NIST SP 800-171 Rev. 2 Compliance for Defense Contractors: Requirements, CMMC & Readiness

NIST SP 800-171 Rev. 2 compliance remains important for defense contractors that handle Controlled Unclassified Information (CUI), particularly those preparing for CMMC Level 2. Although NIST SP 800-171 Rev. 3 is now the current NIST publication, the current CMMC Level 2 requirements remain based on NIST SP 800-171 Rev. 2.

For defense contractors and subcontractors, this creates an important distinction: understanding the latest NIST revision is useful, but CMMC readiness still requires organizations to understand and implement the Rev. 2 requirements applicable to the current CMMC program.

This blog explains what NIST SP 800-171 Rev. 2 compliance means, how it connects to CMMC Level 2, what defense contractors need to prepare, and how to build a more structured path toward assessment readiness.

Key Takeaways

• CMMC Level 2: Still aligns with NIST SP 800-171 Rev. 2.
• 110 security requirements: Rev. 2 defines requirements for protecting CUI.
• CUI scope: Determines which systems fall within the assessment boundary.
• Implementation matters: Policies must be supported by operating controls and evidence.
• Continuous readiness: Helps identify and address gaps before a CMMC assessment.

What Is NIST SP 800-171 Rev. 2 Compliance?

NIST SP 800-171 Rev. 2 was developed to help protect Controlled Unclassified Information (CUI) when that information is processed, stored, or transmitted in nonfederal systems and organizations.

For defense contractors, NIST SP 800-171 Rev. 2 compliance means more than having cybersecurity policies on paper. Organizations need to implement the required security practices within systems that handle or protect CUI and be able to demonstrate that those practices are operating effectively.

The requirements cover areas such as access control, authentication, incident response, configuration management, risk assessment, system monitoring, and communications protection.

Importantly, NIST SP 800-171 is not a certification. It defines cybersecurity requirements that organizations implement based on applicable contracts and compliance obligations. For contractors preparing for CMMC Level 2, these requirements form the security foundation that will later be assessed.

NIST SP 800-171 Rev. 2 vs. Rev. 3: Which One Matters for CMMC?

NIST published SP 800-171 Rev. 3 in May 2024, officially superseding Rev. 2. Rev. 3 updates the security requirements and introduces changes to the structure and organization of the publication.

However, defense contractors preparing for CMMC Level 2 still need to pay close attention to Rev. 2. The current CMMC Level 2 requirements are based on the 110 security requirements in NIST SP 800-171 Rev. 2.

For defense contractors, the key is to follow the requirements specified by their contracts and applicable CMMC rules rather than assuming that the newest NIST revision automatically replaces the current CMMC baseline.

Who Needs to Comply with NIST SP 800-171 Rev. 2?

NIST SP 800-171 applies to organizations that process, store, or transmit Controlled Unclassified Information (CUI) in nonfederal systems when the applicable contract or government requirement calls for it.

For the Defense Industrial Base, this can include:

• DoD prime contractors
• Subcontractors
• Manufacturers
• Technology providers
• Engineering firms
• Cloud and service providers supporting defense programs

However, not every defense contractor automatically has the same NIST SP 800-171 obligations. Applicability depends on the contract, the type of information handled, and whether the organization’s systems process, store, or transmit covered defense information or CUI.

What Are the 14 NIST SP 800-171 Rev. 2 Requirement Families?

The 110 security requirements in Rev. 2 are organized into 14 families:

1. Access Control
2. Awareness and Training
3. Audit and Accountability
4. Configuration Management
5. Identification and Authentication
6. Incident Response
7. Maintenance
8. Media Protection
9. Personnel Security
10. Physical Protection
11. Risk Assessment
12. Security Assessment
13. System and Communications Protection
14. System and Information Integrity

Together, these families cover how organizations control access, protect systems, manage incidents, monitor security, and safeguard CUI throughout its lifecycle.

How Does NIST SP 800-171 Rev. 2 Connect to CMMC Level 2?

NIST SP 800-171 Rev. 2 provides the cybersecurity requirements that form the foundation of CMMC Level 2. Organizations at Level 2 are evaluated against the 110 security requirements in Rev. 2 to determine whether appropriate protections for Controlled Unclassified Information (CUI) are in place.

The relationship can be understood simply:

NIST SP 800-171 Rev. 2
Defines the 110 security requirements
↓
NIST SP 800-171A
Provides procedures for assessing those requirements
↓
CMMC Level 2
Uses those requirements to evaluate how effectively an organization protects CUI

An important current development is that the Department suspended CMMC Phase II implementation in July 2026. The program currently remains in Phase I, with NIST SP 800-171 Rev. 2 compliance enforced through self-assessments and select government-led assessments while the broader Phase II rollout remains suspended.

The suspension is part of an ongoing review of the CMMC program rather than a repeal, so defense contractors should continue monitoring official DoD updates for changes to the implementation timeline.  

Under the current Phase I approach, Level 2 organizations may need to complete a self-assessment every three years, submit results to the Supplier Performance Risk System (SPRS), and provide an annual affirmation. Limited Plans of Action and Milestones (POA&Ms) may be permitted for eligible requirements and must be closed within the applicable timeframe.

For a more detailed implementation path, see Akitra’s CMMC Compliance Checklist for Defense Contractors.

NIST SP 800-171 Rev. 2 Readiness Checklist

Preparing for NIST SP 800-171 Rev. 2 and CMMC Level 2 requires more than checking whether policies exist. Organizations need to understand where CUI is located, which systems are in scope, how each requirement is implemented, and what evidence proves that implementation.

1. Identify and Scope CUI

Start by identifying where Controlled Unclassified Information (CUI) is received, stored, processed, and transmitted. This helps determine which systems, applications, users, and assets fall within the assessment scope.

2. Document the Environment

Map the systems, networks, users, vendors, and data flows that support or protect CUI. Clear documentation helps ensure important assets are not missed during readiness preparation.

3. Build and Maintain the SSP

Create and maintain a current System Security Plan (SSP) that describes the system environment, security boundaries, and how applicable security requirements are implemented.

4. Assess the 110 Requirements

Review each NIST SP 800-171 Rev. 2 requirement and determine whether it has been implemented effectively. Identify gaps before the formal CMMC assessment process begins.

5. Collect Supporting Evidence

Maintain evidence that demonstrates how controls operate in practice. This may include access reviews, configuration records, policies, training records, logs, vulnerability results, and incident response documentation.

6. Track and Remediate Gaps

Document eligible unresolved items in a Plan of Action and Milestones (POA&M), assign owners, establish remediation timelines, and track progress until issues are resolved.

7. Maintain Continuous Readiness

Regularly review controls, evidence, the SSP, and changes to the CUI environment. Continuous monitoring helps organizations identify gaps earlier and avoid last-minute preparation before assessments.

For additional implementation context, explore Akitra’s NIST 800-171, CMMC 2.0 & ISO 27001 for Manufacturing resource.
Common NIST SP 800-171 Readiness Mistakes

Even organizations with mature security programs can run into problems during NIST SP 800-171 and CMMC preparation. Common mistakes include:

• Incorrect CUI scoping: Failing to identify all systems, users, and data flows that handle or protect CUI.
• Treating policies as proof: Written policies are not enough if controls are not implemented and supported by evidence.
• Outdated documentation: SSPs, inventories, and control descriptions must reflect the current environment.
• Weak evidence management: Missing or inconsistent evidence can make implemented controls difficult to demonstrate.
• Waiting too long to remediate gaps: Readiness issues are easier to address before the assessment process begins.

How Akitra Supports NIST 800-171 and CMMC Readiness

Akitra Andromeda® helps organizations manage NIST 800-171 and CMMC readiness through centralized control tracking, evidence collection, continuous monitoring, and remediation workflows.

Teams can map requirements, organize supporting evidence, track control gaps, assign remediation owners, and maintain greater visibility into readiness status across the assessment lifecycle.

For broader CMMC implementation support, explore Akitra’s CMMC Compliace resource and related defense contractor content.

Conclusion

NIST SP 800-171 Rev. 2 remains highly relevant for defense contractors preparing for CMMC Level 2. The key is not simply documenting policies, but proving that required security practices are implemented, supported by evidence, and maintained over time.

By defining the CUI environment, maintaining an accurate SSP, assessing the 110 requirements, addressing gaps, and continuously monitoring controls, contractors can build a more structured path toward CMMC readiness.

Security, AI Risk Management, and Compliance with Akitra!

In the competitive landscape of SaaS businesses, trust is paramount amidst data breaches and privacy concerns. Akitra addresses this need with its leading Agentic AI-powered Compliance Automation platform. Our platform empowers customers to prevent sensitive data disclosure and mitigate risks, meeting the expectations of customers and partners in the rapidly evolving landscape of data security and compliance. Through automated evidence collection and continuous monitoring, paired with customizable policies, Akitra ensures organizations are compliance-ready for various frameworks such as SOC 1, SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 9001, ISO 13485, ISO 42001, NIST 800-53, NIST 800-171, NIST AI RMF, FedRAMP, CCPA, CMMC, SOX ITGC, and more such as CIS AWS Foundations Benchmark, Australian ISM and Essential Eight etc. In addition, companies can use Akitra’s Risk Management product for overall risk management using quantitative methodologies such as Factorial Analysis of Information Risks (FAIR) and qualitative methods, including NIST-based for your company, Vulnerability Assessment and Pen Testing services, Third Party Vendor Risk Management, Trust Center, and AI-based Automated Questionnaire Response product to streamline and expedite security questionnaire response processes, delivering huge cost savings. Our compliance and security experts provide customized guidance to navigate the end-to-end compliance process confidently. Last but not least, we have also developed a resource hub called Akitra Academy, which offers easy-to-learn short video courses on security, compliance, and related topics of immense significance for today’s fast-growing companies.

Our solution offers substantial time and cost savings, including discounted audit fees, enabling fast and cost-effective compliance certification. Customers achieve continuous compliance as they grow, becoming certified under multiple frameworks through a single automation platform.

Build customer trust. Choose Akitra TODAY!‍To book your FREE DEMO, contact us right here.  

Frequently Asked Questions