Short answer: NIST SP 800-171 compliance comes down to five steps: (1) find where Controlled Unclassified Information (CUI) lives and draw your boundary, (2) implement the 110 security requirements across 14 families, (3) document them in a System Security Plan (SSP), (4) track any gaps in a plan of action, and (5) score yourself with the DoD Assessment Methodology and post the score in SPRS. The checklist below walks through each step. It’s a planning aid, not a substitute for assessing every requirement and its objectives in NIST SP 800-171A.
Who needs a NIST 800-171 checklist?
Any company whose DoD contract includes DFARS 252.204-7012 and that handles covered defense information, which includes CUI. The clause requires you to implement NIST SP 800-171 (DFARS 7012 explained). Assessment results are recorded in the Supplier Performance Risk System (SPRS) — see what an SPRS score is. CMMC Level 2 is assessed against the same 110 requirements (how CMMC and 800-171 fit together).
DoD contracts require Revision 2 of NIST SP 800-171, not Revision 3 (why). This checklist follows Rev. 2.
Step 1: Scope your CUI environment
Scoping decides how much of your company the 110 requirements apply to. Get it wrong and you either over-spend or leave CUI unprotected.
- List the contracts that include DFARS 252.204-7012 and the CUI they involve (drawings, specifications, technical data)
- Trace how CUI arrives, where it’s stored, who uses it, and where it goes (email, file shares, laptops, removable media, subcontractors)
- Identify every system, application, and cloud service that stores, processes, or transmits CUI, or protects those systems
- Decide whether to protect the whole company or isolate CUI in a smaller enclave
- Confirm cloud services used for CUI meet the FedRAMP Moderate (or equivalent) requirement in DFARS 7012
- Draw a network or data-flow diagram of the boundary
Step 2: Work through the 14 requirement families
The table lists each Rev. 2 family, its requirement count, and the items small contractors most often miss. Use CMMC Level 2 requirements for the plain-English meaning of each family.
| Family | Reqs | Checklist items |
|---|---|---|
| Access Control (AC) | 22 | Accounts limited to authorized users · least privilege · separate admin accounts · session lock · remote access controlled and monitored · wireless and mobile devices controlled · CUI kept off public websites |
| Awareness & Training (AT) | 3 | Security awareness training for all users · role-based training for admins · insider-threat awareness |
| Audit & Accountability (AU) | 9 | Logs created and retained · events traceable to individual users · logs reviewed · alerting on logging failures · time sync · logs protected from tampering |
| Configuration Management (CM) | 9 | Baseline configurations and inventory · change control · least functionality (unneeded ports, services, software disabled) · application allow/deny listing · user-installed software controlled |
| Identification & Authentication (IA) | 11 | Unique IDs · MFA for privileged accounts and network access for all users · replay-resistant authentication · password complexity and reuse rules · passwords stored and sent encrypted |
| Incident Response (IR) | 3 | Incident response capability (plan, roles, contacts) · incidents tracked and reported · response capability tested |
| Maintenance (MA) | 6 | Maintenance performed and controlled · maintenance tools controlled · media sanitized before off-site repair · MFA for remote maintenance · maintenance personnel supervised |
| Media Protection (MP) | 9 | CUI media protected and access limited · media sanitized before disposal or reuse · CUI markings · removable media controlled · encryption for CUI on portable media in transit · backups protected |
| Personnel Security (PS) | 2 | Individuals screened before access · access removed on termination or transfer |
| Physical Protection (PE) | 6 | Physical access limited and monitored · visitors escorted and logged · physical access devices managed · alternate work sites (home offices) safeguarded |
| Risk Assessment (RA) | 3 | Periodic risk assessment · vulnerability scanning · vulnerabilities remediated based on risk |
| Security Assessment (CA) | 4 | Controls assessed periodically · plan of action for deficiencies · controls monitored continuously · System Security Plan developed and kept current |
| System & Communications Protection (SC) | 16 | Boundary protection (firewalls) · deny by default · split tunneling prevented · FIPS-validated encryption for CUI · CUI encrypted in transit · collaborative devices (cameras, microphones) controlled · CUI at rest protected |
| System & Information Integrity (SI) | 7 | Flaws patched on time · malware protection updated · security alerts monitored · systems monitored for attacks and unauthorized use |
| Total | 110 |
For every requirement, ask three questions: Is it implemented? Can we show evidence? Is it written in the SSP? A requirement that’s done but undocumented will be scored as not met.
Step 3: Write the System Security Plan
Requirement 3.12.4 requires a System Security Plan. Without one, you can’t credibly claim any score. A useful SSP covers:
- System boundary, environment, and network or data-flow diagram
- How each of the 110 requirements is implemented (or why it doesn’t apply)
- Roles and responsibilities, including any IT provider
- Connections to other systems and external services
- References to supporting policies and procedures
- A review and update schedule
See SSP & POA&M development for what an assessor expects.
Step 4: Track gaps in a plan of action
Requirement 3.12.2 calls for plans of action to correct deficiencies. For each gap, record:
| Field | Example |
|---|---|
| Requirement | 3.5.3 — multi-factor authentication |
| Gap | MFA not enforced for local administrator logins |
| Planned fix | Deploy MFA for all privileged accounts |
| Owner | IT manager |
| Resources | Licensing, configuration time |
| Target date | Set in your project plan |
| Status | Open / in progress / closed |
Under CMMC, POA&M rules are stricter: only certain lower-weighted requirements can be on a POA&M for conditional Level 2 status, and items must close within 180 days.
Step 5: Score yourself and post it in SPRS
- Assess each requirement using the objectives in NIST SP 800-171A
- Calculate your score with the DoD Assessment Methodology: start at 110 and subtract 1, 3, or 5 points for each requirement not met (the lowest possible score is −203)
- Have the score, SSP date, and plan-of-action completion date posted in SPRS
- Keep the score current (older contracts with DFARS 252.204-7019 require it to be no more than three years old)
Details in What is an SPRS score?.
Step 6: Keep it running
Compliance isn’t a one-time project. Build in:
- Periodic review of the SSP and plan of action
- Log review and vulnerability scanning on a defined schedule
- Annual training and an incident response test
- Flow-down of DFARS 7012 to subcontractors that handle CUI
- A process for reporting cyber incidents to DoD within 72 hours
Frequently Asked Questions
How many requirements are in NIST 800-171?
Revision 2, the version DoD contracts require, has 110 security requirements across 14 families. Revision 3 has 97 requirements across 17 families, but it isn’t yet required by DoD contracts.
Can we be compliant with open items on a plan of action?
Under DFARS 7012, documented gaps are reflected in your SPRS score and your plan of action. Under CMMC Level 2, conditional status requires a score of at least 80% of the maximum, only certain requirements can be on the POA&M, and open items must be closed within 180 days.
How long does NIST 800-171 compliance take?
It depends on your starting point and scope. Small organizations with a narrow CUI boundary and modern cloud tools move fastest. Scoping down to an enclave is often the biggest time saver.
Is a checklist enough to pass an assessment?
No. Assessors evaluate each requirement against its assessment objectives in NIST SP 800-171A and look for evidence. A checklist helps you plan; the SSP, evidence, and a credible score are what hold up.
For the full path from scoping to assessment day, see the CMMC Level 2 Readiness Guide.
How USCIBER can help
A CMMC Readiness Review (from $7,500) runs this checklist against your environment: scope, gap assessment across all 110 requirements, an estimated SPRS score, and a prioritized roadmap. A Compliance Documentation Project produces the SSP, POA&M, and policies. See NIST 800-171 & DFARS compliance for details.
Sources
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- NIST SP 800-171A — Assessing Security Requirements for Controlled Unclassified Information
- DoD — NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- DFARS 252.204-7019 — Notice of NIST SP 800-171 DoD Assessment Requirements
- 32 CFR Part 170 — CMMC Program (eCFR)
This article is general information, not legal advice.