NIST 800-171 Compliance: A Step-by-Step Guide

NIST 800-171 compliance means implementing a specific set of security requirements for nonfederal organizations to protect Controlled Unclassified Information (CUI). It also involves documenting that work in a System Security Plan (SSP) and creating a Plan of Action and Milestones (POA&M). The last piece is submitting a score to the Department of Defense Supplier Performance Risk System (SPRS).

Most organizations that seek NIST 800-171 compliance are legally obligated to do so under the Defense Federal Acquisition Regulation Supplement (DFARS). Among other things, the standard imposes strict cybersecurity rules for contractors and subcontractors that provide goods or services to the DoD.

To meet CMMC Level 2 (Self) requirements, federal contractors must conduct a self-assessment against the standard’s requirements and submit an SPRS score to the DoD. However, since SPRS scores are self-attested, the burden of proof sits with the organization rather than with the regulator. If that score doesn’t hold up under an independent audit, the consequences can be costly.

Notably, DFARS assessments still score against NIST 800-171 Rev 2, even though NIST published Rev 3 in 2024.

This guide explains what NIST 800-171 compliance is, why it’s important, and how to achieve it, with step-by-step instructions to comply. For more on what NIST 800-171 is, who it applies to, and how it defines CUI, see our complete guide to NIST 800-171.

What Is NIST 800-171 Compliance?

NIST 800-171 compliance is the point at which a nonfederal organization can prove that it meets the standard’s requirements for protecting Controlled Unclassified Information (CUI). The primary driver of 800-171 compliance is the Cybersecurity Maturity Model Certification (CMMC). This defense program is designed to protect Federal Contract Information (FCI) and CUI received, processed, or stored by U.S. government contractors and subcontractors.

NIST 800-171 compliance is the cybersecurity baseline the Department of Defense requires of contractors that handle Controlled Unclassified Information (CUI). It maps to a Supplier Performance Risk System (SPRS) score, satisfies the NIST SP 800-171 requirement in DFARS clause 252.204-7012, and serves as the technical foundation for CMMC Level 2 certification.

More specifically, covered organizations must adhere to DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. It requires federal contractors and subcontractors to:

• Safeguard covered defense information that resides or transits through covered information systems.
• Apply specified network security requirements
• Report cyber incidents.

The severity of those requirements depends on a few factors, but for most organizations it all comes down to the CMMC.

Free download: Map NIST SP 800-53 controls to NIST CSF 2.0, SOC 2, ISO 27001, NIST 800-171, CMMC, CJIS and HIPAA with the NIST 800-53 Multi-Framework Crosswalk.

How to Become NIST 800-171 Compliant

NIST 800-171 compliance requires several deliverables, each proving a different part of the standard. At the highest level, that includes:

• A scoped CUI environment
• A current System Security Plan (SSP)
• A self-assessment against the DoD methodology
• A calculated SPRS score, posted to SPRS
• A Plan of Action and Milestones (POA&M) for open gaps

The current published version, NIST SP 800-171 Revision 3 (97 requirements across 17 families, published May 2024), does not yet apply to DFARS assessments. Instead, the DoD still uses NIST 800-171 Rev 2 (110 requirements across 14 families).

DoD Class Deviation 2024-O0013 first required contractors under DFARS 252.204-7012 to follow Rev 2 in May 2024. The current class deviation 2026-O0025 carries that requirement with no stated end date. Federal contractors should therefore continue to scope their compliance work against Rev 2’s 110 requirements.

NIST 800-171 Compliance Checklist

Organizations can use the table below as a NIST 800-171 compliance checklist, where each row pairs a deliverable with what “done” looks like.

For most organizations, those deliverables are what drives self-assessments as an ordered workflow. See our NIST 800-171 assessment guide to learn more about scoring.

How to Comply with NIST 800-171: Step-by-Step Guide

NIST 800-171 compliance typically follows an ordered set of steps. Most start with scope, then SSP, then self-assessment, then SPRS, then POA&M, then ongoing maintenance.

Running the steps out of order is the most common reason 800-171 programs stall, so working through them in sequence is the key to success.

Step 1: Scope the CUI Boundary

Map where FCI and CUI is received, processed, and stored across the organization. Remember that scope fails in both directions, and the root cause is usually a missing CUI data-flow analysis.

Isolating CUI in a technically-enforced enclave right-sizes the boundary and cuts remediation effort. For a repeatable way to map that boundary, see our scoping guide.

Step 2: Write the System Security Plan (SSP)

Document how each requirement is implemented, and note any unimplemented requirement for the POA&M.

A credible SSP is current, operational, and backed by evidence, so use NIST’s CUI SSP template for a solid starting point.

Step 3: Self-assess Against the DoD Assessment Methodology

Score the environment starting at 110 points, then deduct for each unmet requirement. The result can be negative, with a floor of -203. Assess honestly, because the score and its evidence must hold up to a DoD review.

Step 4: Submit the Score to SPRS

Enter the assessment date, score, scope, and SSP name, version, and date. The assessment itself happens outside SPRS. Under the codified text of DFARS 252.204-7019, a current score, no more than three years old, is required to be eligible for award. The DFARS overhaul class deviations that contracting officers now use in place of the codified text no longer include that provision.

Step 5: Build the POA&M

Log every gap with an owner, milestones, and a completion date using the NIST CUI POA&M template.

Step 6: Remediate and Maintain

Work the POA&M down, keep the SSP current, and refresh the SPRS score within the three-year window. Compliance is continuous and posture decays when reassessment stops, so reassess as the environment changes.

Challenges with NIST 800-171 Compliance

Compliance gaps recur in a handful of high-weight technical controls. DoD (DIBCAC) field assessments show the same failures again and again, and fixing those first usually improves an SPRS score the fastest.

Self-reported scores often overstate real posture, and the table below lists the top offenders and how to close each one.

Under 32 CFR 170.21, a POA&M is allowed only at or above an 80% score and must close within 180 days. Only 1-point requirements may go on it, apart from a narrow exception for 3.13.11, and six requirements cannot go on a POA&M at all. These requirements are excluded entirely:

• External Connections (AC.L2-3.1.20)
• Control Public Information (AC.L2-3.1.22)
• System Security Plan (CA.L2-3.12.4)
• Escort Visitors (PE.L2-3.10.3)
• Physical Access Logs (PE.L2-3.10.4)
• Manage Physical Access (PE.L2-3.10.5)

Meanwhile, the timeline often runs longer than most teams expect. A gap or self-assessment usually takes four to eight weeks, and modest gaps close in roughly four months. Full end-to-end compliance for a mid-size contractor with real gaps typically runs 12 to 24 months. Most of that time goes to writing the SSP, gathering evidence, and fixing the high-weight technical controls.

The fastest moves are deploying MFA, rolling out endpoint detection and response, running security-awareness training, blocking USB and removable media, and tightening account hygiene. These quick wins buy time while the longer remediation work proceeds.

How to Simplify NIST 800-171 Compliance

Organizations running NIST 800-171 across multiple systems and business units need one place to manage the assessment, evidence, and remediation work.

Isora GRC is the GRC Assessment Platform™ that gives security teams one connected workspace to run assessments, collect evidence, track risks, and prove compliance. It replaces the spreadsheets and stalled enterprise GRC tools that scatter a compliance program across files and inboxes.

Assessment Management

Run the complete 800-171 self-assessment lifecycle in one place, with campaign targeting, live progress, and scoring. Isora’s prebuilt NIST questionnaire library lets teams launch assessments directly, without building the questionnaire first.

Questionnaires and Evidence

Questionnaires and evidence collection let control owners across the organization attach documentation inline, next to the question it supports, in an interface designed for non-technical users.

Risk Register and Remediation

Capture every finding and assign ownership, milestones, and statuses in a risk register with remediation tracking.

Reports and Scorecards

Generate scorecards and drill-down reports from live assessment data so teams can see the gaps across units of work. Isora GRC reports the gaps and posture, but it does not implement controls, calculate or guarantee the official SPRS score, or issue a certification.

See the GRC Assessment Platform in action →

Key Takeaways

NIST 800-171 compliance can be challenging, especially for multi-framework GRC programs.

The steps to CMMC might sound simple: scope the CUI boundary, write the SSP, self-assess against the DoD methodology, and post the score to SPRS. After that, track every gap in a POA&M, then remediate and reassess within the three-year window. But getting scope and version right at the start is key to prevent rework.

Isora GRC is the GRC Assessment Platform™ that simplifies NIST 800-171 compliance for complex organizations.

See Isora GRC in action →

NIST 800-171 Compliance FAQs

How long does it take to become NIST 800-171 compliant?

A gap or self-assessment usually takes four to eight weeks, and organizations with modest gaps can close them in roughly four months. Full end-to-end compliance for a mid-size contractor with real gaps typically runs 12–24 months. Most of that time goes to writing the SSP, gathering evidence, and fixing high-weight technical controls.

How do you become NIST 800-171 compliant?

Compliance follows six steps: scope the CUI boundary, write the System Security Plan, and self-assess against the DoD Assessment Methodology. The organization then posts the resulting score to SPRS, builds a POA&M for every gap, and remediates and reassesses. Compliance is self-attested under DFARS 252.204-7012, so the SPRS score and its supporting evidence must hold up to a DoD audit.

Is there a NIST 800-171 compliance checklist?

Yes. At minimum, compliance requires a scoped CUI environment, a current System Security Plan, and a self-assessment against all 110 Rev 2 requirements. It also requires an SPRS score and a Plan of Action and Milestones (POA&M) covering open gaps. DFARS assessments still use Rev 2 (110 requirements across 14 families), a requirement that DoD class deviation 2026-O0025 now carries.

What is an SSP and a POA&M in NIST 800-171?

The System Security Plan (SSP) documents how the organization implements each 800-171 requirement and the boundary it applies to. The Plan of Action and Milestones (POA&M) lists every unmet requirement with an owner, remediation steps, and a completion date. NIST publishes official CUI templates for both.

How much does NIST 800-171 compliance cost?

There is no published fixed cost, since it scales with scope size and the number of high-weight technical gaps. FIPS-validated cryptography and MFA are the most common of those gaps, and cost also depends on whether the organization builds a dedicated enclave. A technically-enforced enclave that right-sizes scope can materially cut remediation effort. Any specific dollar figure should be treated as unverified.

What are the most-failed NIST 800-171 requirements?

DIBCAC data from 117 High Assessments run from 2019 to 2022 shows that roughly half of assessed contractors failed FIPS-validated cryptography (3.13.11). More than a third failed multi-factor authentication (3.5.3), and audit and accountability controls also rank among the most common failures. FIPS requires a CMVP-validated module running in FIPS mode, and MFA must cover privileged and non-privileged network access to CUI.

Which NIST 800-171 requirements cannot be covered by a POA&M?

Under the CMMC rule (32 CFR 170.21), six requirements cannot be deferred with a POA&M. They are External Connections, Control Public Information, System Security Plan, Escort Visitors, Physical Access Logs, and Manage Physical Access. Beyond those six, only 1-point requirements may go on a POA&M, apart from a narrow exception for 3.13.11. A POA&M is only permitted at or above an 80% score and must be closed within 180 days.

Is NIST 800-171 compliance the same as CMMC certification?

No. NIST 800-171 compliance is self-attested through an SPRS score under DFARS. CMMC Level 2 is the DoD program built on the same 110 requirements. Depending on the contract, it is met by a self-assessment or by an independent C3PAO assessment.

While the Phase 2 suspension ordered by the Department of War CIO on July 13, 2026 lasts, only the self-assessment route may be required. Being “800-171 compliant” is the technical baseline for CMMC Level 2, not a certification in itself.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.