NIST 800-171
NIST SP 800-171 Rev. 2 vs Rev. 3 for CMMC in 2026
Why NIST Rev. 3 is final while CMMC work can still depend on Rev. 2, and how to avoid mixing assessment baselines.
Read guide →NIST 800-171
NIST SP 800-171 guides for defense contractors
Every NIST SP 800-171 guide on the site in one place — assessments, revisions, evidence, and the requirements that come up most in Level 2 self-assessments.
NIST 800-171
NIST 800-171 DoD Basic Assessment: What the Three-Year Rule Means
A practical explanation of the current NIST SP 800-171 DoD Basic Assessment requirement, SPRS record, and three-year currency rule.
Read guide →NIST 800-171
CMMC MFA Requirements: Privileged, Network, and Local Access Without Guesswork
A precise guide to NIST SP 800-171 Rev. 2 requirement 3.5.3 for CMMC Level 2, including privileged vs non-privileged access, local vs network access, common bypasses, and assessor-ready evidence.
Read guide →NIST 800-171
CMMC Privileged Accounts and Least Privilege: Admin Rights, Daily Accounts, and Evidence
How CMMC Level 2 applies NIST SP 800-171 Rev. 2 least-privilege requirements to administrators, separate daily accounts, privileged functions, logging, approvals, and access reviews.
Read guide →NIST 800-171
CMMC Shared Accounts and Service Accounts: How to Preserve User Traceability
How shared logins and service identities interact with CMMC requirements for identification, unique user traceability, least privilege, authentication, and assessor evidence.
Read guide →NIST 800-171
CMMC Audit Logs: What to Record, Retain, Protect, and Review for Level 2
A practical guide to NIST SP 800-171 Rev. 2 audit requirements 3.3.1 through 3.3.9, including event selection, retention, user traceability, clock synchronization, log protection, failure alerts, and assessor evidence.
Read guide →NIST 800-171
CMMC Vulnerability Scanning: Scope, Cadence, Triggers, and Evidence for 3.11.2
How to implement NIST SP 800-171 Rev. 2 requirement 3.11.2 without inventing a quarterly rule: systems and applications, periodic scans, new-vulnerability triggers, missed devices, exclusions, and evidence.
Read guide →NIST 800-171
CMMC Patch Management and Flaw Remediation: How to Define “Timely” Without a Fake 30/60/90 Rule
A focused guide to NIST SP 800-171 Rev. 2 requirement 3.14.1 and its relationship to vulnerability scanning and risk remediation, including patch SLAs, exceptions, emergency fixes, verification, and evidence.
Read guide →NIST 800-171
CMMC Encryption at Rest: When CUI Needs Cryptography, Physical Protection, and FIPS Validation
A precise guide to NIST SP 800-171 Rev. 2 requirements 3.13.16 and 3.13.11 for CUI at rest, covering endpoints, servers, backups, cloud storage, removable media, key handling, physical safeguards, and evidence.
Read guide →NIST 800-171
CMMC Encryption in Transit: Map CUI Transfers Across TLS, VPN, SFTP, Email, and APIs
How to implement NIST SP 800-171 Rev. 2 requirements 3.13.8 and 3.13.11 for CUI in transit, including transfer-path inventory, alternative physical safeguards, FIPS-validated cryptography, TLS/VPN/SFTP configuration, and evidence.
Read guide →NIST 800-171
CMMC Removable Media and USB: Control Use, Ownership, Transport, and CUI Without a Blanket Myth
A focused guide to NIST SP 800-171 Rev. 2 media requirements for USB drives and portable storage, including 3.8.7, 3.8.8, transport accountability, encryption, approved-device models, technical enforcement, and evidence.
Read guide →
NIST 800-171
CMMC Media Sanitization: Reuse, Disposal, Off-Site Maintenance, and CUI Evidence
How to implement NIST SP 800-171 Rev. 2 media sanitization requirements for drives, SSDs, paper, printers, equipment sent for maintenance, reused devices, and destruction records without confusing decontrol with public release.
Read guide →NIST 800-171
CMMC Wireless Networks: Authorization, Encryption, Guest Wi-Fi, and Evidence for 3.1.16–3.1.17
How CMMC Level 2 applies NIST SP 800-171 Rev. 2 wireless requirements 3.1.16 and 3.1.17 to corporate Wi-Fi, guest networks, access points, rogue devices, remote sites, authentication, encryption, and assessment evidence.
Read guide →NIST 800-171
CMMC Mobile Devices: Phones, Tablets, MDM, CUI Storage, and Lost-Device Evidence
A practical guide to NIST SP 800-171 Rev. 2 requirements 3.1.18 and 3.1.19 for mobile devices, including connection control, CUI encryption, MDM, apps, screenshots, local downloads, cloud backup, loss, remote wipe, and assessor evidence.
Read guide →NIST 800-171
CMMC Incident Response Tabletop: How to Test 3.6.3 and Connect It to DFARS 72-Hour Reporting
A detailed Level 2 tabletop guide for NIST SP 800-171 Rev. 2 incident response requirements 3.6.1–3.6.3, with scenarios, injects, roles, evidence, action tracking, DFARS 252.204-7012 reporting, and 90-day image preservation.
Read guide →