Who must comply with NIST 800-171

Who must comply with NIST 800-171 when a contract requires it

The obligation falls on the nonfederal organization that handles or protects controlled unclassified information (CUI) under a contract or agreement that requires it, most often a DoD contract carrying DFARS 252.204-7012. The requirement reaches only the systems and components that process, store or transmit CUI, or that provide protection for those components. Under 32 CFR 2002.14(h)(2), federal agencies use NIST SP 800-171 when setting CUI safeguards for nonfederal systems, so the requirement arrives through the contract rather than through a general law that applies to every business. The NIST FAQ states that the federal agency holding the contract is responsible for application and compliance issues, regardless of the organization's size, and that no special provisions exist for small or mid-size organizations.

Several factors change the answer for each organization. The first is the contract vehicle: a DoD solicitation or contract generally carries DFARS 252.204-7012 under DFARS 204.7304(c), and that clause flows down to subcontracts that involve covered defense information. The second is whether the work is solely commercially available off-the-shelf (COTS) items, which DFARS 204.7304(c) excludes from the clause. The third is the system map: confirm which laptops, servers, cloud tenants, email accounts and backup stores touch CUI, and which only receive it incidentally. A system that a contractor operates for an agency is treated as a federal system under 2002.14(h)(1), which brings different rules. The fourth is civilian work. The proposed FAR overhaul rule of 23 June 2026 would add a governmentwide CUI clause requiring SP 800-171 Rev. 3, but it was not final as of October 2026, so confirm which revision the contracting officer names.

Your organization owns its controls. An implementation partner can prepare the systems, documentation and evidence, but only an independent assessor or certification body issues assessment results. Before you bring in outside help, ask the contracting officer which SP 800-171 revision and which DFARS clause version apply, and document your CUI scope in writing. Use the NIST SP 800-171 Rev. 3 publication page to review the requirements, and confirm the current revision with the contracting officer before you commit to a plan.

Which contracts and agreements bring NIST 800-171 obligations

NIST SP 800-171 usually reaches an organization through a contract or agreement rather than by law alone. The triggers below differ in who imposes the requirement, which revision applies and where the obligation is written, so the contract text is the first place to look.

DoD prime contracts

DFARS 204.7304(c) prescribes clause 252.204-7012 for DoD solicitations and contracts, including those for commercial products and services, except those solely for commercially available off-the-shelf items. If the contract covers covered defense information, the clause requires implementing SP 800-171 on covered contractor information systems. Check the Section I clauses and any CUI marking in the statement of work. A COTS-only award may not carry the clause at all. Confirm which revision the contracting officer names, since the 2026 class deviation points to Revision 2.

DoD subcontracts, including commercial

DFARS 252.204-7012(m) requires primes to flow the clause down without alteration to subcontracts for operationally critical support, or whose performance involves covered defense information. The flow-down reaches commercial subcontracts too. Check each subcontract for the clause text, the definition of covered defense information, and whether your role makes you a subcontractor handling CUI or only a supplier of a COTS product. Ask the prime which revision and assessment status it expects from you.

Civilian agency contracts under the proposed FAR rule

A FAR overhaul proposed rule published 23 June 2026 would add a governmentwide CUI provision and clause, FAR 52.240-6 and 52.240-7, and would require SP 800-171 Rev. 3 on non-Federal systems handling CUI. It was a proposal, not a final rule, as of October 2026. Until it is final, civilian contracts reach you through their own CUI terms. Check whether the solicitation names CUI, which SP 800-171 revision it cites, and whether a standard form identifies the CUI in the contract.

Grants and agreements that name CUI

Federal agencies must use NIST SP 800-171 when setting requirements to protect CUI on non-Federal systems under 32 CFR 2002.14(h)(2), unless the CUI category's authority prescribes other safeguards or an agreement sets protection above the moderate level. Grants, cooperative agreements and other agreements can therefore name CUI and the revision to follow. Check the award terms for CUI designations, any higher protection level, and who is responsible for compliance under the agreement.

Federal systems operated for an agency

Under 32 CFR 2002.14(h)(1), a system a contractor operates on behalf of an agency is treated as a Federal information system, so the agency's own requirements apply and may go beyond SP 800-171. By contrast, under 2002.14(h)(2), a system that receives federal information only incidentally to providing another product or service is not a Federal system. Check the statement of work for who operates the system, where the CUI is stored and whether the agency sets additional requirements.

How the DFARS clause reaches subcontractors and suppliers

DFARS 252.204-7012(m) requires a prime contractor to flow the clause down without alteration to subcontracts for operationally critical support, or to any subcontract whose performance involves covered defense information. The flow-down reaches commercial subcontracts too. DFARS 204.7304(c) prescribes the clause for all DoD solicitations and contracts, including those for commercial products and services, with one exception: solicitations and contracts solely for commercially available off-the-shelf (COTS) items. A prime should not assume a supplier is outside the clause because it sells commercial goods. The practical decision is per subcontract: does the work involve covered defense information, or is the supplier providing operationally critical support? Procurement and the program office should record that answer in each subcontract file, and the answer should be revisited when the statement of work changes.

A subcontractor that handles covered defense information owes the same obligations the prime owes under the clause, including implementing NIST SP 800-171 on its covered systems and reporting cyber incidents. The subcontractor reports incidents to DoD and, as the clause requires, to the prime, so the prime needs the subcontractor's incident contact and reporting arrangements before work starts. Ask each subcontractor for its own System Security Plan, its current assessment status, and its SPRS posture where it has one. Confirm these with the subcontractor directly, because the prime cannot certify a subcontractor's compliance on its behalf.

The prime still owns the contract relationship with the government. Flowing the clause down does not transfer accountability for the prime's own covered systems or for the way it oversees its supply chain. Document the flow-down decision, the subcontractor's evidence, and any variance or exception requested through the contracting officer. Your sourcing team should check whether an agreement with a supplier is enough, or whether the supplier's systems must be reviewed directly before CUI is shared.

Which rule applies to your contract today

This table compares the governing rule, the SP 800-171 revision that applies, and what to confirm for four common contract types. Read each row against your own contract, because the revision a contracting officer names in the solicitation or award controls your obligation, not a general summary.

Contract type	Governing rule	Which SP 800-171 revision applies	What to confirm
DoD contract or subcontract with DFARS 252.204-7012	DFARS 252.204-7012 flowed down by the contract, backed by CMMC requirements where they apply	Rev. 2 is named in the September 2026 DFARS class deviation and the July 2026 DoW CIO memorandum requiring baseline compliance	Current revision and any CMMC level with the contracting officer, and whether the subcontract flows the clause down unchanged
Civilian agency contract under the proposed FAR CUI clause	Proposed FAR overhaul rule (23 June 2026) adding FAR 52.240-6 and 52.240-7, not yet final	The proposed rule would require Rev. 3 using ODP values published by the DoW CIO	Whether the FAR rule is final, which clause appears in your contract, and which ODP values the agency specifies
Agency grant or university agreement	The terms of the grant or agreement and the CUI category's own authority under 32 CFR Part 2002	Set by the agency in the agreement, so confirm the edition named there rather than assuming Rev. 2 or Rev. 3	Whether the agreement names SP 800-171 by revision, any protection above the moderate level, and who assigns organization-defined parameters
COTS-only purchases	DFARS 204.7304(c) excludes solely commercially available off-the-shelf items from the clause	No SP 800-171 revision applies to a purchase that is solely COTS, unless another clause or agreement adds one	Whether any other item, service or data in the same contract is not COTS, and whether CUI will be handled at all

Which systems fall inside the SP 800-171 boundary

The boundary for NIST SP 800-171 is drawn by where CUI goes, not by how big the company is. The cards below set out the rules that decide whether a system is in scope, and the question to put to your own data flows and contract before you decide.

Systems that process, store or transmit CUI

Any system where CUI is created, opened, saved, sent or retained falls inside the boundary. This includes file shares, email, collaboration platforms, engineering tools and backups that hold CUI, even briefly. Ask your program team to list every place CUI appears in a contract deliverable, then trace each copy from creation to disposal. A system that never sees CUI in that trace is a candidate for exclusion, but only after you verify it.

Components that protect CUI systems

Security components are in scope when they protect systems that handle CUI, even if they never touch CUI themselves. Identity providers, firewalls, logging collectors, endpoint agents and key management servers commonly fall here. Check each security tool against the question: if this component failed or were compromised, could it weaken protection for a CUI system? If yes, the assessor will expect it in your system security plan.

Systems operated for an agency

Under 32 CFR 2002.14(h)(1), a system a contractor operates on behalf of an agency is treated as a Federal information system, as though the agency owned it, and is open to additional agency requirements. This matters when you host a government-run portal or manage a system for a customer agency. Ask the contracting officer or agency whether the system is theirs in substance, because that answer changes which rules apply.

Systems that only incidentally receive federal information

Under 32 CFR 2002.14(h)(2), a system that receives federal information only incidentally to providing another product or service is not a Federal information system. A typical case is a vendor platform that receives a federal file during a support ticket but is not built or contracted to hold it. Document the reasoning and the controls that prevent routine storage, because incidental handling must stay incidental to be treated this way.

Cloud and managed service providers

A cloud or managed service provider that stores, processes or transmits CUI, or that protects a CUI system, sits inside the boundary of the work you give it. Under DFARS 252.204-7012, the cloud provider must also meet specific requirements. Ask each provider where CUI resides, who administers it, and whether it can supply the evidence your assessment will request. Contract language should name these duties before the provider receives any CUI.

Rev. 3 reaches only the components that matter

NIST states that SP 800-171 Rev. 3 applies only to components of nonfederal systems that process, store or transmit CUI, or that protect such components. Use that statement as the test for each system on your list, and record the result with the reason. Confirm which revision your contract cites, because the scope test is written against Rev. 3 while many current DoD contracts reference Rev. 2.

Who owns the obligation, who prepares the evidence, and who assesses it

Your organization owns the obligation. The contract or agreement that carries NIST SP 800-171 binds your company, and the controls, the system security plan and the scope decisions are yours to make and to defend. NIST's FAQ says application and implementation of SP 800-171, and any compliance issues, rest with the federal agency that holds the contract with you, regardless of your size. You cannot hand that accountability to a vendor, even when a vendor does much of the technical work.

Controls and operation: You operate the safeguards every day, including access, logging, patching, incident response and media handling.
System security plan: You write, approve and keep current the plan that describes your systems, boundaries and how each requirement is met.
Scope decisions: You decide which systems process, store or transmit CUI, or protect components that do, and you document that boundary.
Contract responsibilities: You answer to the contracting officer, flow requirements down to subcontractors and report cyber incidents on time.
Organization-defined parameters: Where the agency has not supplied values for Rev. 3 parameters, you must assign them to complete the requirement.

Confirm with your contracting officer which SP 800-171 revision and parameter values apply to your contract before you scope any work.

How to confirm you are covered before you commit budget

This sequence turns a contract requirement into a written scope that names the rules, the systems and the SP 800-171 revision that apply, so budget goes to the systems that actually need the controls. Each step ends with a document you keep and can show an assessor or contracting officer.

Pull the contract clauses and CUI markings
Start with the solicitation and the signed contract, and list every clause that mentions safeguarding, covered defense information, CUI or incident reporting. For DoD work, the clause to look for is DFARS 252.204-7012, which the DFARS prescribes for DoD solicitations and contracts, with narrow exceptions for commercially available off-the-shelf items. For civilian agency work, check whether the contract carries a CUI provision or clause. Then review the statement of work and the attached data for CUI markings or identified categories. Keep a clause register that lists each clause, its date, the contract line it sits in, and the data it covers. You are done when every CUI-related clause and every marked data set appears in that register.
Inventory the contractor systems that touch CUI
Working with IT, engineering and the program team, list every system that will create, receive, process, store or transmit CUI, including email, file shares, collaboration suites, engineering tools, build pipelines, laptops and any cloud service that holds CUI. Record the owner, location and hosting model for each. Include systems that receive federal information only incidentally to another product or service, and note why each is or is not expected to hold CUI. NIST states that SP 800-171 applies to components of nonfederal systems that process, store or transmit CUI or that protect those components, so this inventory defines the starting point. You are done when the inventory is signed off by the system owners and the security lead.
Map the boundary and the subcontractors inside it
Take the inventory and draw the boundary: which components store, process or transmit CUI, and which components only protect them, such as identity providers, logging, backups and security tools. Mark anything that sits outside the boundary and explain why it cannot touch CUI. Then list each subcontractor or external service that will receive CUI or support operationally critical work. DFARS 252.204-7012 requires the clause to flow down without alteration to subcontracts for operationally critical support or where performance involves covered defense information, including commercial subcontracts. Record which subcontracts carry the flow-down and which do not, and why. You are done when you hold a boundary diagram and a subcontractor table that match the inventory.
Confirm the SP 800-171 revision and ODP values
Ask the contracting officer in writing which revision of SP 800-171 the contract requires. Rev. 2 and Rev. 3 differ in requirement count and structure, and the governing text for DoD work is a moving target during the current rulemaking. Also ask whether the agency has specified values for any organization-defined parameters, since NIST does not assign those values and the nonfederal organization must assign them if the agency does not. Request the answer in writing and file it with the contract. You are done when the contracting officer's reply names the revision and states the ODP position, or when you have a documented question that remains open.
Record any variance request before relying on it
If a requirement appears not applicable to your environment, or you have an alternative you believe is equally effective, do not treat that as settled. DFARS 252.204-7012 lets a contractor ask the contracting officer to submit the question for DoD CIO adjudication before relying on a variance. Prepare a short written request that names the requirement, the reason it is not applicable or the alternative control, and the systems affected. Keep the request and the reply with the scope file. You are done when each variance either has a written DoD CIO decision or is recorded as an unresolved item that the scope statement treats as a gap.
Sign a written scope statement
Combine the clause register, system inventory, boundary map, subcontractor list, contracting officer replies and variance records into one scope statement. It should state what is in scope, what is out of scope and why, which SP 800-171 revision and ODP values apply, and which open questions remain. Procurement and the compliance lead sign it, and the system owners acknowledge the systems assigned to them. Ask any implementation partner to work from this document and to quote against it. You are done when the signed statement exists and any budget request cites it. Revisit it when a new contract, subcontract or system changes the boundary.

What usually leads to the wrong scope, and how to avoid it

Most scoping errors come from treating the boundary as an IT org chart instead of a data flow. The cards below cover the mistakes assessors and contracting officers see most often, the rule behind each one, and a check you can run before you commit to a scope.

Assuming size exempts the company

NIST states that there are no special provisions for small or mid-size organizations, and the same level of CUI protection is expected regardless of size. A company with a handful of employees that receives CUI under a DoD contract carries the same obligation as a prime with thousands. Check the contract for CUI or covered defense information, not your headcount, to decide whether SP 800-171 applies. Ask the issuing contracting officer to confirm in writing if the contract language is unclear.

Scoping only the corporate network

CUI often lives where the corporate network does not reach: engineering file shares, CAD and test environments, cloud tenants, collaboration tools and laptops used by program staff. SP 800-171 applies to every component that processes, stores or transmits CUI, and to components that protect those components. Build a data flow map that starts from where CUI enters and follow it through email, cloud storage, build servers and backups. Anything on that path belongs in the boundary unless it is properly separated.

Missing subcontract flow-down

DFARS 252.204-7012 must be flowed down without alteration to subcontracts that involve covered defense information or provide operationally critical support, including commercial subcontracts. Primes often underestimate how many of their suppliers qualify, and subcontractors often assume the clause does not reach them. Inventory every subcontract and purchase order that touches CUI or supports a covered system, then confirm each one carries the clause and that the subcontractor has its own SPRS score posted where required.

Treating a COTS purchase as covered

DFARS 204.7304(c) excludes solicitations and contracts solely for commercially available off-the-shelf items from the clause. That exclusion applies to the contract, not to the product. A COTS item bought for a contract that also involves CUI, or a service that hosts CUI, can bring the environment into scope. Read the solicitation and the contract line items, then document the decision. If you rely on the COTS exclusion, keep the contract language and the reasoning in your file.

Relying on an outdated revision

Rev. 3 was published in May 2024, yet DoD contracts and CMMC still reference Rev. 2 with its 110 requirements. A DoW class deviation signed 3 September 2026 names Revision 2 explicitly, while a proposed FAR rule would move civilian-agency contractors to Rev. 3. Confirm which revision the contract cites, which one your CMMC level assesses, and whether a pending rule could change it before you finish the program. Plan a mapping that keeps both revisions traceable so the scope does not need to be redrawn.

Leaving ODP values unassigned

Rev. 3 introduced organization-defined parameters, which are values such as frequencies or time limits that the requirement leaves open. NIST does not assign them. If a federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Leaving them blank means the requirement is incomplete, even if the control exists. Pull the OSCAL catalog, list every ODP that touches your scope, confirm with the agency whether it has set values, and record your own assignments in the system security plan.

Common questions about who must comply with NIST 800-171

Does a small company have to comply with NIST 800-171?

Yes, if the company stores, processes or transmits CUI under a federal contract or agreement. Size does not change the expectation. NIST states that SP 800-171 has no special provisions for small or mid-size organizations, and the same level of CUI protection applies regardless of headcount. The federal agency that issued the contract is responsible for how compliance is applied and checked, so the contract's clauses and that agency's requirements define what a small firm must show. Scope matters more than size. Only components that process, store or transmit CUI, or that protect those components, fall under the requirements. A small company with one engineering system that touches CUI has a smaller boundary to protect, but it still owes every applicable requirement, including a system security plan. Ask the contracting officer which revision and clauses apply before you buy tooling. NIST FAQ on SP 800-171 Rev. 3 explains how NIST applies these expectations.

Must a subcontractor comply with NIST 800-171 when the prime does?

Usually yes, because the prime must pass the requirement down. DFARS 252.204-7012(m) requires the prime to flow the clause down without alteration to subcontracts for operationally critical support and to subcontracts whose performance involves covered defense information. The flow-down reaches commercial subcontracts too. A subcontractor that handles covered defense information on its own systems must implement SP 800-171 on those systems. A subcontractor that receives no covered defense information and provides no operationally critical support may fall outside the clause, so the prime should check each subcontract's work against the clause terms. Prime contractors should also ask subcontractors for evidence, such as their current assessment status, their system security plan and their incident reporting arrangements. Read the DFARS 252.204-7012 text before writing subcontract terms, because wording changes can break the flow-down.

Does buying commercial products trigger DFARS 252.204-7012?

Not automatically. DFARS 204.7304(c) prescribes clause 252.204-7012 for all DoD solicitations and contracts, including those for commercial products and services. The exception covers solicitations and contracts solely for commercially available off-the-shelf (COTS) items. If an award includes work beyond buying COTS items, such as services, custom development or hosting that handles CUI, the clause is likely to apply to that work. Buying a COTS product for your own use does not by itself bring your systems into scope. Systems that handle covered defense information under a covered contract do fall under the clause, however. Ask the contracting officer to confirm in writing whether the solicitation is solely COTS. Read the award's full clause list, because one covered line item can carry the clause into the whole award. The DFARS subpart 204.73 text sets out the prescription.

Must a university or civilian contractor comply with NIST 800-171 today?

Only if the contract or agreement says so. The FAR overhaul proposed rule was published on 23 June 2026. It would require contractors handling CUI to comply with SP 800-171 Rev. 3 using organization-defined parameter values published by the DoW CIO. Comments closed on 23 July 2026, and the rule was not final as of October 2026, so it does not bind contractors yet. Separately, 32 CFR 2002.14(h)(2) requires federal agencies to use SP 800-171 when they set requirements for CUI on nonfederal systems, so an agency's own agreement terms may already require it. Universities and research institutions face the same test: do they receive or hold CUI under an agreement that names the standard? Read the agreement's clauses, ask the agency which revision applies, and track the final rule in the Federal Register proposal. Planning early is reasonable, but a proposed rule carries no obligation until it becomes final.

Can an implementation partner make our organization NIST 800-171 compliant?

No. Compliance is an outcome the organization owns, because the controls run through its own people, processes and systems. An implementation partner can plan, implement, harden, document and back up the systems that support the controls, and prepare the system security plan, configuration baselines and evidence the requirements call for. DeployOpen works this way on self-hosted open-source platforms inside the client's cloud accounts, data centers or air-gapped networks. The partner does not issue results. An independent assessor issues assessment outcomes, such as a DCMA DIBCAC assessment or a CMMC third-party assessment where those apply, and the organization is responsible for the score it posts. Before engaging any partner, ask for a written scope that names the deliverables it prepares, the decisions that stay with your leadership, and the steps that belong to the assessor.

How long and how much does confirming NIST 800-171 scope take?

No researched figure is available for this, so confirm it with the contracting officer and in a written scope from any partner. Scoping effort usually depends on how many systems touch CUI, how data moves between them, whether cloud or external service providers are involved, and how complete your existing documentation is. Each factor can raise or lower the effort. Ask the contracting officer which CUI categories apply, which SP 800-171 revision and clauses govern the contract, and whether any variance from a requirement is under consideration. Then request a fixed-scope proposal that lists the systems inside and outside the boundary, the deliverables, the assumptions and the people on your side who must take part. DeployOpen agrees scope, deliverables and timelines in writing before work starts and does not publish a price list, so a quote follows from that written scope.

Which NIST 800-171 revision must our contract require in October 2026?

The revision named in your contract's clauses controls, and the clauses changed recently. DoW Class Deviation 2026-O0025, Revision 3, signed on 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly. It cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. The 110 Rev. 2 requirements therefore remain the working baseline for DoD contracts. Rev. 3, with 97 requirements, is NIST's current version, and the proposed FAR rule would move civilian contractors to it. Check the solicitation's clause dates and wording, plan against the revision your contract cites, and watch for further changes to the deviation. The DoW deviation memorandum is the primary text to review with counsel.

How DeployOpen scopes NIST 800-171 work before any build begins

Before anyone builds a CUI enclave or changes a system, DeployOpen works with your team to confirm which contract, subcontract and systems bring NIST SP 800-171 into scope. The organization owns its controls and its compliance position. DeployOpen prepares systems, documentation and evidence, and an independent assessor or the contracting agency makes the formal determination.

How we scope

Confirm which contract, subcontract or agreement requires SP 800-171 and which revision it names.
Identify the systems that process, store or transmit CUI, and the components that protect them.
Agree the scope in writing as a fixed-scope statement covering systems, deliverables and timelines.

How we build

Implement or harden the in-scope platforms inside your own cloud accounts, data centers or air-gapped networks.
Configure access control, audit logging, encryption and boundary protections against the agreed requirements.
Test each configured control and record the results so they can be checked against the assessment procedures.

How we hand over

Deliver the system security plan, policies, procedures and the evidence each requirement needs.
Document any organization-defined parameter values that your contracting agency has not already specified.
Confirm with your assessor which artifacts they expect before any formal assessment begins.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after handover.
Keep the system security plan and evidence current as systems, contracts or revision requirements change.
Confirm the current DoD revision and any pending FAR changes with the contracting officer before planning work.

Who must comply with NIST 800-171