204-7012 requires that a cloud service provider used to store, process, or transmit covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline, and comply with the clause’s incident reporting, malicious software, media preservation, and damage assessment requirements. DoD CIO issued a memo in December 2023 explaining what “FedRAMP Moderate equivalent” means.
In practice: you don’t get FedRAMP-authorized as a contractor. You choose cloud services (email, file storage, collaboration) that meet the FedRAMP Moderate requirement for CUI, and you document that choice in your System Security Plan.
Frequently Asked Questions
Is CMMC Level 2 the same as NIST 800-171?
The requirements are the same: CMMC Level 2 uses the 110 requirements of NIST SP 800-171 Rev. 2. The difference is how compliance is verified. CMMC adds assessment, POA&M, and affirmation rules that DFARS 7012 alone doesn’t.
If we comply with NIST 800-171, are we CMMC compliant?
You’ve done most of the work. You still need the assessment your contract requires (self or C3PAO), a qualifying score, POA&M items limited to what the rule allows, and the annual affirmation by a senior official in SPRS.
Do we need FedRAMP if we use Microsoft 365 or another cloud for CUI?
You don’t need your own FedRAMP authorization. You need a cloud offering that meets FedRAMP Moderate (or equivalent) for CUI under DFARS 7012, configured correctly, and documented in your SSP. Commercial tiers of popular cloud services often don’t qualify; government-focused tiers are designed for it.
Does CMMC replace DFARS 7012?
No. CMMC sits on top of DFARS 7012. The 7012 obligations, including 72-hour incident reporting and subcontractor flow-down, still apply alongside any CMMC requirement.
How USCIBER can help
USCIBER helps defense contractors treat 800-171 and CMMC as one program: scope where CUI lives, assess the 110 requirements, calculate an honest SPRS score, and build the SSP and POA&M an assessor expects. Start with a CMMC Readiness Review (from $7,500) or a Compliance Documentation Project. USCIBER is a readiness consultant, not a C3PAO, and doesn’t issue certifications.
Sources
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- NIST SP 800-171 Rev. 3 — Final publication
- 32 CFR Part 170 — CMMC Program (eCFR)
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- DoD CIO — CMMC program
- DoD CIO — FedRAMP Moderate Equivalency for Cloud Service Provider’s Cloud Service Offerings (December 2023)
This article is general information, not legal advice.