NIST 800-171
NIST SP 800-171 Rev. 2 vs Rev. 3 for CMMC in 2026
Why NIST Rev. 3 is final while CMMC work can still depend on Rev. 2, and how to avoid mixing assessment baselines.
Read guide →NIST 800-171
NIST SP 800-171 guides for defense contractors
Every NIST SP 800-171 guide on the site in one place — assessments, revisions, evidence, and the requirements that come up most in Level 2 self-assessments.
NIST 800-171
NIST 800-171 DoD Basic Assessment: What the Three-Year Rule Means
A practical explanation of the current NIST SP 800-171 DoD Basic Assessment requirement, SPRS record, and three-year currency rule.
Read guide →
NIST 800-171
CMMC MFA Requirements: Privileged, Network, and Local Access Without Guesswork
A precise guide to NIST SP 800-171 Rev. 2 requirement 3.5.3 for CMMC Level 2, including privileged vs non-privileged access, local vs network access, common bypasses, and assessor-ready evidence.
Read guide →
NIST 800-171
CMMC Privileged Accounts and Least Privilege: Admin Rights, Daily Accounts, and Evidence
How CMMC Level 2 applies NIST SP 800-171 Rev. 2 least-privilege requirements to administrators, separate daily accounts, privileged functions, logging, approvals, and access reviews.
Read guide →
NIST 800-171
CMMC Shared Accounts and Service Accounts: How to Preserve User Traceability
How shared logins and service identities interact with CMMC requirements for identification, unique user traceability, least privilege, authentication, and assessor evidence.
Read guide →
NIST 800-171
CMMC Audit Logs: What to Record, Retain, Protect, and Review for Level 2
A practical guide to NIST SP 800-171 Rev. 2 audit requirements 3.3.1 through 3.3.9, including event selection, retention, user traceability, clock synchronization, log protection, failure alerts, and assessor evidence.
Read guide →
NIST 800-171
CMMC Vulnerability Scanning: Scope, Cadence, Triggers, and Evidence for 3.11.2
How to implement NIST SP 800-171 Rev. 2 requirement 3.11.2 without inventing a quarterly rule: systems and applications, periodic scans, new-vulnerability triggers, missed devices, exclusions, and evidence.
Read guide →
NIST 800-171
CMMC Patch Management and Flaw Remediation: How to Define “Timely” Without a Fake 30/60/90 Rule
A focused guide to NIST SP 800-171 Rev. 2 requirement 3.14.1 and its relationship to vulnerability scanning and risk remediation, including patch SLAs, exceptions, emergency fixes, verification, and evidence.
Read guide →
NIST 800-171
CMMC Encryption at Rest: When CUI Needs Cryptography, Physical Protection, and FIPS Validation
A precise guide to NIST SP 800-171 Rev. 2 requirements 3.13.16 and 3.13.11 for CUI at rest, covering endpoints, servers, backups, cloud storage, removable media, key handling, physical safeguards, and evidence.
Read guide →
NIST 800-171
CMMC Encryption in Transit: Map CUI Transfers Across TLS, VPN, SFTP, Email, and APIs
How to implement NIST SP 800-171 Rev. 2 requirements 3.13.8 and 3.13.11 for CUI in transit, including transfer-path inventory, alternative physical safeguards, FIPS-validated cryptography, TLS/VPN/SFTP configuration, and evidence.
Read guide →
NIST 800-171
CMMC Removable Media and USB: Control Use, Ownership, Transport, and CUI Without a Blanket Myth
A focused guide to NIST SP 800-171 Rev. 2 media requirements for USB drives and portable storage, including 3.8.7, 3.8.8, transport accountability, encryption, approved-device models, technical enforcement, and evidence.
Read guide →
NIST 800-171
CMMC Media Sanitization: Reuse, Disposal, Off-Site Maintenance, and CUI Evidence
How to implement NIST SP 800-171 Rev. 2 media sanitization requirements for drives, SSDs, paper, printers, equipment sent for maintenance, reused devices, and destruction records without confusing decontrol with public release.
Read guide →
NIST 800-171
CMMC Wireless Networks: Authorization, Encryption, Guest Wi-Fi, and Evidence for 3.1.16–3.1.17
How CMMC Level 2 applies NIST SP 800-171 Rev. 2 wireless requirements 3.1.16 and 3.1.17 to corporate Wi-Fi, guest networks, access points, rogue devices, remote sites, authentication, encryption, and assessment evidence.
Read guide →
NIST 800-171
CMMC Mobile Devices: Phones, Tablets, MDM, CUI Storage, and Lost-Device Evidence
A practical guide to NIST SP 800-171 Rev. 2 requirements 3.1.18 and 3.1.19 for mobile devices, including connection control, CUI encryption, MDM, apps, screenshots, local downloads, cloud backup, loss, remote wipe, and assessor evidence.
Read guide →
NIST 800-171
CMMC Incident Response Tabletop: How to Test 3.6.3 and Connect It to DFARS 72-Hour Reporting
A detailed Level 2 tabletop guide for NIST SP 800-171 Rev. 2 incident response requirements 3.6.1–3.6.3, with scenarios, injects, roles, evidence, action tracking, DFARS 252.204-7012 reporting, and 90-day image preservation.
Read guide →
NIST 800-171
CMMC Security Awareness & Training Requirements: What 3.2.1–3.2.3 Actually Require
CMMC training under NIST 800-171 3.2.1–3.2.3 means role-aware and insider-threat-aware training with records proving people actually received it.
Read guide →
NIST 800-171
CMMC Configuration Management: Baselines, Change Control, and Least Functionality (3.4.x)
CMMC configuration management connects secure baselines, inventories, controlled changes, least functionality, and software restrictions across the CUI environment.
Read guide →
NIST 800-171
CMMC Maintenance Requirements: Tools, Remote Maintenance, and Sanitization Before Off-Site Repair (3.7.x)
CMMC maintenance controls govern who services CUI systems, which tools are used, how remote maintenance is protected, and what happens before equipment leaves.
Read guide →
NIST 800-171
CMMC Personnel Security: Screening, Termination, and Transfer Actions (3.9.x)
CMMC personnel security under 3.9.1–3.9.2 covers screening before access plus timely system and facility actions for termination and transfer events.
Read guide →
NIST 800-171
CMMC Physical Protection: Facility Access, Visitor Logs, and Alternate Work Sites (3.10.x)
CMMC physical protection covers authorized facility access, visitor control, access logs, physical devices, and safeguards at alternate work sites.
Read guide →
NIST 800-171
CMMC Account Management: Provisioning, Deprovisioning, and Periodic Access Review (3.1.1–3.1.2)
CMMC account management should prove only authorized users and devices receive permitted access, with controlled provisioning, removal, and review.
Read guide →
NIST 800-171
CMMC Session Lock and Session Termination: What Counts as Evidence (3.1.10–3.1.11)
CMMC session controls require inactivity locking with pattern-hiding displays and automatic termination after defined conditions, backed by real settings.
Read guide →
NIST 800-171
CMMC Remote Access Beyond MFA: Monitoring, Encryption, and Managed Access Points (3.1.12–3.1.14)
CMMC remote access requires controlled and monitored sessions, cryptographic protection, and routing through managed access-control points—not MFA alone.
Read guide →
NIST 800-171
CMMC Malicious Code Protection: Endpoint and Email Scanning Evidence (3.14.2)
CMMC 3.14.2 requires malicious-code protection at appropriate locations, with current configuration and operating evidence—not just an antivirus license.
Read guide →
NIST 800-171
CMMC System Monitoring and Security Alerts: What 3.14.6–3.14.7 Actually Require
CMMC 3.14.6–3.14.7 require monitoring for attacks and indicators of attack, plus a working process to identify and investigate unauthorized system use.
Read guide →
NIST 800-171
CMMC Risk Assessment Requirements Beyond the Vulnerability Scan (3.11.1)
CMMC 3.11.1 requires periodic risk assessment to organizational operations, assets, and individuals—not merely a vulnerability scanner report.
Read guide →
NIST 800-171
CMMC Boundary Protection: Firewalls, Segmentation, and DMZ Evidence (3.13.1–3.13.5)
CMMC boundary protection under 3.13.1–3.13.5 requires controlled communications, architecture safeguards, separation, and public-system isolation.
Read guide →
NIST 800-171
CMMC Non-Federal Organization (NFO) Controls Explained: What Rev. 2 Tailored Out and Why It Matters
NFO is a Rev. 2 tailoring category, not a hidden CMMC control set; learn what NIST expected nonfederal organizations to satisfy routinely.
Read guide →
NIST 800-171
CMMC and Collaboration Tools: Voice, Video, and Chat Platforms Carrying CUI
CMMC scoping for voice, video, chat, meetings, and collaboration tools depends on whether the service processes, stores, or transmits CUI and how it is configured.
Read guide →