NIST SP 800-171 Revision 2 sets 110 security requirements in 14 families for protecting Controlled Unclassified Information (CUI) held outside federal systems. It underpins US defence and federal contract security terms.
Free account needed to download. You come straight back to the file.
Who it is for. Contractors, subcontractors and other non-federal organisations that handle Controlled Unclassified Information for US federal agencies, and the suppliers who touch that data.
What this list covers. NIST SP 800-171 Revision 2 (February 2020, updated January 2021); Revision 3 (May 2024) restructures it: 110 requirements. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| 3.1.1 | Limit access to authorised users and devices | Let only authorised users, the processes acting for them and approved devices, including other systems, reach your systems. |
| 3.1.2 | Limit what users may do | Restrict each user to the kinds of transactions and functions they have been permitted to carry out. |
| 3.1.3 | Control where CUI flows | Decide where CUI may travel, inside your network and outside it, and enforce those decisions. |
| 3.1.4 | Separate duties | Divide tasks among different people so that one person cannot misuse access without someone else being involved. |
| 3.1.5 | Apply least privilege | Give accounts, including privileged and security-function accounts, only the access their job needs. |
| 3.1.6 | Use ordinary accounts for ordinary work | Have administrators use a non-privileged account or role for everyday tasks that do not need elevated rights. |
| 3.1.7 | Block and log privileged actions | Stop ordinary users from running privileged functions, and record in audit logs when those functions are run. |
| 3.1.8 | Limit failed sign-in attempts | Set a limit on repeated unsuccessful logon attempts, and lock or delay the account when it is reached. |
| 3.1.9 | Show use notices | Display privacy and security notices that match the CUI rules that apply, for example when users sign in. |
| 3.1.10 | Lock idle sessions | Lock the screen after a period of inactivity, and hide what was on it until the user signs in again. |
| 3.1.11 | End sessions automatically | Close a user's session automatically when a condition you have defined is met, such as a time limit. |
| 3.1.12 | Monitor remote access | Watch and control remote access sessions, such as VPN and remote desktop connections. |
| 3.1.13 | Encrypt remote access | Use cryptography so remote access sessions cannot be read by others on the network path. |
| 3.1.14 | Route remote access through controlled points | Send all remote access through a limited number of managed entry points that you can control and watch. |
| 3.1.15 | Authorise remote privileged work | Approve in advance remote execution of privileged commands and remote access to security-related information. |
| 3.1.16 | Authorise wireless access first | Approve wireless connections before they are allowed to connect. |
| 3.1.17 | Protect wireless access | Require authentication and encryption on wireless connections to your systems. |
| 3.1.18 | Control mobile devices | Manage which mobile devices may connect to your systems and under what conditions. |
| 3.1.19 | Encrypt CUI on mobile devices | Encrypt CUI stored on phones, tablets, laptops and similar mobile platforms. |
| 3.1.20 | Control external systems | Verify and limit connections to, and use of, systems you do not own or run. |
| 3.1.21 | Limit portable storage on external systems | Restrict the use of your portable storage devices, such as USB drives, on systems outside your control. |
| 3.1.22 | Keep CUI off public systems | Control what is posted or processed on publicly accessible systems, so CUI is not exposed there. |
| Ref | Control | What it requires |
|---|---|---|
| 3.2.1 | Make people aware of risks and rules | Make sure managers, administrators and users understand the security risks of their work and the policies and procedures that apply. |
| 3.2.2 | Train people for their security duties | Train staff to carry out the information security tasks assigned to them. |
| 3.2.3 | Teach insider threat awareness | Train people to recognise and report signs of a possible insider threat. |
| Ref | Control | What it requires |
|---|---|---|
| 3.3.1 | Create and keep audit logs | Generate and retain logs detailed enough to support monitoring, analysis, investigation and reporting of unauthorised or unlawful activity. |
| 3.3.2 | Trace actions to individuals | Record enough in each log entry that every action can be tied to one user, so people can be held accountable. |
| 3.3.3 | Review logged events | Review which events you log, and update the list as threats and needs change. |
| 3.3.4 | Alert when logging fails | Raise an alert if the logging process breaks down, for example when storage is full or a log source stops. |
| 3.3.5 | Correlate log review and response | Bring together log review, analysis and reporting so that suspicious activity can be investigated and acted on. |
| 3.3.6 | Support on-demand log analysis | Provide ways to filter and summarise log data and produce reports when needed, without altering the original records. |
| 3.3.7 | Synchronise clocks | Keep system clocks aligned with a trusted time source so log timestamps can be relied on. |
| 3.3.8 | Protect logs and logging tools | Prevent unauthorised access to, changes to, or deletion of audit records and the tools that produce them. |
| 3.3.9 | Restrict log management | Let only a small group of privileged users manage the logging functions. |
| Ref | Control | What it requires |
|---|---|---|
| 3.4.1 | Keep baselines and inventories | Define and maintain standard configurations and an inventory of hardware, software, firmware and documentation throughout each system's life. |
| 3.4.2 | Set and enforce secure settings | Choose security settings for the products you use, apply them, and make sure they stay applied. |
| 3.4.3 | Control changes | Track, review, approve or reject, and log changes to your systems. |
| 3.4.4 | Assess security impact before changing | Work out how a change affects security before it goes ahead. |
| 3.4.5 | Restrict who can make changes | Define, document, approve and enforce the physical and logical access needed to change systems. |
| 3.4.6 | Provide only essential capabilities | Configure systems with only the functions the business needs, following the idea of least functionality. |
| 3.4.7 | Switch off what is not needed | Restrict, disable or block programs, functions, ports, protocols and services that are not essential. |
| 3.4.8 | Control which software may run | Use a blocklist for unauthorised software, or better an allowlist that permits only approved software to run. |
| 3.4.9 | Control user-installed software | Decide what users may install, and watch what they do install. |
| Ref | Control | What it requires |
|---|---|---|
| 3.5.1 | Identify users, processes and devices | Give every user, process acting for a user, and device a unique identity on your systems. |
| 3.5.2 | Verify identities before access | Authenticate users, processes and devices before they are allowed onto your systems. |
| 3.5.3 | Use multifactor authentication | Require more than one factor for privileged accounts, whether local or over the network, and for network access to ordinary accounts. |
| 3.5.4 | Use replay-resistant authentication | Use sign-in methods that cannot be defeated by recording and replaying a captured exchange. |
| 3.5.5 | Do not reuse identifiers too soon | Do not hand out an old user or device identifier again until a set period has passed. |
| 3.5.6 | Disable inactive identifiers | Switch off identifiers that have not been used for a defined period. |
| 3.5.7 | Enforce password strength | Set a minimum password complexity and require enough characters to change when a password is replaced. |
| 3.5.8 | Block password reuse | Stop people from reusing a password they have used within a set number of previous passwords. |
| 3.5.9 | Make temporary passwords one-time | Allow temporary passwords at sign-in only if the user must change them to a permanent one straight away. |
| 3.5.10 | Protect stored and sent passwords | Store and transmit passwords only in a cryptographically protected form. |
| 3.5.11 | Hide authentication feedback | Mask what is typed or shown during sign-in, so onlookers cannot learn the secret. |
| Ref | Control | What it requires |
|---|---|---|
| 3.6.1 | Build incident handling capability | Set up a working capability to prepare for, detect, analyse, contain, recover from and respond to incidents affecting users. |
| 3.6.2 | Track and report incidents | Record each incident and report it to the right people inside the organisation and to outside authorities where required. |
| 3.6.3 | Test incident response | Test your incident response capability, for example with exercises. |
| Ref | Control | What it requires |
|---|---|---|
| 3.7.1 | Maintain systems | Carry out maintenance on your systems. |
| 3.7.2 | Control maintenance tools and people | Put controls on the tools, techniques, mechanisms and personnel used for maintenance. |
| 3.7.3 | Wipe equipment sent off-site | Remove all CUI from equipment before it leaves for repair away from your premises. |
| 3.7.4 | Scan diagnostic media | Check media holding diagnostic and test programs for malicious code before using them on your systems. |
| 3.7.5 | Secure remote maintenance | Require multifactor authentication for remote maintenance sessions over external networks, and end the connection when the work is done. |
| 3.7.6 | Supervise uncleared maintenance staff | Watch over maintenance staff who do not have the necessary authorisation while they work. |
| Ref | Control | What it requires |
|---|---|---|
| 3.8.1 | Protect media holding CUI | Physically control and securely store any media containing CUI, whether paper or digital. |
| 3.8.2 | Limit access to CUI on media | Allow only authorised users to access CUI held on media. |
| 3.8.3 | Sanitise or destroy media | Wipe or destroy media containing CUI before disposal or reuse. |
| 3.8.4 | Mark media | Label media with the required CUI markings and any limits on who may receive it. |
| 3.8.5 | Control media in transit | Restrict access to media carrying CUI outside controlled areas, and keep track of who has it. |
| 3.8.6 | Encrypt digital media in transit | Use cryptography to protect CUI on digital media during transport, unless physical safeguards give equal protection. |
| 3.8.7 | Control removable media | Manage the use of removable media on your system components. |
| 3.8.8 | Ban portable storage with no owner | Do not allow portable storage devices when nobody can be identified as their owner. |
| 3.8.9 | Protect backups | Keep the confidentiality of CUI in backups at the places where they are stored. |
| Ref | Control | What it requires |
|---|---|---|
| 3.9.1 | Screen people before access | Check individuals' background before giving them access to systems that contain CUI. |
| 3.9.2 | Protect CUI when people leave or move | Make sure CUI systems stay protected during and after terminations and transfers, for example by removing access and collecting devices. |
| Ref | Control | What it requires |
|---|---|---|
| 3.10.1 | Limit physical access | Allow only authorised people into the places where systems, equipment and their operating environments are kept. |
| 3.10.2 | Protect and monitor facilities | Protect and watch the physical site and the infrastructure that supports your systems. |
| 3.10.3 | Escort and watch visitors | Escort visitors and keep an eye on what they do. |
| 3.10.4 | Log physical access | Keep records of who enters protected areas. |
| 3.10.5 | Manage physical access devices | Control and manage keys, badges, locks and similar devices that give physical access. |
| 3.10.6 | Protect CUI at alternate work sites | Apply safeguards to CUI where people work away from the main site, such as at home or on the road. |
| Ref | Control | What it requires |
|---|---|---|
| 3.11.1 | Assess risk regularly | Periodically assess the risk to operations, assets and people from running your systems and handling CUI. |
| 3.11.2 | Scan for vulnerabilities | Scan systems and applications for vulnerabilities on a schedule and whenever new ones affecting you become known. |
| 3.11.3 | Fix vulnerabilities by risk | Remediate vulnerabilities in line with what your risk assessments say. |
| Ref | Control | What it requires |
|---|---|---|
| 3.12.1 | Assess controls regularly | Periodically check whether your security controls are working as intended. |
| 3.12.2 | Plan and carry out fixes | Create and follow plans of action to correct weaknesses and reduce or remove vulnerabilities. |
| 3.12.3 | Monitor controls continuously | Keep monitoring controls on an ongoing basis to be sure they stay effective. |
| 3.12.4 | Keep a system security plan | Write and update a plan that describes system boundaries, environment, how each requirement is met, and connections to other systems. |
| Ref | Control | What it requires |
|---|---|---|
| 3.13.1 | Protect network boundaries | Monitor, control and protect communications at the external edge and key internal boundaries of your systems. |
| 3.13.2 | Design for security | Use architecture, development practices and engineering principles that support security. |
| 3.13.3 | Separate user and admin functions | Keep functions used by ordinary users apart from those used to manage the system. |
| 3.13.4 | Prevent leaks through shared resources | Stop information from passing between users or processes through shared system resources. |
| 3.13.5 | Isolate public-facing systems | Place publicly accessible components on separate subnetworks, physically or logically apart from your internal network. |
| 3.13.6 | Deny network traffic by default | Block all network traffic unless it is specifically allowed. |
| 3.13.7 | Prevent split tunnelling | Stop a remote device from connecting to your network while also connecting to other external networks at the same time. |
| 3.13.8 | Encrypt CUI in transit | Use cryptography to prevent disclosure of CUI during transmission, unless equivalent physical protection is in place. |
| 3.13.9 | End idle network connections | Close network connections when a session finishes or after a set period of inactivity. |
| 3.13.10 | Manage cryptographic keys | Establish and manage the keys used by the cryptography in your systems. |
| 3.13.11 | Use FIPS-validated cryptography | When cryptography protects the confidentiality of CUI, use FIPS-validated cryptography. |
| 3.13.12 | Control collaboration devices | Stop remote activation of cameras and microphones, and show users when such devices are in use. |
| 3.13.13 | Control mobile code | Control and monitor the use of code that moves between systems and runs on arrival, such as scripts in web pages. |
| 3.13.14 | Control VoIP | Control and monitor the use of internet voice technology. |
| 3.13.15 | Protect session authenticity | Take steps to make sure each communications session is genuine and cannot be hijacked. |
| 3.13.16 | Protect CUI at rest | Protect the confidentiality of CUI where it is stored. |
| Ref | Control | What it requires |
|---|---|---|
| 3.14.1 | Fix flaws promptly | Find, report and correct system flaws in a timely manner. |
| 3.14.2 | Protect against malicious code | Provide protection against malicious code at suitable places in your systems. |
| 3.14.3 | Act on security alerts | Follow security alerts and advisories and respond to those that affect you. |
| 3.14.4 | Keep malware protection current | Update malicious code protection whenever new versions are released. |
| 3.14.5 | Scan systems and incoming files | Scan systems periodically, and scan files from outside as they are downloaded, opened or run. |
| 3.14.6 | Monitor for attacks | Monitor your systems and the traffic coming in and going out to spot attacks and signs of one. |
| 3.14.7 | Identify unauthorised use | Detect any use of your systems that is not authorised. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
CUI is government-created or government-owned information that is sensitive but not classified, and that law or policy says must be protected. Your contract or the agency tells you what counts as CUI in your case.
There are 110, split across 14 families from access control to system and information integrity. Each is numbered 3.family.item, from 3.1.1 to 3.14.7.
Revision 2 (February 2020, updated January 2021) remains the version many contracts and assessment programmes refer to. Revision 3 (May 2024) restructures the requirements, so check which revision your contract names.
No. The references and short headings identify each requirement; the sentence beside each is our own plain-English summary. Read NIST's publication, and any assessment guide your contract uses, for the authoritative wording.
A spreadsheet-ready CSV of the same list with blank columns for applicability, status, owner and evidence, so you can use it to start a gap assessment.