NIST SP 800-171

NIST Special Publication 800-171 specifies security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems. Rev. 3, published in May 2024, is the current revision, with 97 requirements in 17 families; it withdrew Rev. 2, which had 110 requirements in 14 families. DoD continues to assess contractors against Rev. 2 for DFARS 252.204-7012 and CMMC, so both revisions are in use.