> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NIST 800-171

> Protect Controlled Unclassified Information (CUI) for US government contractors.

NIST Special Publication 800-171 establishes requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations. It is a mandatory requirement for US government contractors and subcontractors who handle CUI.

## Who needs NIST 800-171?

<CardGroup cols={2}>
  <Card title="Defense contractors" icon="shield-halved">
    Companies in the Defense Industrial Base (DIB) that handle CUI from the Department of Defense.
  </Card>

  <Card title="Government suppliers" icon="building-columns">
    Any non-federal organization that stores, processes, or transmits CUI on behalf of US government agencies.
  </Card>
</CardGroup>

## 14 control families

| Family                                 | Description                                  |
| -------------------------------------- | -------------------------------------------- |
| **Access Control**                     | Limit access to authorized users             |
| **Awareness & Training**               | Security awareness for personnel             |
| **Audit & Accountability**             | Create and review audit logs                 |
| **Configuration Management**           | Establish and maintain system configurations |
| **Identification & Authentication**    | Verify identity of users and devices         |
| **Incident Response**                  | Establish incident handling capability       |
| **Maintenance**                        | Perform system maintenance                   |
| **Media Protection**                   | Protect and sanitize media                   |
| **Personnel Security**                 | Screen individuals before access             |
| **Physical Protection**                | Limit physical access                        |
| **Risk Assessment**                    | Assess operational risks                     |
| **Security Assessment**                | Assess and monitor security controls         |
| **System & Communications Protection** | Protect communications and systems           |
| **System & Information Integrity**     | Identify and manage system flaws             |

## How DSALTA helps

* **110 security requirements** mapped to NIST 800-171 control families
* **Gap assessment** identifying missing controls
* **Evidence collection** automated from integrations
* **Policy templates** aligned with CUI protection requirements
* **Cross-framework mapping** — strong overlap with SOC 2, ISO 27001, and CIS Controls

**5** of DSALTA's automated checks contribute evidence to this framework, drawn from **3** integrations. Browse them in the [Compliance Tests](/tests/overview) catalog. They are linked through the controls each check satisfies, so a single check usually contributes to several frameworks at once — the count is not a list of checks unique to this one.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="How does NIST 800-171 relate to CMMC?" icon="diagram-project">
    CMMC (Cybersecurity Maturity Model Certification) builds on NIST 800-171. CMMC Level 2 aligns directly with NIST 800-171 requirements. Achieving NIST 800-171 compliance prepares you for CMMC Level 2 certification.
  </Accordion>

  <Accordion title="Is self-assessment sufficient?" icon="clipboard-check">
    Currently, self-assessment is accepted, but CMMC 2.0 will require third-party assessments for Level 2 (equivalent to NIST 800-171). Prepare now for the transition.
  </Accordion>
</AccordionGroup>

## Related pages

* [CIS Controls v8](/frameworks/cis-v8/overview)
* [Active Frameworks](/guides/compliance/frameworks-active)