NIST 800-171 Compliance
Implement the gold-standard cybersecurity framework trusted by the federal government. We help you map, implement, and maintain all 110 security requirements.
The 110 NIST 800-171 Controls, by Family
NIST SP 800-171 Rev. 2 contains 110 security requirements split across 14 control families. Here is how the 110 controls break down, and what each family actually asks you to prove.
-
1
3.1 Access Control — 22 controls
Limit system access to authorized users and processes, enforce least privilege, separate duties, control remote access and wireless, and restrict CUI flow between systems.
-
2
3.2 Awareness & Training — 3 controls
Train users and managers on security risks and their specific responsibilities, including insider-threat awareness for anyone handling CUI.
-
3
3.3 Audit & Accountability — 9 controls
Create, protect, retain, and review audit logs so individual user actions can be traced, with alerting on audit process failures.
-
4
3.4 Configuration Management — 9 controls
Maintain baseline configurations and inventories, enforce security settings, control changes, and restrict nonessential software and services.
-
5
3.5 Identification & Authentication — 11 controls
Uniquely identify users and devices, enforce multifactor authentication for privileged and network access, and manage password complexity and reuse.
-
6
3.6 Incident Response — 3 controls
Establish an operational incident-handling capability, test it, and report incidents to internal and external authorities including DoD within 72 hours.
-
7
3.7 Maintenance — 6 controls
Control local and remote maintenance activity, sanitize equipment before off-site repair, and supervise maintenance personnel without required access.
-
8
3.8 Media Protection — 9 controls
Protect, mark, and control CUI on paper and digital media, encrypt media in transit, and sanitize or destroy media before disposal or reuse.
-
9
3.9 Personnel Security — 2 controls
Screen individuals before granting access to CUI, and protect systems during and after personnel termination or transfer.
-
10
3.10 Physical Protection — 6 controls
Limit physical access to facilities and equipment, escort visitors, maintain access logs, and safeguard CUI at alternate and remote work sites.
-
11
3.11 Risk Assessment — 3 controls
Assess risk to operations and assets, scan for vulnerabilities on a defined cadence, and remediate findings according to risk.
-
12
3.12 Security Assessment — 4 controls
Periodically assess controls, develop and maintain the System Security Plan (SSP) and POA&M, and monitor controls on an ongoing basis.
-
13
3.13 System & Communications Protection — 16 controls
Monitor and control communications at boundaries, deny network traffic by default, separate user and management functions, and use FIPS-validated cryptography for CUI.
-
14
3.14 System & Information Integrity — 7 controls
Identify and correct flaws promptly, protect against malicious code, monitor security alerts and advisories, and detect unauthorized use of systems.
Who Needs NIST 800-171?
Why It Matters
Federal Contract Eligibility
NIST 800-171 compliance is required under DFARS for any contractor processing, storing, or transmitting CUI. Stay eligible.
Proven Security Baseline
110 controls covering access control, incident response, system integrity, and more — a comprehensive security foundation.
CMMC Foundation
NIST 800-171 maps directly to CMMC Level 2. Getting compliant now puts you ahead for certification.
How TRNSFRM Gets You There
Comprehensive assessment of your current posture against all 110 NIST 800-171 controls.
CUI scoping — identify where Controlled Unclassified Information lives and flows in your environment.
System Security Plan (SSP) creation documenting your security architecture and control implementations.
Technical remediation for gaps in access control, audit logging, encryption, and incident response.
POA&M development and tracking for any controls not yet fully implemented.
Continuous monitoring and annual reassessment to maintain compliance as your environment evolves.
Frequently Asked Questions
Other frameworks & resources
CMMC Level 2 Definitive Guide
Deep-dive on controls, cost, and process.
CMMC
DoD contractor certification.
ISO 27001
International ISMS certification.
HIPAA
Healthcare PHI protection.
FTC Safeguards
Auto dealer & finance rule.
ITAR
Defense export controls.
Free Compliance Checklist
Score yourself in 10 minutes.
Case Studies
Real certification outcomes.
vCISO Leadership
Strategic security guidance.
“Frameworks like CMMC, NIST, and HIPAA aren't just paperwork — they're the difference between winning the next contract and losing it. We've walked dozens of organizations through certification. Let's talk about your path.”
Jeff Dennis
Founder & CEO, TRNSFRM
Ready to Get Compliant?
No pressure. No sales pitch. Just a conversation with an expert to map out your risks, gaps, and next steps.
Not ready to book? — it's free.