CIS Controls vs NIST 800-171

CIS Controls vs NIST 800-171: which one a CUI contractor needs first

If your organization handles controlled unclassified information (CUI) under a federal or defense contract, NIST SP 800-171 is the requirement set that the contract points to, and the CIS Controls are a voluntary, prioritized set of safeguards that help you build the controls 800-171 asks for. You do not choose between them. You use the CIS Controls to get the work done and use 800-171 to define what done means for your contract. Start by reading the contract clause that names the security requirement and the revision it cites, because that revision decides which requirements apply to you.

The revision question matters more than most teams expect. Rev. 2 has 110 requirements in 14 families and remains the set that DoD contractors are assessed against under the CMMC Level 2 rule, and the DoW has recently pointed contracting officers to Rev. 2 by name. Rev. 3 has 97 requirements in 17 families and uses organization-defined parameters that the nonfederal organization may have to assign itself if the agency does not. Confirm with your contracting officer which revision applies to each contract, and whether any proposed rule that would move the requirement to Rev. 3 has become final, before you map your program to either document.

CIS work does not replace an 800-171 assessment. CIS publishes a mapping to both Rev. 2 and Rev. 3, which is a useful way to find where your existing safeguards already cover a requirement and where they do not. A mapping shows a relationship between two sets of text, not that a requirement is met, and neither CIS nor NIST certifies that an organization conforms. Use the mapping to build a gap list, then collect evidence against each 800-171 requirement, including the parameter values your contract requires. Ask the assessor or contracting officer which evidence they expect before you treat any CIS safeguard as credit toward a specific requirement.

How the CIS Controls and NIST SP 800-171 differ on scope, structure and proof

This table compares who requires each framework, how it is structured, who publishes it, how it is licensed, which version is current and what proof it produces. Read it to separate the contractual CUI requirement from the prioritized set of safeguards you can use to close gaps against it.

Factor	CIS Controls v8.1	NIST SP 800-171
Who requires it	No regulator or contract requires it by default. CIS states the Controls do not replace any regulatory, compliance or authorization scheme.	Contractors and suppliers handling CUI on nonfederal systems. Federal agencies must use it under 32 CFR 2002.14(h)(2).
What it is	A prioritized set of cyber defense safeguards grouped into Implementation Groups for organizations of different size and risk.	A set of security requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.
Number of items	153 Safeguards in 18 Controls. IG1 has 56, IG2 brings the total to 130 and IG3 covers all 153.	Rev. 3 has 97 requirements in 17 families. Rev. 2 has 110 requirements in 14 families, still used for CMMC Level 2.
Publisher	Center for Internet Security, a US 501(c)(3) nonprofit.	NIST, a US federal agency.
Licensing	Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. Commercial use requires CIS's prior approval. Free for an organization to use internally to improve its own security.	US government publication. Confirm reuse terms for any derivative material with NIST before reproducing text.
Version status	Version 8.1, published 24 June 2024, is the current version on cisecurity.org as of October 2026.	Rev. 3 is current. Rev. 2 was withdrawn on 14 May 2024, but DoD contractors are still assessed against Rev. 2 under the current DoD instructions.
What proof it produces	No certificate. Organizations can use the Assessment Specification to define measures, and CIS Controls Accreditation covers providers of implementation or assessment services.	No certificate from NIST. Compliance is evidenced through SP 800-171A Rev. 3 assessment or a CMMC assessment, depending on the contract.

What each framework asks you to build, and how the items are organized

CIS Controls and NIST SP 800-171 organize their requirements in different units, and that difference shapes how you map one to the other. The four cards below cover the structure you must build to, the parameters you may have to set yourself, and the measurement guide that CIS publishes alongside its Safeguards.

CIS Safeguard structure

Each CIS Safeguard in v8.1 carries one asset class (Devices, Software, Data, Users, Network or Documentation), one security function (Govern, Identify, Protect, Detect, Respond or Recover) and its Implementation Groups. For a CUI contractor, the asset and function tags help you sort Safeguards into the systems and processes that handle CUI. Check that the Govern tag on 25 Safeguards is matched by owned policy work, since 800-171 has no equivalent layer. Use Implementation Group 1 as the starting set, then confirm which additional Safeguards your contract scope needs.

800-171 requirement structure

SP 800-171 Rev. 3 contains requirements numbered 03.01.01 to 03.17.03 across 17 families, so each requirement has a fixed identifier your System Security Plan can cite. Rev. 3 added Planning, System and Services Acquisition, and Supply Chain Risk Management, and it dropped Rev. 2's split between basic and derived requirements. Because the DoD's current contract path still points to Rev. 2, confirm which revision your contract names before you build your requirement inventory around one numbering scheme.

Organization-defined parameters

Rev. 3 introduced organization-defined parameters (ODPs), which set values such as frequencies or thresholds that a requirement depends on. NIST's catalog defines 88 ODPs across 50 requirements and does not assign values itself. If the federal agency does not specify them, you must assign them yourself to complete the requirement. For a CUI contractor, this means documenting each ODP value in your System Security Plan and checking whether a pending FAR rule would publish values for you to use instead.

CIS Assessment Specification scope

The CIS Controls Assessment Specification defines, for each Safeguard, the inputs, operations, measures and metrics used to verify implementation. CIS states that it covers what to measure, not how. That means your team still designs the test procedures, evidence collection and sampling method, and must align them with the examine, interview and test methods that SP 800-171A Rev. 3 uses. Treat the Specification as a measurement guide for your CIS evidence, not as an assessment method that a DoD assessor will accept on its own.

Rev. 2 or Rev. 3 for DoD work: which revision applies to your contract

If your contract carries DFARS 252.204-7012 and you are working toward CMMC, the revision question is largely settled by the CMMC rule itself. NIST withdrew SP 800-171 Rev. 2 on 14 May 2024, but 32 CFR 170.14(c)(3) makes the CMMC Level 2 requirements identical to Rev. 2, so assessments are still scored against the 110 Rev. 2 requirements. Your mapping work should therefore start from Rev. 2 numbering.

Level 2 scope: CMMC Level 2 assessments use the 110 Rev. 2 requirements in 14 families, even though NIST no longer publishes Rev. 2.
Rev. 3 as a reference: Rev. 3 numbering (03.01.01 to 03.17.03) can help you organize evidence, but it does not change the Level 2 scoring baseline.
CIS mapping: Use the CIS Controls Navigator for v8.1 to pull Rev. 2 mappings, and check each mapping against the requirement wording rather than relying on the mapping alone.
Assessor expectations: Confirm with your C3PAO or the assessment scope document which revision the assessor will use for your environment.

Confirm the clause version and any CMMC level stated in your contract with the contracting officer before you commit scope to a revision.

What the CIS mapping to NIST 800-171 proves and what it does not

A CIS Navigator mapping shows where a Safeguard relates to a NIST SP 800-171 requirement. It does not show that the requirement is met. CIS publishes its v8.1 mappings to both NIST SP 800-171 Rev. 2 and Rev. 3 in the CIS Controls Navigator, and those links are useful for planning which Safeguards support which requirements. NIST's position on mappings in general is that informative references are developed by NIST and non-NIST entities, that NIST does not check the correctness of non-NIST mappings, and that listing a mapping does not imply endorsement. The mapping is therefore a starting point for your own analysis, not a finding you can hand to an assessor.

An 800-171 assessment is a different exercise. Under SP 800-171A Rev. 3, an assessor works through each requirement's determination statements using the examine, interview and test methods, and needs objective evidence that the requirement is implemented and working. For DoD work at CMMC Level 2, the assessment is performed against the 110 Rev. 2 requirements, and the evidence must be tied to each requirement, not to the Safeguard that a mapping links to it. A single Safeguard such as an access control or logging Safeguard may touch several requirements, and one requirement may draw on several Safeguards. Keep a requirement-level evidence register that names the artifact, the system and the date for each one, and treat the mapping only as the index into it.

Before you rely on any mapping, confirm which revision your contract names. Check the DFARS clause, any class deviation or solicitation language, and the revision the contracting officer has directed, then pull the mapping for that revision from the Navigator and check the mapped requirement IDs against the NIST publication itself. Ask your assessor or contracting officer which revision will govern your next assessment, because a Rev. 2 mapping does not carry over to Rev. 3's numbering, ODP values or changed requirements. Record the revision and the date you checked it, so the mapping is traceable to the requirements you were actually assessed against.

Who assesses each framework, what is issued and how often it recurs

This table shows who checks each of the three routes, what document or record each one produces, and how often it recurs. Read it to separate voluntary self-alignment from contract-driven assessment, because the CIS Controls and NIST SP 800-171 leave different evidence trails.

Route	Who assesses	What is issued or produced	Cycle and what sets it
CIS Controls (v8.1)	No assessor is required. CIS Controls Accreditation, run with CREST, accredits SecureSuite member organizations that provide implementation, auditing or assessment services	No certificate. Your own implementation records and, if you hire one, an accredited provider's report. Confirm the report format and its use with the provider	Set by your own governance or by the customer or insurer asking for it. Confirm whether the contract names a cycle
NIST SP 800-171 under a DoD contract	Contractor self-assessment or a third-party assessment, depending on the contract clause and the CMMC level required. Confirm the applicable DFARS clause and any CMMC requirement with the contracting officer	A self-assessment record, score and System Security Plan, or a CMMC certification if the contract requires it. Confirm exactly what the contracting officer will accept	Depends on the contract clause and the current DoD direction. Confirm the assessment cycle and the SP 800-171 revision the contract names before planning
CMMC Level 2 (DoD assessment route)	C3PAOs authorized or accredited by The Cyber AB assess Level 2 (32 CFR 170.17)	A CMMC Level 2 certification assessment outcome, issued through the CMMC program when the contract requires it. Confirm the current status of CMMC phases with the contracting officer	Set by the CMMC program rules and the contract. Confirm the certification validity period and reassessment triggers in 32 CFR Part 170

Where CIS Controls work counts toward 800-171 and where it does not

CIS Controls v8.1 maps to both NIST SP 800-171 Rev. 2 and Rev. 3 in the CIS Controls Navigator, which makes it a useful technical starting point. The mapping still leaves contractors responsible for several areas, and the cards below show where the overlap is strong and where your own evidence must carry the weight.

Two revisions in the Navigator

The Navigator maps v8.1 to both Rev. 2 and Rev. 3, so a single Safeguard inventory can serve either target. The catch is that the requirement numbering and families differ between revisions, so a Safeguard that maps to a Rev. 3 requirement may not map to the Rev. 2 requirement you are assessed against today. Export the mapping for the exact revision your contract names and check each row before you reuse it.

Planning and acquisition families

Rev. 3 adds Planning, System and Services Acquisition, and Supply Chain Risk Management. These areas cover security plans, secure acquisition of systems and services, and supplier risk. CIS Controls touch supplier and vendor management, but a Rev. 3 assessor will expect your own system security plan, acquisition requirements and supplier risk records. Confirm which Safeguards map to these families and plan to produce the artifacts yourself.

Safeguard count versus requirement count

The 153 Safeguards cover more ground than the 97 Rev. 3 or 110 Rev. 2 requirements in some areas, such as asset inventory and continuous vulnerability management. In other areas they cover less, because a single 800-171 requirement can need several operating procedures and evidence sets. Read the mapping as a many-to-many relationship, and do not treat a Safeguard count as a requirement count.

Organization-defined parameters

Rev. 3 introduces organization-defined parameters that set values such as review frequencies or thresholds. NIST does not assign these values. If the federal agency does not specify them, the contractor must assign them to complete the requirement. CIS Safeguards describe actions but rarely set the numeric values an assessor will check, so you must document each value and its rationale in your own policy set.

Govern function without a 800-171 family

CIS v8.1 aligned its security functions to NIST CSF 2.0 and added the Govern function, which holds 25 of the 153 Safeguards. SP 800-171 has no family that matches Govern one-to-one, so governance content such as risk strategy and policy oversight may map loosely or not at all. Check how each Govern Safeguard maps, then confirm which 800-171 requirements your governance records satisfy.

Measurement not covered by mapping

The CIS Controls Assessment Specification defines what to measure for each Safeguard but says nothing about how to measure it. A mapped Safeguard therefore does not prove that a 800-171 requirement is met in operation. Ask your assessor how they will test each mapped requirement and collect evidence against the assessment procedures in SP 800-171A, not against the Safeguard alone.

How to use CIS Implementation Group 1 to close 800-171 gaps

This sequence turns the CIS Controls into a prioritized working plan for NIST SP 800-171, producing a per-requirement gap register with evidence and assigned parameter values that a qualified assessor or contracting officer can review. It does not replace the 800-171 assessment itself.

Scope CUI systems and fix the revision
Identify every system, enclave, service and user group that stores, processes or transmits CUI, and draw the boundary around them. Then confirm with the contracting officer which revision of SP 800-171 the contract names, since DoD work may point to Rev. 2 or Rev. 3 depending on the clause in force at the time. The step is done when you have a signed-off scope document that lists the in-scope assets and the single revision you will map against.
Baseline IG1 Safeguards on the in-scope systems
Start with the 56 IG1 Safeguards, which CIS describes as essential cyber hygiene for every enterprise. Assign an owner to each Safeguard for the in-scope asset classes (devices, software, data, users, network and documentation), and record whether each one is implemented, partly implemented or absent. The output is an IG1 status register covering the CUI boundary, not the whole company, so gaps are visible where the contract actually applies.
Map Safeguards to the contract revision
Use the CIS Controls Navigator for v8.1 to pull the 800-171 mapping for the revision you fixed in step one. Work from each 800-171 requirement back to the Safeguards that mention it, and note where the mapping is partial or absent. Treat the mapping as a starting point: CIS and NIST both state that a mapping does not prove the requirement is met. The output is a requirement-by-requirement crosswalk with a column for mapping strength and a column for gaps that IG1 does not cover.
Add IG2 and IG3 items only for mapped gaps
Pull in IG2 or IG3 Safeguards only where the crosswalk shows an 800-171 requirement that IG1 leaves open. This keeps the effort tied to the contract rather than to a full move up the Implementation Groups. Record each added Safeguard next to the requirement it closes, so the reason for every addition is traceable. The check is that every IG2 or IG3 item in the register points to a named requirement gap.
Define evidence against SP 800-171A Rev. 3 methods
For each requirement, write down the evidence that would satisfy the assessment methods in SP 800-171A, which use examine, interview and test methods with determination statements. Decide which artifacts, configurations, logs, tickets or interviews will show each determination is met. The Safeguard's CIS Assessment Specification can help define what to measure, but it does not define how to satisfy the 800-171 determination statements. The output is an evidence matrix that lists the artifact, its owner and the date it was last collected.
Record organization-defined parameter values
If you are working to Rev. 3, identify every requirement that carries an organization-defined parameter and record the value you have set or been given. NIST does not assign ODP values, and if the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Confirm the values with the contracting officer, because a pending FAR proposal would tie ODP values to those published by the DoW CIO. The output is an ODP register with the value, the source of the value and the approver.
Confirm open gaps with an assessor
Take the gap register, evidence matrix and ODP register to a qualified assessor or to the contracting officer before you rely on them. IG1 alone is not an SP 800-171 assessment, and a CIS mapping does not establish conformity with any 800-171 requirement. Ask the reviewer to confirm each open gap, each marked-as-met requirement and each assigned parameter value. The step is done when the reviewer's written feedback is filed against each item in the register.

What buyers ask before they hire help on CIS Controls and NIST 800-171

Do the CIS Controls satisfy NIST SP 800-171?

No. The CIS Controls help you build much of what SP 800-171 asks for, but they do not replace it. CIS publishes a mapping from its Safeguards to SP 800-171 Rev. 2 and Rev. 3, and that mapping is a useful starting point for gap work. It is not evidence that a requirement is met. Your contract and any DoD assessment still measure you against the 800-171 requirements themselves, with their own evidence, and the CIS Controls state that they do not replace any regulatory, compliance or authorization scheme. Treat the mapping as a way to find gaps faster, then collect 800-171-specific evidence for each requirement you claim.

Which NIST 800-171 revision should we build to?

The answer depends on the contract clause and the current DoD direction, so confirm it in writing with your contracting officer before you scope the work. The 32 CFR 170.14(c)(3) rule makes CMMC Level 2 identical to Rev. 2, which has 110 requirements, and NIST withdrew Rev. 2 on 14 May 2024. A recent DoW class deviation names Rev. 2 explicitly and cites a memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A proposed FAR overhaul would move contractors to Rev. 3, but it was not final as of October 2026. Rev. 3 has 97 requirements and organization-defined parameters that you may have to assign yourself. Ask for the revision named in your clause, and ask whether any ODP values are published for you to use.

What drives the cost and effort of an 800-171 engagement?

Cost follows the scope you can state in writing. The main drivers are the number of systems that store, process or transmit CUI, the number of separate CUI enclaves, how much usable evidence already exists, how many organization-defined parameter values you must set, and whether an independent assessment is required at the end. Each added enclave or system adds configuration review, testing and documentation. Good existing evidence, such as current configuration baselines and access reviews, shortens the work. One-time costs include the gap assessment, remediation and the system security plan. Recurring costs include monitoring, periodic reviews and reassessment. Ask any provider for a fixed-scope quote that lists systems, enclaves, deliverables and who performs each task.

How long does an 800-171 project usually take?

No duration is set by a supplied source, so ask for a timeline in the written scope rather than relying on a general figure. The pace is set by the number of in-scope systems, how many requirements have no current control, the time needed to change configurations or deploy tools, and how quickly the client can review and approve evidence. Assessment scheduling, if a third-party or government assessment applies, can add time that sits outside the implementation work. Ask the provider to split the timeline into gap assessment, remediation, evidence collection and any assessment support, and to name which steps depend on your staff's availability.

What does the work need from our team?

Plan on time from four groups. Your team needs an asset inventory that shows which devices, software, data stores and users touch CUI, so the boundary can be drawn correctly. Policy owners must approve or write the policies and the system security plan. System administrators must give access to configurations, logs and identity systems and must make changes during remediation. Someone with access to the CUI environment must walk the provider through the real workflows, so evidence reflects how people work. Without these people available on a schedule, the work slips regardless of the provider's skill. Confirm named owners for each group before signing a scope.

Can our own team do NIST 800-171 work without outside help?

Yes, a capable internal team can do the work, provided it has time, clear ownership and someone who knows both the 800-171 requirements and the assessment evidence they must produce. The risks are usually independence, time and missed gaps. Internal staff who run the systems often cannot test their own controls objectively, and a first pass that is never checked by a second reviewer tends to miss evidence gaps. Outside help adds value in a gap review, independent testing of claimed controls, or preparing evidence for an assessor. Decide which parts you will do yourselves and which need a second set of eyes, and write that split into any scope you request.

How DeployOpen prepares CIS and NIST 800-171 readiness

DeployOpen plans, implements, documents and supports self-hosted platforms inside your own infrastructure, and prepares the controls and evidence for compliance assessments. We start from your contract scope and your CUI boundary, then use CIS Safeguards to close the gaps that matter most, with the NIST 800-171 requirement set as the target you are measured against. DeployOpen does not issue assessment reports or certifications.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
We confirm which systems store, process or transmit CUI and which contract clauses set the requirement version.
The written scope states which NIST 800-171 requirements and CIS Safeguards are in or out for your environment.

How we build

We map existing CIS Safeguard implementations to 800-171 requirements and record each gap with its evidence source.
Configuration, hardening and logging changes are made in your own cloud accounts, data centers or air-gapped networks.
We run security testing against the in-scope boundary so you can see which requirements are met in practice.

How we hand over

You receive system documentation, control mappings and an evidence index tied to each in-scope requirement.
Organization-defined parameter values are documented as decisions your team owns and can change.
Your team is trained on running the controls, so readiness does not depend on DeployOpen staying on site.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover re-checks after contract clause changes, such as a revised requirement version.
Confirm with your assessor or contracting officer which evidence format and version they will accept before work begins.

CIS Controls vs NIST 800-171