Framework · NIST SP 800-171 Rev. 3 – Protecting CUI
You are to protect controlled unclassified information (CUI) for US customers? Complass guides you up to the system security plan and POA&M, with evidence from ISO 27001 or NIS2.
NIST Special Publication 800-171 sets out how companies protect US government CUI in their own systems. Revision 3 of 14 May 2024 contains 97 requirements in 17 families and introduces organisation-defined parameters; SP 800-171A Rev. 3 describes with 422 determination statements for the requirements and 88 for the parameters how they are assessed. SP 800-171 becomes binding through contracts, above all in US defence. There is no certificate.
Complass is not affiliated with NIST. The English wording of the requirements and determination statements is taken from NIST SP 800-171 Rev. 3 and SP 800-171A Rev. 3, freely usable works of the US federal government.
Content as of:
SP 800-171 concerns contractors and subcontractors of US agencies that receive CUI, such as technical drawings from defence contracts. The obligation is passed down the supply chain and so also reaches suppliers outside the US.
Check which revision your contract names: US defence contracts (DFARS 252.204-7012) and the CMMC programme (32 CFR Part 170) are based on Rev. 2 as far as we know (November 2026).
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
There are no statutory deadlines for companies; your contract sets the deadlines. SSP and POA&M are living documents that you update whenever things change and after every assessment.
Scope the CUI environment, assess the current state, set parameters, create the SSP and POA&M, assess and update.
Each requirement with its official identifier, the NIST wording and the SP 800-171A determination statements, titles and hints in our own words.
System Security Plan (SSP), organisation-defined parameters and Plan of Action and Milestones (POA&M).
Complass suggests adopting measures you have already assessed for ISO 27001, NIS2 or NIST CSF.
Catalogue: NIST SP 800-171 Rev. 3 – 97 security requirements
If your clients require NIST SP 800-171, this selection covers the requirements in Complass.
minimum selection NIST SP 800-171
€199 net per month
Recommended
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the requirements without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
Complass prepares the implementation and assessment of the requirements. CMMC is a separate programme of the US Department of Defense with its own assessments; Complass does not issue a certificate.
The revision in your contract applies. The module covers Rev. 3; clarify the revision with your customer before you build evidence.
No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion for whether it covers the CUI environment.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
