Last reviewed October 13, 2026.
NIST SP 800-171 Rev. 2 defines 110 security requirements for protecting Controlled Unclassified Information (CUI) on contractor systems. DFARS 252.204-7012 requires them in covered DoD contracts, and CMMC Level 2 is built on them. This checklist groups the 110 requirements into their 14 families and explains what each family asks of you.
For each family, plan to show three things: a documented policy or procedure, a working technical or operational control, and evidence that it runs. Assessors check all three against the objectives in NIST SP 800-171A.
The 14 families
AC: Access Control (22 requirements)
Limit system access to authorized users, processes and devices, and limit what they can do. Covers least privilege, remote access, wireless access, mobile devices, session controls and controlling the flow of CUI.
AT: Awareness and Training (3 requirements)
Make sure users know the security risks of their roles, are trained to carry out their duties, and can recognize insider-threat indicators.
AU: Audit and Accountability (9 requirements)
Create and retain system audit logs, tie actions to individual users, protect the logs, and review them. Time-stamped, trustworthy logs are the evidence behind many other requirements.
CM: Configuration Management (9 requirements)
Establish baseline configurations, control and track changes, apply least functionality, and control the software users can install.
IA: Identification and Authentication (11 requirements)
Identify users and devices, authenticate them, and require multi-factor authentication for privileged accounts and for network access. Covers password rules and replay-resistant authentication.
IR: Incident Response (3 requirements)
Have an operational incident-handling capability, track and report incidents, and test the response.
MA: Maintenance (6 requirements)
Perform and control system maintenance, including tools and remote sessions, and sanitize equipment removed for off-site maintenance.
MP: Media Protection (9 requirements)
Protect, mark, control access to, transport and sanitize or destroy media that contains CUI.
PS: Personnel Security (2 requirements)
Screen individuals before granting access to CUI, and protect CUI during personnel actions such as terminations and transfers.
PE: Physical Protection (6 requirements)
Limit physical access to systems and facilities, escort visitors, keep physical access logs, control access devices and safeguard CUI at alternate work sites.
RA: Risk Assessment (3 requirements)
Assess risk periodically, scan for vulnerabilities, and remediate them in line with risk.
CA: Security Assessment (4 requirements)
Assess the controls periodically, develop plans of action for deficiencies, monitor controls continuously, and develop and maintain the system security plan.
SC: System and Communications Protection (16 requirements)
Protect system boundaries, separate public-facing systems, deny network traffic by default, use FIPS-validated cryptography to protect CUI, and protect CUI in transit and at rest.
SI: System and Information Integrity (7 requirements)
Find and fix flaws promptly, protect against malicious code, monitor security alerts and advisories, and monitor systems for attacks and unauthorized activity.
How to use this checklist
- Start with scope. The checklist applies to the systems that store, process or transmit CUI, and to the systems that protect them. Define that boundary first.
- Score honestly. Mark a requirement met only when it is fully implemented and you can show evidence. Partial implementation is not a pass.
- Record the result. Document each requirement in your system security plan and track gaps in a plan of action and milestones. See CMMC POA&M rules for what can and cannot be deferred.
- Turn it into a score. Apply the DoD Assessment Methodology weights to calculate your SPRS score.
Where the controls usually fail
- Multi-factor authentication that covers some accounts but not all privileged and remote access.
- Audit logging that is enabled but not reviewed, or retained for too short a time.
- Encryption that exists but is not FIPS-validated.
- A system security plan that describes the intended design instead of the real environment.
- Unclear scope, so CUI turns up on systems no one planned to protect.
Several families depend on continuous operations, including audit and accountability, incident response, risk assessment and system integrity. Cyberix delivers these through 24/7 monitoring, vulnerability management and incident response, supported by our CMMC and NIST SP 800-171 compliance services. For the wider picture, read our guide to CMMC Level 2 requirements.
The three ways each requirement is checked
NIST SP 800-171A tells assessors to examine, interview and test. Plan your evidence for all three:
- Examine: policies, procedures, system security plan, network and data-flow diagrams, configuration settings, logs and records.
- Interview: system administrators, security staff, HR, facilities and management, who must be able to explain how the controls really work.
- Test: the control in operation, such as a login that requires multi-factor authentication, a blocked connection, or a log entry that appears when an action is taken.
The documents you need on hand
- A system security plan that describes the CUI boundary and how each requirement is met.
- Policies and procedures for each family.
- An asset inventory and network and data-flow diagrams.
- An incident response plan and records of testing it.
- Training records, access reviews, visitor and physical access logs.
- A plan of action and milestones for open items.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
How many requirements are in NIST SP 800-171?
Revision 2 contains 110 security requirements in 14 families. NIST SP 800-171A defines 320 assessment objectives used to determine whether each requirement is met.
Which family has the most requirements?
Access Control, with 22, followed by System and Communications Protection, with 16.
Is NIST SP 800-171 the same as CMMC?
No. NIST SP 800-171 is the set of requirements. CMMC Level 2 is the program that verifies a contractor has implemented them.
Do all 110 requirements apply to my whole company?
They apply to the systems that process, store or transmit CUI and the assets that protect them. Defining a tight boundary around that environment is one of the most effective ways to reduce the work.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.
To turn this checklist into a number, try the free SPRS score calculator. It lists all 110 requirements with their DoD point values.