NIST 800-171 Requirements Checklist: All 110 Rev. 2 Controls, Evidence, SSP & SPRS

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. Informational only — not legal, contractual, or compliance advice.

This article is educational and is not legal, contractual, or compliance advice. CMMC requirements vary by contract, scope, and CUI handling specifics. Consult a CMMC Registered Practitioner (RP/RPO) or qualified attorney before making compliance decisions.

Bottom line, before you scroll. The NIST 800-171 requirements checklist you should be working from for any Department of Defense (DoD) contract that touches Controlled Unclassified Information (CUI) is NIST Special Publication 800-171, Revision 2 — 110 security requirements organized into 14 families. That is the version the Cybersecurity Maturity Model Certification (CMMC) Level 2 still verifies today. We confirmed it by reading the CMMC rule itself at 32 CFR 170.14 — not from a slide deck.

Here is the part most checklists won’t say out loud: the list of 110 is the easy 10%.Anyone can hand you the controls — we’ll give you all 110 below. What decides whether you keep the contract is the evidencebehind each line: the proof an assessor will examine, the owner who can defend it, the score it produces in the Supplier Performance Risk System (SPRS). That gap — between “we have a checklist” and “we can prove it” — is where companies lose months and money.

So this isn’t another wall of bullet points. It’s the working checklist we wish someone had handed us: which version applies to your exact situation, what each of the 14 families has to prove, every one of the 110 requirement IDs, the first piece of evidence to put in the folder, who owns it, the trap that quietly sinks self-assessments, and what to do when the gap is bigger than your team can close.

Which NIST 800-171 checklist should you actually use?

It comes down to one thing: what is driving the requirement. If a DoD contract or flow-down touches CUI, you use the NIST SP 800-171 Rev. 2 evidence checklist (110 requirements). The contract clause then tells you what the checklist has to feed— a SPRS score, a CMMC status, or both.

What we actually verified for this page

We are a trade publication, not the government — your binding obligations come from your contracts, clauses, CUI scope, and official DoD direction.

What a NIST 800-171 requirements checklist actually is

A NIST 800-171 requirements checklist is the working tracker your organization uses to manage implementation of the NIST SP 800-171 security requirements that protect CUI on non-federal systems. For CMMC Level 2 and DoD CUI work today, that tracker should be built on Rev. 2’s 110 requirements and should record evidence, the System Security Plan (SSP) reference, the Plan of Action and Milestones (POA&M) status, the owner, and assessment readiness — not just a column of yes/no checkboxes.

Think of it as four levels of maturity:

Most pages ranking for this topic stop at the second level — they hand you the 110 and call it a checklist. This page gives you the third, and shows you how to climb to the fourth.

Do you actually have CUI — or only FCI?

Before you implement a single control, confirm whether you handle Controlled Unclassified Information (CUI) at all — because the full 110-requirement checklist is the CUI path, and if you only handle Federal Contract Information (FCI), you’re on the shorter CMMC Level 1 path instead. FCI is information provided by or generated for the government under a contract that isn’t intended for public release; CUI is a defined category of government information that requires safeguarding under law, regulation, or government-wide policy. They are different triggers, with different checklists. Confusing them early is expensive to unwind.

A few ways to resolve it quickly:

• Read the contract and the markings. Look for CUI markings on deliverables, and for clauses like DFARS 252.204-7012 (which travels with CUI) versus only the basic FAR safeguarding clause (which travels with FCI).
• Ask the prime or the contracting officer. If a prime is flowing requirements down to you, they should be able to tell you what category of information you’ll receive and create.
• Map the data flow. Trace where contract information enters, where it’s stored, who touches it, and where it leaves. The answer to “do we have CUI” usually falls out of that map.

For the full CUI/FCI distinction, see our FCI vs. CUI guide and CMMC scoping guide. If the honest answer is “we don’t know,” treat that as your first task — not a reason to start checking boxes.

Should your checklist use NIST 800-171 Rev. 2 or Rev. 3?

Use NIST SP 800-171 Rev. 2 for CMMC Level 2 unless your contract or government customer specifically requires a different version. NIST published Rev. 3 in May 2024, and in NIST’s own library Rev. 3 supersedes Rev. 2 — but CMMC Level 2 still verifies the 110 Rev. 2 requirements, because that’s the version written into the CMMC rule at 32 CFR 170.14. Changing that reference isn’t a memo; it requires new federal rulemaking that hasn’t happened.

The 110 requirements across 14 families — and what each must prove

NIST SP 800-171 Rev. 2 organizes its 110 CUI security requirements into 14 families, numbered 3.1 through 3.14, ranging from 2 requirements (Personnel Security) to 22 (Access Control). Knowing the family names is orientation. The work is translating each family into evidence, an owner, an SSP reference, and a defensible status.

Last verified June 16, 2026. Requirement counts are from NIST SP 800-171 Rev. 2; reconcile any downloadable version line-by-line against the authoritative NIST PDF before each material update.

The DCR Evidence-Ready NIST 800-171 Checklist Matrix

A word on the “owner” column, because it’s the most underrated part of any checklist: CMMC failures are rarely about a single missing tool. They’re about requirements that live nowhere — IT assumes HR has it, HR assumes contracts has it, and the SSP claims it’s done. Assign an accountable owner to every family before you write a single “met,” and you’ve already dodged the most common self-assessment failure in the table.

The complete 110-requirement NIST 800-171 Rev. 2 checklist

Every requirement ID, in plain language, grouped by family. Pair it with the evidence, owner, and SSP columns from the matrix above.

Access Control (AC) — 3.1 — 22 requirements

Awareness & Training (AT) — 3.2 — 3 requirements

Audit & Accountability (AU) — 3.3 — 9 requirements

Configuration Management (CM) — 3.4 — 9 requirements

Identification & Authentication (IA) — 3.5 — 11 requirements

Incident Response (IR) — 3.6 — 3 requirements

Maintenance (MA) — 3.7 — 6 requirements

Media Protection (MP) — 3.8 — 9 requirements

Personnel Security (PS) — 3.9 — 2 requirements

Physical Protection (PE) — 3.10 — 6 requirements

Risk Assessment (RA) — 3.11 — 3 requirements

Security Assessment (CA) — 3.12 — 4 requirements

System & Communications Protection (SC) — 3.13 — 16 requirements

System & Information Integrity (SI) — 3.14 — 7 requirements

What makes a checklist “evidence-ready” — and why a yes/no list fails

An evidence-ready checklist proves each requirement the way an assessor will judge it. NIST SP 800-171A — the companion assessment publication — turns each requirement into a set of assessment objectives evaluated three ways: by examining documents and configurations, interviewing the people who run them, and testing what the environment actually does. That’s the difference between “we wrote a policy” and “we can show it operating right now.”

The posture that protects your SPRS score: walk every requirement as if a stranger will say, “Show me.” If the only answer is a checkbox, it isn’t done. If the answer is a document, a screenshot, and a person who can defend it, it is.

What documents should sit behind your checklist?

A complete NIST 800-171 checklist connects to a small set of documents that an assessor will expect, and that your SPRS score depends on.

• System Security Plan (SSP) — describes your system boundary, the CUI you handle, and how each requirement is implemented. Required by 3.12.4 and itself scored. If your SSP doesn’t describe your real environment, the rest of the checklist is fiction.
• Plan of Action & Milestones (POA&M) — lists what isn’t done yet and when it will be, under 3.12.2. (POA&M eligibility rules are covered in the next section.)
• CUI data-flow diagram — shows where CUI enters, moves, rests, and leaves. This defines and defends your boundary.
• Asset and user inventory — you can’t protect what you haven’t listed; this anchors access control, configuration management, and media protection.
• Policies and procedures — written rules behind families like access control, training, incident response, and media protection.
• Vendor / external service provider (ESP) responsibility matrix — spells out which requirements are inherited from a cloud platform or managed provider, which are shared, and which are yours. This is where “the cloud handles it” claims either hold up or fall apart.
• Evidence folder — the screenshots, exports, logs, and records that turn a “yes” into a defensible “met.”
• Training and incident-response records — completion logs, role-based training, the tested IR plan, and tabletop notes.

Build these alongside the checklist, not after it. The companies that move fastest treat the SSP and evidence folder as living documents from day one.

How your checklist becomes a SPRS score

For applicable DoD systems, you self-score your NIST 800-171 implementation using the DoD Assessment Methodology and post the result in SPRS. You start at a perfect 110 and subtract a weighted value — 1, 3, or 5 points — for each requirement you have not fully implemented, producing a score between −203 (nothing implemented) and 110 (everything implemented). A current score is required for award under the NIST 800-171 assessment clause.

The lack of partial credit is the part people get wrong — with two narrow exceptions worth knowing. Under 32 CFR 170.24, the CMMC scoring methodology credits partial implementation only in limited cases: IA.L2-3.5.3 (multifactor authentication) and SC.L2-3.13.11 (CUI encryption) can have adjusted deductions depending on how they’re implemented. Every other NOT MET requirement loses its full 1-, 3-, or 5-point value.

• There are three assessment levels. A contractor self-assessment is a Basic assessment, which DoD treats as “low” confidence. Medium and High assessments are government-led.
• Your SSP is the backbone of the score. If your SSP requirement (CA.L2-3.12.4) is marked NOT MET, SPRS can’t produce a score at all.
• SPRS stores the result, not the work. It records your score, scope, assessment date, CAGE codes, SSP details, POA&M completion date, and a confidence level. An old score with no current evidence behind it is a liability, not an asset.

One current-state note. As of February 1, 2026, a Revolutionary FAR Overhaul class deviation (DARS tracking number 2026-O0025) replaced DFARS 252.204-7019/-7020 with a new clause, DFARS 252.240-7997, reorganized under a new DFARS Part 240. We read the deviation memo: it changes how the Department administers NIST 800-171 assessments and which clause numberyou’ll see — it does not amend the CMMC rule (32 CFR Part 170), does not touch DFARS 252.204-7021 (the CMMC clause), and does noteliminate Level 2 self-assessments or SPRS posting where a solicitation requires them. In plain terms: same work, new clause numbers.

Which requirements can sit on a POA&M (and which can’t)

For CMMC, a Plan of Action & Milestones lets you defer a limited set of unmet requirements and still earn a Conditionalstatus — but the rules are strict, and most of the requirements that hurt your score can’t be deferred at all. Under 32 CFR 170.21, Conditional Level 2 requires a score of at least 88 out of 110 (80%), and the POA&M can hold only narrow categories of requirements, closed out within 180 days.

• Only 1-point requirements are POA&M-eligible. Every 3-point and 5-point requirement must be fully met before assessment.
• One narrow encryption exception: SC.L2-3.13.11 (CUI encryption) may be placed on a POA&M if encryption is employed but is not FIPS-validated — in which case it counts as a 3-point deduction.
• Six specific 1-point requirements are excluded by name under 170.21(a)(2)(iii), even though they’re only worth a point.
• The closeout is hard-dated: the POA&M must be confirmed closed within 180 days of the Conditional CMMC Status Date, or the Conditional status expires.

Practitioner analyses count 63 of the 110 as ineligible for a POA&M. This is precisely why you run the checklist first and fix in order of weight: you want the expensive, non-deferrable requirements done long before an assessor is in the room. See our Conditional Level 2 POA&M closeout guide for the full closeout process.

How the checklist connects to CMMC Level 2 — and whether you need a C3PAO

NIST 800-171 is the requirement set; CMMC is the DoD program that verifies it. CMMC Level 2 uses the same 110 Rev. 2 requirements, but your contract decides whether your Level 2 path is a self-assessment or a certification assessment by an authorized C3PAO (a Certified Third-Party Assessment Organization). DFARS 252.204-7021 requires you to hold and maintain the CMMC status the contract specifies, and it flows that obligation down to your subcontractors.

A checklist cannot make you compliant or certified. It’s a tracker.Finish it perfectly and you still haven’t “passed” anything — and the work an honest checklist exposes is routinely bigger, slower, and more expensive than leadership expects. Separate the two jobs permanently:

• Readiness and remediation — scoping, the SSP, the POA&M, implementing controls, managing your environment — is one job. This is where your time and money go first if you’re not assessment-ready.
• Formal assessment — a C3PAO confirming Level 2 when the contract requires certification — is a different job, done later, by a different party. Any combined “we’ll fix you and certify you” pitch is a conflict question to verify before you sign.

See our CMMC self-assessment vs. C3PAO guide and CMMC Level 2 requirements for the full picture.

Provider-matching forms on this site may generate referral or lead-routing compensation. This page does not currently contain named provider rankings, endorsements, or "best provider" awards. If named provider reviews are published later, sponsored, affiliate, partner, or referral relationships will be labeled on the relevant provider card or review. See our Methodology and Editorial & Advertising Policy for details.

How much does NIST 800-171 compliance cost, and how long does it take?

There’s no single number, because cost and timeline scale with three things: how mature you already are, how large your CUI environment is, and how much you outsource. In practice, readiness commonly runs from several months to a couple of years, and from the low five figures for a tightly scoped small shop to well into six figures for a broad, multi-system environment.

Where the money actually goes:

• MFA everywhere CUI is reachable — not just on email, but on privileged accounts, remote access, and local logons.
• FIPS-validated cryptography — for data at rest and in transit, which often means replacing or reconfiguring tools you assumed were “encrypted enough.”
• Shrinking the boundary — moving CUI into a controlled environment such as GCC High or a purpose-built CUI enclave, so you protect a small, well-defined space instead of your entire company.
• Documentation — a real SSP and a clean POA&M, which is labor, not licensing.
• Ongoing monitoring — logging, vulnerability management, and incident response that operate continuously, not once a year.

One nuance: DoD’s own economic analysis of the CMMC rule focused on the cost of assessments and affirmations— not the underlying NIST 800-171 implementation — because that implementation was already required under DFARS 252.204-7012. The security work itself is a cost you already owed; CMMC mostly adds the bill for proving it. For cost breakdowns across levels, see our CMMC certification cost guide and CMMC Level 2 cost guide.

The fastest safe order to work through the checklist

Do not start at requirement 3.1.1 and march down the list. Unless you already know your CUI scope, linear order is how you burn weeks protecting systems that should never have been in scope. The fastest safe sequence is scope-first.

1. Read the clause or the flow-down. Identify the required level and which clauses are present. Don’t assume your CMMC level from hearsay.
2. Identify your CUI and FCI. Know what data you actually hold and where it came from.
3. Define the CUI system boundary. Where does CUI enter, move, rest, and leave? This single decision determines the size and cost of everything that follows.
4. Decide whether an enclave makes sense. If CUI is sprawled across commercial email and file shares, isolating it into a smaller controlled environment can shrink the boundary dramatically.
5. Build the SSP skeleton. Describe the system you just scoped. A generic SSP that doesn’t match your environment is worse than none.
6. Inventory users, devices, cloud apps, vendors, and data flows. You can’t protect what you haven’t listed.
7. Prioritize the high-leverage technical baselines. Identity and access, MFA, logging, vulnerability management, incident response, and configuration baselines — the families that carry the heavy SPRS weights and that can’t sit on a POA&M.
8. Close evidence family by family. Use the matrix and 110-list above. For each line: status, evidence, owner, SSP reference.
9. Calculate or update SPRS only when the evidence supports it. Not before.
10. Decide your path. Self-assessment-ready, readiness-provider-ready, or C3PAO-ready — and act accordingly.

Can you do this yourself, or do you need a provider — and which kind?

You can absolutely start the checklist yourself — scope discovery, owner mapping, document inventory, and evidence collection are squarely in reach for an internal team. You typically need outside help when the checklist exposes technical implementation gaps, a CUI environment that’s too broad, SSP or POA&M uncertainty, SPRS scoring risk, or a near-term certification assessment.

For the full category breakdown, see our CMMC provider categories guide and who to hire first.

Where CMMC enforcement actually stands right now

The DFARS rule that puts CMMC into contracts became effective November 10, 2025, starting a phased rollout, and the underlying CMMC Program rule (32 CFR Part 170) took effect December 16, 2024. In Phase 1 — where we are now — contracting officers can require Level 1 and Level 2 self-assessments, and may require Level 2 C3PAO assessments at program discretion. Phase 2 begins around November 2026: for solicitations and contracts that require CMMC Level 2 (C3PAO), a self-assessment is no longer enough.

As of the October 2025 Cyber AB Town Hall, only about 431 organizationsheld a final CMMC Level 2 certification, against the roughly 80,000companies DoD estimates will need Level 2 (treat those as market indicators — verify current numbers in the Cyber AB Marketplace). The takeaway isn’t panic — it’s sequence. The contractors who do well from here run the checklist now, fix in priority order, and get in line for assessment before the crowd does. See how long CMMC certification takes for timeline planning.

The most common NIST 800-171 checklist mistakes

Most checklist failures aren’t new regulatory requirements — they’re practical errors that make the checklist unreliable.

• Using a Rev. 3 checklist for CMMC Level 2. CMMC verifies Rev. 2.
• Treating “the tool can do it” as evidence. Capability isn’t implementation. Show it operating.
• Ignoring BYOD, vendors, file shares, and email. CUI hides in the places nobody scoped.
• No link between the SSP and the evidence. If the SSP doesn’t describe your real system, the checklist is fiction.
• No owner for each family. Compliance that lives nowhere fails everywhere.
• Putting a non-eligible gap on a POA&M. If a 3- or 5-point gap (or one of the six named 1-point requirements) is on your POA&M, you don’t get a Conditional status.
• A stale SPRS score with no current evidence. This is a contractual risk, not a formality.
• Hiring an assessor before you’re ready. Expensive, and it can put a poor result on record.

A real, honest checklist may reveal that your environment is further behind and more expensive to fix than you hoped. That isn’t a reason to soften the checklist — it’s the entire point of running one. It’s far cheaper to learn it now than to learn it from a failed assessment, a lost recompete, or a DOJ Civil Cyber-Fraud problem tied to a SPRS score you knowingly couldn’t support.

NIST 800-171 requirements checklist FAQ

How many NIST 800-171 requirements are there?

For CMMC Level 2 today, the control set is 110 NIST SP 800-171 Rev. 2 security requirements across 14 families. Contractors usually call them “controls”; NIST’s term is “security requirements.” They’re the same thing.

Is NIST 800-171 Rev. 2 or Rev. 3 required for CMMC?

CMMC Level 2 currently uses NIST SP 800-171 Rev. 2. Rev. 3 exists and supersedes Rev. 2 in NIST’s publication library, but it doesn’t become the CMMC checklist unless DoD changes the rule through new rulemaking, which hasn’t happened.

Is NIST 800-171 the same as CMMC?

No. NIST SP 800-171 is the set of security requirements for protecting CUI on non-federal systems. CMMC is the DoD program that verifies implementation at the required level and assessment type. The standard is the “what”; CMMC is the “prove it.”

What is NIST 800-171A?

NIST SP 800-171A is the companion publication that provides procedures for assessing the NIST SP 800-171 requirements. It’s used for self-assessments, independent third-party assessments, and government-sponsored assessments, and it judges each requirement by examining, interviewing, and testing.

Did the February 2026 DFARS change end the NIST 800-171 self-assessment?

No. A February 1, 2026 Revolutionary FAR Overhaul class deviation replaced DFARS 252.204-7019/-7020 with a new clause (DFARS 252.240-7997) under a new DFARS Part 240, and renumbered the FAR safeguarding clause. It reorganized how the Department administers NIST 800-171 assessments; it did not amend CMMC (32 CFR Part 170), touch the CMMC clause (252.204-7021), or remove Level 2 self-assessments and SPRS posting where a solicitation requires them.

Do I have to post a NIST 800-171 score in SPRS?

If your covered DoD system is subject to the NIST 800-171 assessment requirements, the relevant result is posted in SPRS, and a current score is required for award consideration. A contractor self-assessment is a “Basic” assessment based on your SSP using the DoD Assessment Methodology.

Do I need a C3PAO for NIST 800-171?

Not automatically. Your contract decides whether your CMMC Level 2 path is self-assessed or requires an authorized C3PAO. If certification is required and you’re ready, you engage a C3PAO; if not, you do readiness work first — and keep the two roles separate.

Can I use a POA&M for unfinished requirements?

For CMMC, POA&M use is limited. None is permitted at Level 1. At Level 2, you need a score of at least 88/110, only 1-point requirements are eligible (with a narrow exception for SC.L2-3.13.11 if encryption is employed but not FIPS-validated, at 3 points), six specific 1-point requirements are excluded by name, and the POA&M must be closed within 180 days or your Conditional status expires. See 32 CFR 170.21 for the exact list.

Does GCC High, Azure Government, AWS GovCloud, or a GRC tool make me compliant?

No single platform makes your organization compliant by itself. The checklist still has to show the system boundary, which responsibilities are inherited versus shared versus yours, the settings as implemented, the operating evidence, and the SSP language. The platform is a foundation, not a finish line.

My boss just handed me “NIST 800-171” — what do I do first?

Start with scope, not control 3.1.1. Determine whether you handle CUI, where it lives, who can access it, which systems touch it, and which clauses apply. Then build the Rev. 2 evidence checklist — and use the matrix and 110-list on this page as your template. See also our NIST 800-171 gap analysis guide and NIST 800-171 consultant guide.

The next move

You came here for a checklist. You’re leaving with the version that matters: Rev. 2, all 110 requirements, 14 families, mapped to the evidence, owners, and score that actually decide whether you keep the contract. The list was the easy part. The evidence is the work — and now you know the order to do it in.

If you can see your path from here, run the checklist and go. If the gap is bigger than your team can close before your contract needs it, don’t guess at who to call.

Keep going from here

• CMMC Level 2 requirements — the full 110 controls and what they mean for CMMC
• CMMC Level 2 checklist — the assessment-ready version
• CMMC self-assessment vs. C3PAO — who can assess what and when
• CMMC certification process — what a C3PAO assessment actually involves
• SPRS score guide — how to calculate, post, and maintain your score
• NIST 800-171 gap analysis — finding and prioritizing your gaps
• NIST 800-171 consultant guide — what to look for and what to avoid
• CMMC scoping guide — the five asset categories and how to define your boundary
• FCI vs. CUI — which path you’re actually on
• CMMC provider categories — RPO, C3PAO, MSP, MSSP — what each one does
• CMMC readiness checklist — pre-assessment checklist across all levels
• CMMC Level 3 requirements — the 24 NIST SP 800-172 enhanced controls

Sources we read (primary and authoritative)

• NIST SP 800-171 Rev. 2
• NIST SP 800-171A (assessment procedures)
• NIST SP 800-172 (Level 3 enhanced requirements)
• NIST SP 800-171 Rev. 3
• 32 CFR Part 170 (CMMC Program), eCFR
• 32 CFR 170.14 (CMMC Model — confirms Rev. 2)
• 32 CFR 170.21 (POA&M requirements)
• 32 CFR 170.24 (CMMC Scoring Methodology)
• 32 CFR Part 170 final rule (Federal Register, Oct. 15, 2024)
• DoD NIST SP 800-171 Assessment Methodology
• DFARS class deviation 2026-O0025 (Revolutionary FAR Overhaul, DFARS Part 240 / 252.240-7997)
• DFARS 252.204-7012
• DFARS 252.204-7021
• SPRS
• Cyber AB (ecosystem roles / conflict of interest / Marketplace)
• Case study: 313 Industries (Univ. of Michigan DCAP / MEP)
• CyberSheath 2025 State of the DIB Report

Last verified: June 16, 2026. Next scheduled review: September 2026 or sooner if DoD, eCFR, or NIST materially updates NIST 800-171, the CMMC rule, DFARS, or SPRS requirements.

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. This article is informational and is not legal, contractual, or compliance advice. We are not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, NIST, SPRS, the Cyber AB, or any U.S. Government agency. Verify all regulatory citations against the primary sources listed above before relying on them in a contract context.