Get audit-ready for NIST 800-171
NIST SP 800-171 Rev 2 · Protecting CUI
Requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations, aligned with CMMC Level 2.
NIST 800-171What is NIST 800-171?
Requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations, aligned with CMMC Level 2.
Who it applies to
Non-federal organisations holding Controlled Unclassified Information on behalf of a US agency. It reaches private companies through contract clauses, which is why suppliers often meet it before they have heard of it.
How the standard is organised
Security requirements derived from the moderate baseline of SP 800-53 and grouped into families, scoped specifically to protecting CUI in non-federal systems.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
NIST 800-171 on the Bitkosh platform
The 110 NIST 800-171 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 3.13.2Employ architectural designs and principles that promote effective security
Use architecture, software engineering and design principles that promote effective information security.
System and Communications Protection - 3.8.4Mark media with necessary CUI markings and distribution limitations
Label media with required CUI markings and any distribution limitations.
Media Protection - 3.13.14Control and monitor the use of Voice over Internet Protocol (VoIP)
Control and monitor the use of Voice over Internet Protocol technologies.
System and Communications Protection - 3.5.8Prohibit password reuse for a specified number of generations
Block users from reusing a password within a defined number of previous passwords.
Identification and Authentication - 3.4.8Apply deny-by-exception (blacklist) or permit-by-exception (whitelist) policy
Use a deny-by-exception or permit-by-exception policy to control which software may run.
Configuration Management - 3.14.6Monitor systems and inbound/outbound traffic to detect attacks and indicators
Monitor systems, including inbound and outbound traffic, to detect attacks and signs of potential attacks.
System and Information Integrity
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes NIST 800-171, and who does it apply to?
How is NIST 800-171 conformance demonstrated?
How is NIST 800-171 structured?
Ready to get audit-ready for NIST 800-171?
See how the Bitkosh Readiness Platform gets you audit-ready for NIST 800-171 — and the other 47 ready frameworks — from a single control library.