NIST 800-171 Controls Explained

NIST Special Publication 800-171 Rev 2 contains 110 security requirements organized into 14 families. Each family covers a specific security domain. Each requirement has a unique identifier in the format 3.X.Y where X is the family number and Y is the practice number within that family.

The companion document, NIST 800-171A, contains the assessment objectives. Each requirement breaks down into 1-7 objectives that you must satisfy individually to claim the requirement is met. There are roughly 320 objectives total across the 110 practices.

Understand the structure before you start scoping. Practices map to objectives. Objectives map to evidence. Evidence maps to systems. Get the chain right and your CMMC assessment goes smoothly.

Access Control (3.1) has 22 practices. It is the largest family and covers who can access what, how, and from where. Practices range from basic (3.1.1: limit access to authorized users) to advanced (3.1.20: verify external connections).

Identification and Authentication (3.5) has 11 practices and works hand-in-hand with AC. The flagship practice is 3.5.3, which requires multi-factor authentication for privileged accounts and for any access to systems handling CUI. SMS-based MFA does not satisfy this requirement under modern guidance.

Implementation typically involves:

• An identity provider (Okta, Entra ID, JumpCloud) with MFA enforced
• Role-based access control with documented role definitions
• Privileged access management for admin accounts
• Session timeout and lockout policies
• Password complexity meeting current NIST 800-63 guidance

If you only fix 5 things in your environment, fix MFA, RBAC, session timeouts, account lockout, and password policy alignment to 800-63B.

Audit and Accountability (3.3) has 9 practices. The core requirements: generate audit logs for security-relevant events, retain them long enough for investigations (90 days minimum, often 1 year), protect them from tampering, and review them regularly.

Configuration Management (3.4) has 9 practices covering baselines, change control, software inventory, and least functionality. The most overlooked is 3.4.1, which requires you to maintain baseline configurations for all in-scope systems. A baseline is a documented hardened image you build from.

Maintenance (3.7) has 6 practices on system maintenance procedures, controlling who performs maintenance, and sanitizing media before disposal. The wrinkle here is third-party maintenance. If a vendor RMA-replaces a hard drive, you need procedures for what happens to the old drive (sanitize or destroy, never return without sanitization).

Implement a SIEM, build CIS-benchmarked baselines, and maintain a software inventory. Those three close most AU/CM/MA gaps.

The remaining 9 families cover specialized domains. Quick tour:

• Awareness and Training (3.2): 3 practices on annual training and insider threat awareness
• Incident Response (3.6): 3 practices on detection, response, and reporting
• Media Protection (3.8): 9 practices on labeling, transport, and sanitization of media containing CUI
• Personnel Security (3.9): 2 practices on screening and termination procedures
• Physical Protection (3.10): 6 practices on facility access, visitor logs, and physical security of CUI assets
• Risk Assessment (3.11): 3 practices on regular risk assessments and vulnerability scanning
• Security Assessment (3.12): 4 practices on assessing your own controls and having an assessment plan
• System and Communications Protection (3.13): 16 practices including FIPS cryptography, network boundary controls, and DNS protections
• System and Information Integrity (3.14): 7 practices on flaw remediation, malicious code protection, and security alerts

SC and SI together account for 23 practices. They cover most of your network and endpoint security stack. Skimping here is the biggest source of failed assessments.

If you are starting from a partial NIST 800-171 implementation, sequence remediation in this order:

1. Scope: Identify your CUI boundary. Without this, no other work matters.
2. Identity: MFA, RBAC, identity provider. AC and IA families.
3. Cryptography: FIPS-validated modules at rest and in transit. SC family.
4. Logging: SIEM ingesting from in-scope systems. AU family.
5. Baselines: CIS-benchmarked images and change control. CM family.
6. Documentation: SSP, POA&M, and policies. CA family.
7. Training and IR: Annual training, IR plan, tabletop exercise. AT and IR families.

Track your progress with the SPRS calculator. Each closed practice lifts your score by 1, 3, or 5 points depending on weight. Watch the trajectory month over month and you will know if you are on track for assessment.