The ultimate guide to NIST 800-171

While the world of information security has many standards and frameworks that are widely used, there are also standards that are more specialized. If you’re just hearing about NIST 800-171 for the first time, you’re not out of the loop. This guide will help you determine if you need NIST 800-171, and if so, how to move forward.

‍

What is NIST 800-171?

NIST 800-171 is a special publication of the National Institute of Standards and Technology. It is a detailed list of security controls that can be used to protect sensitive information. Specifically, this standard is designed to protect controlled unclassified information (CUI) that is handled by contractors hired by the federal government.

‍

The US federal government defines CUI as sensitive, but not classified, information that is controlled and owned by the government. While it’s not critical enough to be classified, CUI can still have economic or national security consequences if it falls into the wrong hands. NIST 800-171 is designed to keep it safe.

‍

Who needs NIST 800-171 compliance?

NIST 800-171 is a legally mandated framework. By law, any contractor that is hired by any US federal agency, and is handling CUI in its network, must be NIST 800-171 compliant. This is part of the Defense Federal Acquisition Regulation Supplement (DFARS) which took effect in 2017. If you hope to win federal contracts, attaining NIST 800-171 compliance will allow you to bring on those contracts smoothly.

‍

What are the NIST 800-171 controls?

In total, there are 110 controls that are required in the NIST 800-171 framework. They are divided into 14 categories:

• Access control
• Awareness and training
• Audit and accountability
• Configuration management
• Identification and authentication
• Incident response
• Maintenance
• Media protection
• Personnel security
• Physical protection
• Risk assessment
• Security assessment
• System and communications protection
• System and information integrity

‍

Each of these categories plays a role in creating a thoroughly protected information system that can keep your CUI safe.

‍

What is the current version of NIST 800-171?

Like many government regulations, NIST 800-171 has gone through changes and iterations over time. As of the publication of this blog, the currently enforced version of NIST 800-171 is Revision 2, which was released in February 2020.

‍

What does it mean to be NIST 800-171 compliant?

There is no formal third-party audit or certification for NIST 800-171 compliance. Instead, you’re responsible for verifying your ongoing compliance with a self-assessment. If you don’t maintain your compliance, and it is found that you’re not in compliance, especially if this comes to light because of an information breach, you could face fines, lawsuits, and loss of government contracts.

‍

What is the best way to become NIST 800-171 compliant?

Vanta’s automated compliance platform conducts an assessment of your information system to determine which NIST 800-171 controls you already have in place. From there, our platform gives you a detailed report of any NIST 800-171 controls you need to implement to reach compliance. 

‍

Vanta was designed by knowledgeable experts to help you achieve compliance smoothly and as swiftly as possible. If you’re ready to get started, sign up for a Vanta demo to learn more about our innovative platform.