Enforcement of defense cybersecurity rules shifted from promise to practice in late 2025. The Cybersecurity Maturity Model Certification (CMMC) Final Rule took effect on November 10, 2025. That shift ended a decade of contractors promising compliance with federal cybersecurity rules and replaced it with verified proof.
NIST SP 800-171 sits at the center of that change. It is the technical standard that spells out how a non-federal organization protects Controlled Unclassified Information (CUI), and it is not a separate requirement from CMMC Level 2. It is the actual content of Level 2. CMMC Level 2 consists of 110 requirements that correspond with the requirements found in NIST SP 800-171A. Any organization in the defense supply chain handling CUI, from small manufacturers to Bay Area technology firms supporting Department of Defense (DoD) programs, now works toward the same 110-control baseline whether the path chosen is self-assessment or independent certification. This piece lays out what those controls cover, how Level 2 certification maps onto them, and where a forthcoming revision changes the picture.
What Is NIST SP 800-171 and Who Needs It?
NIST SP 800-171 defines security requirements for protecting Controlled Unclassified Information in nonfederal systems. The standard applies to contractors, subcontractors, and suppliers that store, process, or transmit CUI outside of a federal government network. That reach extends well beyond prime defense contractors to engineering firms, software vendors, and research organizations that touch defense-related data as part of a contract.
The underlying contract clause, DFARS 252.204-7012, mandates protecting Controlled Unclassified Information to the NIST SP 800-171 standard, reporting a cyber incident within 72 hours, and flowing the obligation down to subcontractors. That clause has applied to covered defense contracts for years. What changed with the CMMC Final Rule is verification: contracting officers can now require proof rather than a signed assurance.
The 110 Controls Across 14 Families
NIST SP 800-171 Revision 2 contains 110 security requirements organized across 14 control families. Each family groups related technical and procedural requirements under one security topic, and the distribution across families is far from even.
The 14 families include:
- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical Protection
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity
Access Control carries 22 requirements and governs who can reach systems, networks, and CUI, covering account management, role-based permissions, and remote access restrictions. It stands as the largest family in the standard. Other families run far smaller. Awareness and Training, for example, covers only a handful of requirements focused on making staff aware of handling obligations and risk. That unevenness matters for planning, since a gap assessment weighted toward the larger families usually surfaces the most work.
How NIST SP 800-171 Maps to CMMC Level 2
CMMC organizes defense cybersecurity obligations into three tiers, scaled to the sensitivity of information handled.
- Level 1 applies to organizations handling only Federal Contract Information and relies on a smaller set of basic safeguarding practices.
- Level 2 applies to organizations handling Controlled Unclassified Information and requires full implementation of the NIST SP 800-171 control set.
- Level 3 adds a further layer of enhanced requirements drawn from a companion NIST publication, aimed at information facing advanced persistent threats.
Level 2 requires implementation of all 110 NIST SP 800-171 controls, most commonly verified by a certified third-party assessment organization on a three-year cycle. That assessment covers the 110 cybersecurity requirements referenced in DFARS 252.204-7012, along with a select set of enhanced requirements for organizations at Level 3. There is no separate Level 2 control list sitting apart from NIST SP 800-171. Certification confirms that the 110 requirements are actually in place rather than introducing new ones.
The rollout is phased rather than immediate. The rule implementing the program rolls out in four phases through 2028. The first phase authorizes contracting officers to require Level 1 and Level 2 self-assessments, while program managers retain discretion to require an independent assessment for Level 2. Later phases progressively close that discretion and make third-party verification standard for most CUI-handling contracts. Organizations counting on self-assessment as a long-term strategy should treat the current window as temporary.
Scoring ties directly back to the 110 controls as well. A self-assessment under the DoD methodology starts at 110 points, with one point awarded for each requirement fully implemented, for a maximum possible score of 110. Deficiencies get documented in a remediation plan with specific milestones. That plan must state the date by which a full score of 110 is expected. Once an organization reaches Conditional Level 2 status through certification, outstanding items generally carry a strict closeout window of roughly six months before the certification lapses.
NIST 800-171 Revision 3: What Changes and Why Revision 2 Still Governs CMMC
NIST SP 800-171 Revision 3 was finalized in May 2024, marking the first major update since Revision 2. Revision 3 reduced the total control count from 110 to 97 and added new control families and organization-defined parameters that did not exist before. On paper that looks like a lighter standard. In practice, several requirements once grouped under policy-and-procedure catch-alls were redistributed into the technical controls themselves, so the actual assessment burden has not dropped by much.
For current certification purposes, the older revision still rules. The CMMC Final Rule under 32 CFR Part 170 references NIST SP 800-171 Revision 2, not Revision 3. A Department of Defense class deviation kept compliance aligned to Revision 2 under DFARS 252.204-7012. Organizations beginning a compliance project today should build against the 110-control, 14-family structure rather than the newer 97-control version, since that remains the version assessors use for Level 2 scoring.
Common Gaps Found During Readiness Work
A few patterns show up repeatedly during gap assessments for small and mid-sized organizations:
- System Security Plans that describe intended controls rather than what is actually configured
- Access Control practices left informal, without documented role-based permissions or periodic review
- Media Protection and asset inventory records that have not kept pace with cloud migration
- Incident Response plans that exist on paper but have never been tested
- Insufficient documentation to support an assessor's evidence requests, even where technical controls are sound
Any one of these gaps can stall certification even when the underlying security posture is reasonably strong, because CMMC Level 2 assessment depends as much on documented evidence as on functioning technology.
Building a Path to Compliance
Full NIST 800-171 compliance touches nearly every function in an organization: information technology, human resources, physical facilities, and vendor management all contribute evidence to a System Security Plan. Mapping the 110 controls against current practices, identifying honest gaps, and building a realistic remediation timeline typically takes several months even for organizations with a mature security program already in place.
A NIST 800-171 compliance consultant brings value in exactly that scoping stage, translating generic control language into specific configuration changes, policies, and evidence an assessor will expect to see. That guidance tends to shorten the distance between a first gap assessment and an audit-ready System Security Plan, and it reduces the odds of discovering a major gap late in the certification process when timelines are tightest.
Moving Toward Certification
NIST SP 800-171 is not a parallel obligation sitting next to CMMC Level 2. It is the control set that Level 2 certification exists to verify, and every one of the 110 requirements carries forward into an assessment whether conducted internally or by an independent assessor. Organizations still treating the two as separate projects tend to waste effort building security programs that do not map cleanly to how an assessor scores them.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in CMMC readiness for small and mid-sized businesses in defense contracting and government suppliers. Our virtual Chief Information Security Officers (vCISOs) and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.
