XL EagleNIST SP 800-171 (NIST Special Publication 800-171)
NIST SP 800-171 stands for NIST Special Publication 800-171. NIST SP 800-171 is a publication from the National Institute of Standards and Technology that lists security requirements for protecting Controlled Unclassified Information (CUI) on non-federal systems. Revision 2 contains 110 requirements covering things like access control, passwords, training, and incident response.
For defense contractors, DFARS 252.204-7012 requires these protections when you handle covered defense information. DoD has generally kept Revision 2 as the standard for now, even though NIST published Revision 3. Contractors also score themselves and post the score in the Supplier Performance Risk System (SPRS) when required.
Why it matters to a small contractor
If a defense prime sends you drawings, specs, or other files marked CUI, these rules come with them. If your work can be done without receiving CUI, ask the prime to keep it that way. If not, budget for real security work and documentation, not just a checkbox.
Example
A small electrical contractor receives building drawings marked CUI for a base project. They set up a separate secured laptop, multi-factor login, and a written system security plan to meet the requirements.
NIST SP 800-171: common questions
Who needs to comply with NIST 800-171?
Contractors and subcontractors that store, process, or transmit CUI under contracts that require it, especially DoD contracts with DFARS 252.204-7012.
What is an SPRS score?
It is a self-assessment score showing how many NIST SP 800-171 requirements you have met, posted in DoD's Supplier Performance Risk System.
Want the contract without the paperwork? Send XL Eagle your price on an open government job. We write and submit the bid under our registrations, free to you. Find open jobs →