NIST SP 800-171 outside the usual defense prime: universities and research institutions, contractors to civilian agencies under the proposed FAR CUI rule, and DHS's own CUI clause.
When universities and research labs must meet NIST SP 800-171 and CMMC: fundamental research and DFARS 252.204-7000, what DoD said to universities in the CMMC rule, the proposed FAR research exclusion, and the Georgia Tech False Claims Act settlement.
How NIST SP 800-171 reaches contractors to civilian agencies: the CUI rule that requires agencies to use it, the proposed FAR clause moving to Rev. 3, the SF XXX form, incident reporting to CISA, and the Government's cost estimates for non-defense contractors.
What DHS's own CUI clause requires of contractors: 1-hour and 8-hour incident reporting, FIPS-validated email encryption, 180-day evidence preservation, sanitization certificates, and adequate security defined by DHS policy rather than NIST SP 800-171.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.