NIST 800-171 for civilian agency contractors: what applies

Does NIST 800-171 apply to civilian agency contractors, and when?

Under 32 CFR 2002.14(h)(2), federal agencies must use NIST SP 800-171 when they set requirements to protect the confidentiality of CUI on nonfederal information systems, unless the CUI category's authority prescribes other safeguards or an agreement sets protection above the moderate level. The proposed FAR overhaul rule published 23 June 2026 would turn that policy into contract terms by requiring contractors that handle CUI to comply with SP 800-171 Rev. 3, but the rule was not final as of October 2026. Until it is final and your agency issues its contract language, the obligation reaches you through the specific contract, not through the regulation alone.

The exact duties depend on three things in your agreement: the CUI categories involved, the safeguarding or dissemination authority attached to them, and the organization-defined parameter (ODP) values the agency assigns. NIST does not set ODP values, and if the agency leaves them unspecified, the nonfederal organization must assign them to complete the requirement. The proposed rule would publish those values in a Standard Form, SF XXX, Controlled Unclassified Information (CUI) Requirements, so two contracts from the same agency can carry different obligations. Ask the contracting officer which CUI categories apply, whether any category prescribes its own safeguards, and whether an ODP value sheet or SF XXX will be attached.

Start with a written inventory of the contracts and subcontracts that involve CUI, and record for each one the agency, the contract number, the CUI categories and any safeguarding terms. NIST states that the agency holding the contract is responsible for applying and implementing SP 800-171 and for resolving compliance questions, regardless of the contractor's size. Put those questions to the agency in writing before you price the work, because the answers determine which of the 97 Rev. 3 requirements apply and which ODP values you must implement. Confirm the incident reporting path and the rule's status with your contracting officer as well, since the proposed rule's reporting terms are not yet binding.

How the civilian agency requirement reaches your contract

The sequence moves NIST SP 800-171 from a federal regulation into a specific contract, so each party knows which version, which parameter values and which incident reporting points apply to the work. Every step produces a document in the contract file, not a certification, and the chain was still a proposal as of October 2026.

Agency adopts NIST SP 800-171 under the CUI rule
The federal agency starts from 32 CFR 2002.14(h)(2), which requires agencies to use NIST SP 800-171 when they set requirements for protecting CUI on nonfederal information systems. The rule has exceptions where the CUI category's own authority prescribes other safeguards, or where an agreement sets protection above the moderate level. The agency owns this decision, and you can confirm it by asking the contracting officer which safeguarding authority applies to the CUI in your contract.
Proposed FAR overhaul would add a CUI clause
The FAR overhaul proposed rule published 23 June 2026 would require contractors that handle CUI to comply with SP 800-171 Rev. 3, using organization-defined parameter values published by the DoW CIO. Comments closed 23 July 2026, and the rule was not final as of October 2026. Until a final rule is issued, ask the contracting officer which version and parameter values the current contract text names, because the proposal is not yet binding.
Contracting officer issues the SF XXX form
The proposed rule would use a Standard Form, SF XXX, Controlled Unclassified Information (CUI) Requirements, to tell contractors which CUI categories the contract involves, the safeguarding or dissemination authority for each, where to report CUI incidents, and the Rev. 3 parameter values that apply. The form is issued by the agency with the contract, so it is the document to read for scope. Confirm the form's status and content with the contracting officer before scoping any work.
Incident reporting points appear in the form
The proposed rule would require CUI incidents to be reported within 72 hours of discovery, to CISA for non-DoD contracts and to dibnet.dod.mil for DoD contracts, with notice to the contracting officer and the next higher tier contractor. Incidents at FedRAMP authorized cloud providers would follow FedRAMP procedures. Your incident response plan should name these recipients only after the SF XXX confirms them for your contract.
Contractor receives the clause and SF XXX
The contractor receives the contract with the clause and the SF XXX attached, and the terms are fixed at award or modification. The output is a signed contract file with the CUI categories, parameter values and reporting points listed in writing. Ask for the complete set of attachments at award, since a clause that is referenced but not attached leaves the parameter values unclear.
Organization scopes its systems to the contract
With the contract documents in hand, the organization maps which systems store, process or transmit the listed CUI and sets the Rev. 3 parameter values into its system security plan. An implementation partner can prepare the system and evidence, but the organization owns the controls and the scope decisions. The output is a scoped system security plan that cites the contract documents, which you can check by tracing each CUI category to a named system.

What the proposed FAR clause asks you to report, and to whom

The June 2026 FAR overhaul proposed rule would turn CUI incident reporting into a contract obligation with a fixed clock, named recipients and a notification chain. The cards below separate the reporting window, the two reporting destinations, the notifications up the supply chain and the FedRAMP exception, so you can map each one to your incident response plan before the final rule is issued.

The 72-hour reporting clock

The proposed rule would require contractors to report CUI incidents within 72 hours of discovery, not of confirmation or root-cause analysis. That starts the clock at the moment someone in the organization has a reason to believe CUI may have been affected. Check whether your incident intake process lets a help desk analyst or system owner open a reportable event on day one, and whether your triage workflow can reach a reporting decision inside that window.

CISA for non-DoD contracts

For contracts outside the Department of Defense, the proposed rule would send CUI incident reports to CISA. Your incident response plan needs a documented path to that agency, the contact method it accepts, and the information fields your analysts must collect before submission. Confirm the submission channel and required content in the final rule, because a report sent to the wrong destination may not satisfy the clause.

DoD reporting on DoD contracts

Where a contract is with the Department of Defense, the proposed rule points reports to dibnet.dod.mil instead of CISA. Civilian agency contractors that also hold a defense subcontract or a mixed portfolio need separate reporting paths for each contract type, and the SF XXX form should tell you which applies. Map contract numbers to reporting destinations in your incident runbook so an analyst does not have to guess under time pressure.

Notifying the contracting officer

The proposed rule would also require notice to the contracting officer, so the federal customer learns of the incident from the contractor and not only from a regulator. Your communications plan should name who drafts that notice, who approves it and which contract records it must reference. Confirm the notification timing and content in the final text, since a notice that arrives after the reporting window may still be a compliance gap.

Notifying the next higher tier contractor

Subcontractors would also have to notify the next higher tier contractor, which means the flow-down reaches every tier that handles CUI. If you are a prime, expect to receive these notices and to need a process for passing them up or across. Review subcontract templates now to confirm that incident notice duties, contact points and cooperation terms are written into each agreement.

The FedRAMP cloud provider exception

Incidents at FedRAMP authorized cloud providers would be reported under FedRAMP procedures rather than through the 72-hour route, which can change who files and who holds the evidence. This exception does not remove your duty for incidents on your own systems. Inventory which CUI workloads run on authorized cloud services, record each provider's reporting obligations, and confirm how your contract with that provider allocates the report.

What the Government estimated civilian contractors would spend

This table sets the Government's estimated labor, hardware and software costs for small and other businesses against the aggregate estimate for 5,875 non-defense contractors. Read the Government figures as a baseline from the rulemaking, not a quote, and use the bottom rows to list what your own proposal must price.

Cost component	First year	Recurring (each year after)
Labor, small business (1,560 hours at $95 first year; 1,040 hours after)	About $148,200, per the January 2025 FAR CUI proposed rule	About $98,800, per the January 2025 FAR CUI proposed rule
Hardware and software, small business	Average $27,500, per the January 2025 FAR CUI proposed rule	Average $5,000, per the January 2025 FAR CUI proposed rule
Hardware and software, business other than small	Average $140,000, per the January 2025 FAR CUI proposed rule	Average $80,000, per the January 2025 FAR CUI proposed rule
Aggregate, 5,875 non-defense contractors (Rev. 2 implementation)	$1,524,706,500, per the 2024 rule estimate, of which $861,808,500 fell on 4,905 small businesses	$1,065,919,000 a year, per the 2024 rule estimate
Assessor fees (if an independent assessment is required)	Ask for a written fee tied to your scope	Confirm with the contracting agency whether reassessment applies
Implementation partner services	Quote from a written, fixed scope	Ask whether support or testing retainers are priced separately
Internal staff time (compliance, IT, security)	Estimate hours by role in your own environment	Estimate ongoing monitoring, reviews and evidence upkeep

What makes your cost higher or lower than the estimate

The federal estimate is an average across many contractors, so your own figure depends on the systems in scope, where CUI sits, and how much work already exists. The cards below cover the drivers that move a quote up or down and the checks to run before you ask for one.

Number of systems that hold CUI

Every system that stores, processes or transmits CUI must meet the requirements, so the count of in-scope systems is usually the largest driver of labor and tooling. Start with a data flow map that shows where CUI enters, moves and is copied, including email, file shares, collaboration tools and backups. Each system you exclude must be justified in the system security plan, and reducing scope usually reduces cost faster than any other single change. Ask any quote to list each in-scope system by name.

Cloud enclave or on-premises CUI

Keeping CUI in a dedicated cloud enclave can narrow the boundary to fewer systems, but the enclave's provider, configuration and logging still fall within your assessment scope. Confirm whether the cloud provider's authorization covers your use, and who pays for the enclave's license, monitoring and administration. On-premises environments cost more in hardware and physical controls, while cloud environments shift cost toward subscriptions and configuration work. Ask the quote to separate one-time build effort from monthly platform fees.

Organization-defined parameters the agency sets

Rev. 3 requires values for organization-defined parameters, and NIST does not assign them. If the agency does not specify values in the contract, your organization must choose them, which means more analysis, documentation and sometimes stronger controls than the agency would have chosen. Under the proposed FAR rule, DoW CIO-published values would apply instead. Ask the contracting officer which parameter values apply and whether they are fixed, so the quote does not include guesswork.

Existing policy and evidence maturity

Organizations with written policies, current system security plans, tested backups and centrally collected logs need less new work than those building these from scratch. Rev. 3 also turns foundational policy and procedure controls into explicit requirements, so gaps there add effort. Review what you already have against the requirement families and record which evidence is current, which is out of date and which does not exist. This inventory is often the most useful input to a fixed-scope quote.

Third-party service providers

Outside providers that host, process, maintain or support CUI systems extend your scope and your evidence burden. You are responsible for their compliance with the requirements that apply to them, which means contract terms, reviews of their security assessments and documented supply chain risk decisions. Each provider that touches CUI adds review work, and providers without current assessment evidence may require replacement or added controls. Ask for the provider inventory before accepting a quote, and confirm which costs the vendor will absorb.

Who owns the controls, who prepares evidence, and who assesses

The contracting organization owns its controls. Under NIST SP 800-171, the nonfederal organization is responsible for implementing the requirements on the systems that process, store or transmit CUI, and for writing the system security plan that describes how each requirement is met. NIST also states that application and implementation of SP 800-171, and any compliance issues, are the responsibility of the federal agency that holds the contract or agreement, whatever the organization's size. Before any work starts, confirm with the contracting officer which version and which organization-defined parameter values apply. Under the proposed FAR rule, those values would come from a standard form, so ask whether your contract already names the ODP values you must assign.

An implementation partner such as DeployOpen prepares the systems and the evidence. That work covers configuring the platforms, documenting how each control is operated, collecting logs and configuration exports, and organizing the plan of action and milestones. DeployOpen does not issue assessment reports, attestations or certificates, and it does not decide whether a requirement is met. That decision belongs to the agency reviewing the submission, or to an independent assessor where the contract calls for one. Put the split in writing in the statement of work: who writes each part of the system security plan, who signs it, and who receives the evidence package.

Ask the agency or contracting officer exactly who will review the score or evidence, what form that review takes, and whether it is an independent assessment or an internal determination. Agree the evidence format before implementation, not after. Test that the reviewer can trace each requirement to a configuration, a policy and a log sample, and confirm whether the agency expects you to hire an outside assessor. Keep the ownership record current, because the agency will hold you responsible for any gap, including gaps created by a partner's work.

What to have in place before the contract requires it

Civilian agency contracts can name NIST SP 800-171 before any formal assessment exists, so the gap between a signed award and a working program is where delays happen. The checks below connect the plan, the boundary, the parameter decisions, the reporting runbook and the evidence, and each one can be verified by the contractor before the agency asks.

Current system security plan

The system security plan describes how each requirement is met in the systems that handle CUI, who owns each control and where its evidence lives. Check that it names every system in the boundary, that each of the 97 Rev. 3 requirements has a stated implementation or an explicit reason it does not apply, and that a named person reviews it on a set schedule. A plan written for a different contract or a different scope will fail review quickly. Ask whether it has been updated since the last system change.

Scoped CUI boundary

Every system, account, device and service that stores, processes or transmits CUI sits inside the boundary, and everything else is kept out or separated by controls. Test the boundary by tracing a real CUI document from receipt to deletion, listing each system it touches, including email, collaboration tools, backups and support tickets. Confirm that remote administrators and managed service providers with access are inside the boundary or covered by written agreements.

Documented ODP decisions

Rev. 3 requirements contain organization-defined parameters, such as review frequencies and time limits, that the federal agency may set or may leave to the contractor. Where the contract does not supply values, the contractor must assign them. Record each value, the reason for it and the date it was approved, and check that the agency's contract documents do not already specify different values. The proposed FAR rule would have the DoW CIO publish values for defense contracts, so watch for a parallel source on civilian contracts.

Incident reporting runbook

The June 2026 proposed FAR overhaul would require CUI incident reports within 72 hours of discovery to CISA for non-DoD contracts, and notice to the contracting officer and the next higher tier contractor. Build a runbook that starts with discovery, names who decides it is a reportable incident, drafts the report, preserves evidence and tracks notifications. Test it with a tabletop exercise. Confirm the final rule's timelines before relying on this, since the rule was not final as of October 2026.

Evidence for all 97 requirements

Assessors test each requirement by examining artifacts, interviewing people and, for most requirements, running a test. Build an evidence index with one row per requirement that names the artifact, its owner, its location and the date it was last produced. Examples include access review exports, audit log samples, patch reports, training records and change tickets. Sample the index quarterly, and confirm that each row would satisfy the determination statements in SP 800-171A Rev. 3.

Assessment and score readiness

Agencies may ask for a current score or evidence of an independent assessment, so the contractor should know which scoring method applies and who holds the scoring records. Check whether the contract names an assessment method, whether an open plan of action and milestones exists for unmet requirements, and who signs off on the score. Ask the contracting officer which version of the requirements the contract cites, since Rev. 2 and Rev. 3 require different scoring work.

In-house or outside help for civilian contract readiness

Keeping the work internal suits organizations that already run mature security and platform teams, have a contained CUI boundary, and can staff the project for its full length. Your own people write the System Security Plan, select and assign the organization-defined parameter values, configure the systems, and collect the evidence that an assessor will examine. The contracting agency holds the compliance responsibility either way, so internal ownership gives you the most direct control over decisions and over what the record says.

Staff time: Budget for security, IT and compliance staff to work on the project alongside their regular duties, and plan for the recurring labor the rule's cost estimates describe.
Skills gap: Confirm that someone on the team can configure logging, encryption, identity and boundary controls to the Rev. 3 requirements, not just describe them.
Parameter decisions: Your team must assign organization-defined parameter values where the agency does not specify them, and document why each value was chosen.
Ongoing evidence: Recurring evidence such as access reviews, vulnerability scan results and training records needs an owner after the project ends.

Before you commit, ask whether your team can produce an accurate, current System Security Plan and Plan of Action and Milestones without outside help.

Questions civilian contractors ask about NIST 800-171

Is the FAR CUI rule final for civilian agency contractors?

No. As of October 2026, the FAR overhaul proposed rule published on 23 June 2026 is still a proposal, and its comment period closed on 23 July 2026. As proposed, it would require contractors handling CUI to comply with SP 800-171 Rev. 3 using organization-defined parameter values published by the DoW CIO, and it would introduce the SF XXX form. Until a final rule takes effect, your contract governs. Agencies can already require NIST SP 800-171 under 32 CFR 2002.14(h)(2), so ask the contracting officer which version and parameter values your contract cites, and track the Federal Register proposal for the final text.

Does NIST SP 800-171 Rev. 2 or Rev. 3 apply to my civilian contract?

The version named in your contract applies, so settle that question in writing before planning the work. Rev. 3 contains 97 requirements in 17 families. Rev. 2 contained 110 requirements in 14 families, and NIST withdrew it on 14 May 2024. The proposed FAR overhaul would move civilian contractors to Rev. 3 with agency-published parameter values. Defense contracts follow a separate track: DoW Class Deviation 2026-O0025, Revision 3 names Rev. 2 explicitly in DFARS 252.204-7012. Confirm the version, the organization-defined parameter values and any agreed exceptions with the agency, because building to one revision and being assessed against the other creates rework.

What did the Government estimate SP 800-171 would cost civilian contractors?

The Government's estimates were built on the Rev. 2 requirements, so treat them as a published baseline, not a quote for your environment. The FAR CUI proposed rule of January 2025 put the first-year cost for 5,875 non-defense contractors at $1,524,706,500, of which $861,808,500 fell on 4,905 small businesses, with recurring costs of $1,065,919,000 a year. For a small business, it estimated first-year labor at about $148,200 (1,560 hours at $95) and about $98,800 a year after that (1,040 hours). It estimated hardware and software at $27,500 in the first year and $5,000 a year after. For businesses other than small businesses, it estimated $140,000 in the first year and $80,000 a year for hardware and software. Your actual figures depend on existing controls, system scope and whether labor is in-house or bought.

How long does preparing for NIST SP 800-171 take for a civilian contract?

No supplied duration exists for this, so ask the agency before accepting any timeline. Preparation time depends on how far your systems already meet the requirements, how much CUI falls within the system boundary, and how many organization-defined parameter values the agency has assigned. Typical work includes writing the system security plan and plan of action and milestones, configuring identity, logging, encryption and boundary controls, and collecting evidence for assessment. Ask the contracting officer for the delivery date, the version that applies and whether a plan of action is accepted at award. Any implementation partner should provide a written schedule tied to a fixed scope before work starts.

Can a civilian contractor meet NIST SP 800-171 without outside help?

Yes, a contractor can implement the requirements in-house if it has the staff, skills and time, and the Government's labor estimates assume that kind of internal effort. Accountability stays with you either way. NIST says the application, implementation and any compliance issues are the responsibility of the federal agency that holds the contract, irrespective of the organization's size. In-house teams typically handle policies and procedures, the system security plan, access and logging configuration and evidence collection. Outside help is often used for a gap assessment, technical hardening and evidence preparation. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms in your own infrastructure and prepares evidence, but it does not issue assessments or certifications.

How does the SF XXX form change what my contract requires?

If the proposed FAR rule is finalized as written, the SF XXX form would give you a single statement of your CUI obligations for each contract. It would list the CUI categories involved, their safeguarding or dissemination authority, where to report incidents, and the Rev. 3 organization-defined parameter values that apply. The proposal would also require reporting CUI incidents within 72 hours of discovery, to dibnet.dod.mil for DoD contracts and to CISA for non-DoD contracts, with notice to the contracting officer and the next higher tier contractor. Incidents at FedRAMP authorized cloud providers follow FedRAMP procedures. Because the form exists only in the proposal, check its fields against the final rule and your agency's instructions before you build controls around it.

How DeployOpen prepares your systems and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so that the NIST SP 800-171 requirements your civilian agency contract names can be shown with evidence. Your organization owns its controls and its submissions, and an independent assessor issues any assessment result.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
Scoping confirms which systems store, process or transmit the CUI named by your agency's contract.
Confirm with your contracting officer which Rev. 3 organization-defined parameter values apply to your contract.

How we build

We configure and harden self-hosted platforms in your cloud accounts, data centers or air-gapped networks.
Access control, logging, encryption and boundary settings are built to match each requirement in your system security plan.
Security testing of applications, APIs and infrastructure checks that the implemented controls behave as documented.

How we hand over

You receive documentation mapping each implemented control to the requirement it supports and the evidence that shows it.
Evidence packages are organized for the independent assessor, so they can test each determination statement directly.
Ownership of configurations, documentation and runbooks transfers to your team at handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can keep evidence current as systems change, including plan of action and milestones updates.
Confirm with your agency and assessor which submissions and score updates remain your responsibility after handover.