X-CUI-NIST171 Informational
Protect CUI on Nonfederal Systems per NIST SP 800-171
Official citation: NIST SP 800-171 Rev 3; 32 CFR 2002.14(g)
Class: informational · Severity: high
Requirement text
NIST SP 800-171 Rev 3; 32 CFR 2002.14(g)
What it means
For CUI on nonfederal information systems, NIST SP 800-171 is the control set the government expects. Revision 3 (2024) reorganized the families and tightened several controls; DFARS 252.204-7012 and 32 CFR 2002.14(g) make it contractually and regulatorily binding for many contractors. A System Security Plan and POA&M are the core evidence artifacts.
Required by
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- — 32 CFR Part 2002
- DIB — 32 CFR Part 2002
- Nuclear — 32 CFR Part 2002
- IT/Cloud — 32 CFR Part 2002
- Ag/Food — 32 CFR Part 2002
- Chemical — 32 CFR Part 2002
- Legal — 32 CFR Part 2002
- GovCon — 32 CFR Part 2002
- Water — 32 CFR Part 2002
Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.