NIST 800-171 vs ISO 27001: which one do you need first?
For a supplier holding US government CUI, the contract decides whether NIST SP 800-171 is required, not the engineering team or the security function. NIST states that application and compliance of SP 800-171 are the responsibility of the federal agency holding the contract with the nonfederal organization, irrespective of size. Start by reading the contract clauses, the flowed-down DFARS language and any agency-specific requirements, and confirm which SP 800-171 revision is named. The revision matters: a current DoW class deviation names Rev. 2, while a proposed FAR overhaul would move contractors to Rev. 3 with organization-defined parameter values published by the DoW CIO. Confirm the current status with your contracting officer before you scope the work.
ISO/IEC 27001 is usually a commercial or market-access decision. It is a risk-based management system that a certification body issues after audit, and buyers outside the US may ask for it in tenders or supplier questionnaires. Confirm with your largest international customers whether they require a certificate, a statement of applicability or only a documented ISMS, because that answer sets the scope. If the contract only requires SP 800-171, pursue it alone and keep the ISO project in planning until a buyer asks for it. If both apply, plan one shared risk assessment and one set of evidence, since ISO clauses 6.1.2 and 6.1.3 and the SP 800-171 requirements overlap in asset, access and incident topics. Neither can stand in for the other.
Pursue both together when the same CUI environment serves a US contract and an international customer that expects a certificate. In that case, define the boundary of the CUI enclave first, because a narrow boundary reduces the number of systems each framework must cover, and map the ISO Annex A controls against the SP 800-171 requirements before writing new policy. Ask each certification body and each assessor which evidence they accept, and whether the ISO certificate scope can exclude the CUI enclave while the SP 800-171 assessment covers it. Expect separate reports and separate sign-offs even when the underlying controls are shared.
How the two frameworks differ on scope, structure and proof
This table compares who requires each framework, how its requirements are structured, what assessment reference applies, what proof it produces and how current each version is. Read it to see whether your contracts point to a fixed requirement set or whether your customers expect a certifiable management system.
| Factor | NIST SP 800-171 | ISO/IEC 27001:2022 |
|---|---|---|
| Who requires it | Federal agencies flow it down by contract for CUI on nonfederal systems; NIST leaves compliance decisions to the contracting agency | No government mandate; buyers, regulators or tender rules ask for it voluntarily or by contract |
| Requirement structure | 97 security requirements in 17 families (Rev. 3), numbered 03.01.01 to 03.17.03 | 93 Annex A controls in four themes inside a risk-based ISMS set by clauses 4 to 10 |
| Assessment reference | SP 800-171A Rev. 3 with determination statements and examine, interview and test methods | Clauses 4 to 10 of the standard plus Annex A, assessed by an accredited certification body |
| Risk handling | Requirements are fixed; organization-defined parameters must be set, by the agency or by the organization if the agency is silent | You perform risk assessment (clause 8.2) and risk treatment (clause 8.3) and justify your choices |
| Proof produced | Self-assessment or CMMC assessment outcome; for DoD Level 2, artifacts kept six years from the CMMC status date | Accredited certificate issued by a certification body after audit; ISO does not certify organizations |
| Version currency | Rev. 3 is current NIST version; DoD still enforces Rev. 2 (110 requirements) through the CMMC Level 2 rule and a 2026 DFARS deviation | 2022 edition current; 2013 certificates had to expire or be withdrawn by 31 October 2025 |
Who requires SP 800-171 and who asks for ISO 27001
SP 800-171 reaches you through contract, not through choice. It applies when a federal agency puts CUI into your nonfederal systems and flows the requirement down in the contract or agreement. NIST states that application and implementation of SP 800-171, and any compliance issues, are the responsibility of the federal agency that holds the contract with your organization, regardless of your size. Under 32 CFR 2002.14(h)(2), agencies must use SP 800-171 when they set CUI protection requirements on nonfederal information systems, unless the CUI category's authority prescribes other safeguards or an agreement sets protection above the moderate level. Your first check is the contract clause itself and the CUI categories it covers, then a written question to the contracting officer about which revision and which organization-defined parameter values apply.
ISO/IEC 27001 is voluntary unless a customer, regulator or contract asks for it. Nothing in the standard obliges you to certify, and no government contract in this comparison requires it by default. Some international buyers and sector regulators ask for an ISMS, and the GDPR and NIS2 do not require ISO/IEC 27001 or any certificate. Before you commit budget, list each international customer and regulator that has written an information security requirement into its contracts, and record whether it names ISO/IEC 27001 specifically, accepts an equivalent such as a SOC 2 report, or asks only for evidence of controls. That list tells you whether certification is a market requirement for you or a choice you are making for your own reasons.
Where the controls and evidence overlap
SP 800-171 and ISO/IEC 27001 cover much of the same security ground, but they are written and proven differently. The mappings below show where they meet, and the limits of those mappings show where your own evidence still has to do the work.
CIS Navigator mapping for both
The CIS Controls Navigator for v8.1 offers CIS mappings to both SP 800-171 Rev. 3 and ISO/IEC 27001:2022, which makes it a useful starting point for a shared control inventory. Use it to see which CIS Safeguards land on each framework's requirements or Annex A controls. Check each mapped row against the requirement text yourself, because a shared CIS safeguard does not mean the two frameworks ask for the same evidence.
CSF 2.0 informative references
NIST's CSF 2.0 Reference Tool lists informative references to both SP 800-171 Rev. 3 and ISO/IEC 27001:2022, so the CSF subcategories can act as a bridge between the two. This is useful when you need one outcome-level view for executives. Confirm which specific requirement or control a given subcategory points to, since an informative reference links topics, not identical obligations.
Mappings are not equivalence
ENISA states that its own mapping is not a measure of equivalence and does not assess whether one standard fully covers another's requirements. The same caution applies to any mapping in this comparison. Treat a mapped pair as a pointer to evidence to collect, not as proof that passing one assessment satisfies the other. Your assessor will decide what counts.
Non-NIST mappings are unverified
NIST notes that it does not check the correctness of non-NIST informative references and that listing a mapping does not imply endorsement. Mappings to ISO/IEC 27001:2022 in the CSF Reference Tool were developed by others, so NIST will not vouch for each row. Before you cite a mapping in a System Security Plan or a cover letter, verify the row against both control texts and record who made the mapping and when.
Risk assessment and treatment clauses
ISO/IEC 27001:2022 sets risk assessment in clause 6.1.2 and risk treatment in clause 6.1.3, then requires both to be carried out in operation under clauses 8.2 and 8.3. SP 800-171 Rev. 3 has no equivalent planning clause. Its risk-based elements sit inside requirements such as the Risk Assessment and Security Assessment families. Expect an ISMS auditor to ask for dated risk registers and treatment decisions, and expect an SP 800-171 assessor to ask how each requirement is met.
What you must confirm locally
No mapping knows your system boundary, your CUI flows, or which ISMS scope you will certify. Confirm which systems hold CUI and which fall inside the ISMS scope, then test each shared control against both. Also confirm with your contracting officer whether Rev. 2 or Rev. 3 applies to your contract, and with your certification body how it treats the scope statement. Document the answers, because they decide which evidence is reusable.
Why SP 800-171 Rev. 2 and Rev. 3 change the work
The version of SP 800-171 in your contract determines how many requirements you must meet, so confirm it before you plan any control work. DoD still assesses contractors against the 110 Rev. 2 requirements, because 32 CFR 170.14(c)(3) makes CMMC Level 2 identical to Rev. 2, even though NIST withdrew Rev. 2 on 14 May 2024. A DoW Class Deviation (2026-O0025, Revision 3, signed 3 September 2026) has contracting officers insert a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly, and it cites a DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A proposed FAR overhaul published 23 June 2026 would instead require SP 800-171 Rev. 3, using organization-defined parameter (ODP) values published by the DoW CIO. That rule was not final as of October 2026, so the clause in your contract today is the one that counts. Ask your contracting officer which clause and revision appear in each active contract and task order, and whether any solicitation you are bidding on uses a different one.
Rev. 3 introduced organization-defined parameters, which are blanks in a requirement such as how often a review occurs or what counts as a timely response. NIST does not assign these values. If the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. NIST's OSCAL catalog defines 88 ODPs across 50 of the 97 Rev. 3 requirements. For an ISO 27001 program, this means your risk assessment under clauses 6.1.2 and 8.2 may not produce the parameter values the contract expects, so you need a documented decision for each one. Ask the contracting officer in writing whether values will be supplied for your contract, and if they will not, record the values you chose, the reason for each, and the owner who approved them.
Plan for the revision change before it arrives, because a move to Rev. 3 changes the requirement count, adds families such as Planning and Supply Chain Risk Management, and needs ODP decisions your ISO 27001 risk treatment plan must support. Build a crosswalk that tracks each Rev. 2 requirement, its Rev. 3 counterpart, and the ODP value you assigned, and keep it under change control so an agency-published value can replace your own without rework. Confirm the status of the FAR rule with your contracting officer or your counsel at each contract renewal, not only once.
Who assesses each framework and what they issue
This table compares who assesses SP 800-171 and ISO/IEC 27001, what each produces and how often it recurs. Read it to see which framework your customers can demand proof of, and which one an independent body issues.
| Dimension | NIST SP 800-171 (CMMC Level 2) | ISO/IEC 27001:2022 |
|---|---|---|
| What triggers it | A federal contract or flow-down clause that requires CUI protection in nonfederal systems | A voluntary decision, or a customer or market requirement for an information security management system |
| Who assesses | The contractor for a Level 2 self-assessment, or a C3PAO for a Level 2 certification assessment, with DCMA DIBCAC for Level 3 | An accredited certification body operating to ISO/IEC 17021-1 and ISO/IEC 27006-1; ISO itself does not certify organizations |
| Standard used to assess | SP 800-171A Rev. 3 for the assessment method; CMMC Level 2 requirements are identical to the 110 Rev. 2 requirements | Clauses of ISO/IEC 27001:2022 and the Annex A controls; the body audits your own risk treatment and controls |
| What it issues | A self-assessment score with affirmation, or a certification assessment result under the CMMC program | An accredited ISMS certificate for a defined scope, which can be checked in the IAF CertSearch database |
| Evidence you must keep | Artifacts used as evidence for a Level 2 self-assessment, kept for six years from the CMMC status date under 32 CFR 170.16(c)(4) | Documented information the certification body samples across stages 1 and 2 and each surveillance audit; confirm retention terms with your body |
| Cycle | Set by the contract and the CMMC status date; confirm the current phase and timing with the contracting officer | Three-year certification cycle with at least one audit (surveillance or recertification) in every calendar year |
| Consequence of major gaps | Assessment results can affect contract eligibility; confirm the consequences for your specific contracts | If major nonconformities are not verified as corrected within 6 months after stage 2 ends, another stage 2 is required before certification |
| What to ask for before you start | Which contract clauses apply, which CMMC level is required, and which C3PAO or self-assessment route fits your scope | Certification scope, accreditation status of the body, audit plan for each year of the cycle, and how the body handles the 2026 transition rules |
Doing both: order of work and shared evidence
This sequence lets one team build contract-driven SP 800-171 evidence and an ISO 27001 ISMS on a single scope and asset inventory, so shared records are written once while each assessment still produces its own result. The order matters because the CUI boundary decides which systems the ISMS must cover.
Confirm contract obligations and CUI scope
Start with the contracts, task orders and flow-down clauses that name the requirement set your customer expects, which may be SP 800-171 Rev. 2 or Rev. 3 depending on the contract vehicle and any current DoD class deviation or proposed rule. Your contracts or contracting officer, not this page, settle which revision applies. Ask the contracting officer or prime contractor which CUI categories you handle and where they are stored, processed and transmitted. The output is a written scope statement signed off by the business owner and, where the contract requires it, the customer, so the team knows which obligations apply before any control work begins.
Define the CUI boundary and asset inventory
Map every system, service, endpoint, enclave and third party that stores, processes or transmits CUI, and every system that can affect its protection. Record each asset once in a single inventory with owner, location, data classification and dependencies. This inventory becomes the shared scope for both programs, so the ISMS and the SP 800-171 assessment do not describe different environments. The check that closes this step is a boundary diagram that the system owners have reviewed and that matches the inventory line for line.
Set organization-defined parameter values
For SP 800-171 Rev. 3, the federal agency may specify organization-defined parameter (ODP) values, and if it does not, the nonfederal organization must assign them to complete the requirement. Ask the contracting officer whether values have been provided, and document your own values for any that remain open, such as review frequencies or retention periods. Record each value with its rationale and owner. The output is an ODP register that the security team and the contract owner have both approved, which the SP 800-171 evidence will reference directly.
Build SP 800-171 evidence mapped to requirements
Map each applicable requirement to the policy, procedure, configuration, log, ticket or record that shows it operates inside the boundary, and tag each evidence item with the requirement number and the ODP value it satisfies. Use the determination statements in SP 800-171A to check that every requirement has evidence that answers its examine, interview and test methods. Keep the evidence index in a form that an assessor can follow without help from your staff. The check that closes this step is a gap list in which every requirement is either evidenced, documented as not applicable with justification, or assigned an owner and remediation item.
Build the ISMS risk assessment and risk treatment
Using the same asset inventory and boundary, run the information security risk assessment required by clause 6.1.2 and the risk treatment process in clause 6.1.3 of ISO/IEC 27001:2022, then carry both out in operation under clauses 8.2 and 8.3. Because SP 800-171 requirements are not risk-based selections, use the CUI-related risks to inform treatment decisions while keeping the contract requirements as fixed obligations. The output is a risk register and risk treatment plan that link each CUI-related risk to the controls chosen to treat it and to the SP 800-171 requirements they support.
Write the Annex A statement of applicability
Prepare the statement of applicability against the 93 Annex A controls, recording for each control whether it applies, why, and where its implementation evidence sits. Reference the SP 800-171 evidence index where a control and a requirement describe the same safeguard, so one artifact serves both programs. Have the ISMS owner and a second reviewer confirm that exclusions are justified and that the scope matches the boundary from step two. The check is a statement of applicability that traces each applicable control to a named owner, a named evidence item and a review date.
Run an internal audit and management review
Before any external assessment, test both programs against the same evidence set. Internal auditors who are independent of the control owners should sample evidence for SP 800-171 requirements and for ISMS controls, record nonconformities, and track corrective actions to closure. Management review should then accept the residual risks and approve the scope. The output is an internal audit report and a corrective action log that show which findings are closed and which remain, so that external assessors do not discover them first.
Schedule the certification and government assessments
Engage an accredited ISMS certification body for ISO/IEC 27001, which operates under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. Separately, confirm with the contracting officer or the DoD program whether a CMMC Level 2 assessment by a C3PAO, a self-assessment or another agency review applies to your contracts, and what the current status of CMMC Phase 2 is. Ask each body what evidence it will request and how long it expects the evidence to be retained. The check is a signed schedule with each body, and a written note confirming that the ISO certificate and the SP 800-171 or CMMC result are separate outcomes that do not substitute for each other.
What drives cost for each route
Start by separating who gets paid for what, because the two routes charge for different things. On the SP 800-171 side, the main line items are your own staff time (system owners, IT administrators and the person who maintains the System Security Plan), remediation of gaps against the 97 Rev. 3 requirements or the 110 Rev. 2 requirements that DoD still enforces, any external consultant you bring in, and the assessor fee. The DoD's CMMC final rule (32 CFR Part 170, October 2024) estimated a Level 2 self-assessment plus initial affirmation at $43,403 for an other-than-small entity and $34,277 for a small entity, and a Level 2 C3PAO certification assessment plus affirmation at $112,345 and $101,752. Those figures are federal estimates for the assessment path, not what your organization will pay, and they exclude your remediation and staff time. Affirmation recurs, so budget for it in every cycle.
On the ISO/IEC 27001 side, no certification fee figure is supplied in our research, so do not treat any number you see elsewhere as a benchmark without checking its basis. The cost is driven by the certification body's audit days, which depend on scope, the number of sites and the sample taken across them, plus stage 1 and stage 2 audits and the surveillance audits that recur in the three-year cycle. Internal costs include building the ISMS, the risk assessment and risk treatment work under clauses 8.2 and 8.3, and the Annex A control evidence. Ask each certification body to state its audit day calculation in writing, and ask consultants to separate their fixed-scope deliverables from ongoing support.
When you request quotes for either route, put the same inputs on the table so the numbers are comparable. For ISO, ask for the in-scope sites, headcount, the systems and processes covered, the proposed sample per site, the audit days for stage 1, stage 2 and each surveillance year, and whether the certification body's fee is separate from its travel and accreditation charges. For SP 800-171, ask for the number of systems that store, process or transmit CUI, the assumed number of ODP values you must assign if the federal agency does not specify them, and whether the quote covers remediation or only assessment. Items that DeployOpen would scope in a fixed written plan, such as gap assessment or documentation, should be quoted separately from the certifying or assessing body's own fees.
How long, what it costs and what we need from you
Can a contract require SP 800-171 without requiring ISO 27001?
Yes. SP 800-171 is a requirement set that a federal agency can flow down through its contract, so a supplier handling CUI can be bound to it with no ISO 27001 requirement at all. The agency decides how the requirement is assessed and enforced, and NIST notes that application and compliance issues rest with the federal agency that holds the contract, regardless of the organization's size. ISO 27001 is only relevant when a buyer asks for it in its own right, usually an international customer wanting certificate evidence. Confirm the exact clause, version and assessment method in the contract, because the DoD's current baseline is a moving target (see the next question).
How long does SP 800-171 compliance take compared with ISO 27001 certification?
No duration for either route is supplied here, so treat any timeline you hear as something to verify. Work through the variables that set the length: the number of systems in CUI scope, how many of the 97 Rev. 3 requirements already have evidence, whether the contract names Rev. 2 or Rev. 3, and whether a third-party assessor is required. For ISO 27001, the certification body runs its own stage 1 and stage 2 audits and can require a further stage 2 if corrective actions for major nonconformities are not verified within 6 months after stage 2 ends. Ask your assessor and certification body for a written plan, then compare it against your contract dates.
What does the work need from our internal staff?
The work needs named owners, not only an IT team. Expect demand on the following roles:
- An executive sponsor who accepts the scope and risk decisions for CUI systems.
- System owners who can explain how each boundary, account and log source works.
- An ISMS or compliance lead who maintains the System Security Plan or ISMS documents and the evidence index.
- Administrators who produce configuration screenshots, exports and access reviews on request.
ISO 27001 adds risk assessment and risk treatment work under clauses 8.2 and 8.3, which needs business input. Ask any provider to name which of these roles they expect you to fill and how many hours a month that implies.
Can a small team assess itself against SP 800-171?
A small team can attempt a self-assessment, but the rules set the bar. Under the CMMC framework, Level 2 self-assessments require the organization to keep the artifacts used as evidence for six years from the CMMC status date (32 CFR 170.16(c)(4)). The DoD's 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $34,277 for a small entity and $43,403 for an other-than-small entity, while a C3PAO certification assessment was estimated at $101,752 and $112,345. Those are the DoD's estimates, not vendor quotes. Confirm with your contracting officer which assessment type applies to your contract before you decide. Note that the DoW's 2026 class deviation names Rev. 2 for the DFARS clause, so the version in scope may differ from your plan.
What recurs every year once we are compliant?
Recurring work is what keeps the evidence valid, and it is where most budgets are underestimated. For ISO 27001, the certification cycle lasts three years with at least one audit, surveillance or recertification, in every calendar year, so expect annual audit fees and internal audit and management review. For SP 800-171, nothing is certified on a fixed cycle, but the contract, the evidence retention rule and any affirmation obligation keep work moving: access reviews, patch records, log review, change records and updates to the security plan. Ask any quote to separate one-time implementation from annual recurring costs, and to show who pays for each.
How are the 97 requirements and organization-defined parameters handled?
Rev. 3 has 97 requirements in 17 families, and many of them include organization-defined parameters (ODPs). NIST's OSCAL catalog defines 88 ODPs across 50 requirements, and NIST does not assign their values. If a federal agency does not specify them, you must assign them yourself to complete the requirement, so each value should be written down, justified and approved. Compare that with ISO 27001, where your risk assessment and Statement of Applicability drive the choices, with 93 Annex A controls. Ask your contracting officer whether ODP values will be published, since a 2026 proposed FAR rule would have the DoW CIO publish them.
Can DeployOpen certify us against SP 800-171 or ISO 27001?
No. DeployOpen does not issue certifications, attestations or audit reports. ISO does not certify organizations either; accredited certification bodies do so for ISO/IEC 27001, and for SP 800-171 the assessment is performed by the agency, a C3PAO or DCMA DIBCAC depending on the contract. What DeployOpen can do is plan and implement the controls, prepare system documentation and evidence, and support you in preparing for an assessment, with the scope agreed in writing before work starts. Ask any provider which parts of the work they will perform and which the independent assessor will perform.
How DeployOpen scopes and supports both frameworks
DeployOpen works on NIST 800-171 vs ISO 27001 as two separate workstreams that share one set of controls, evidence and system boundary. We plan, implement and document self-hosted open-source platforms inside your own infrastructure, and we prepare the systems and evidence that an assessor or certification body will review. We do not issue assessments, attestations or certifications.
How we scope
- The written scope names the systems that store, process or transmit CUI, and the separate ISMS boundary for ISO/IEC 27001.
- We record which organization-defined parameters your federal sponsor has set and which ones you must assign yourselves.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts; ongoing support is available as a retainer.
How we build
- We map SP 800-171 requirements and ISO/IEC 27001 Annex A controls to the same implemented controls, so evidence is collected once.
- We run a risk assessment and risk treatment process in operation, as clauses 8.2 and 8.3 of ISO/IEC 27001:2022 require.
- We test the controls against the SP 800-171A determination statements and document gaps before any external assessment.
How we hand over
- You receive system security plans, policies, risk registers and evidence files organized by requirement and by Annex A control.
- Evidence retention is set to the period your contract requires, including the six-year retention rule for Level 2 self-assessment artifacts.
- We walk your team through the evidence index so your assessor or certification body can trace each claim to its artifact.
How we support
- Retainers can cover updates when SP 800-171 Rev. 2 or Rev. 3 requirements change in your contracts or flow-down clauses.
- Retainers can also cover annual ISMS reviews, internal audits and evidence refreshes between certification audits.
- Confirm with your assessor, contracting officer or certification body which versions and cycles apply before you sign a scope.
Sources and further reading
- NIST FAQ: SP 800-171 Rev. 3 and SP 800-171A Rev. 3 ↗
- NIST SP 800-171 Rev. 3 (CSRC publication page) ↗
- CMMC Program final rule, 32 CFR Part 170 (Federal Register) ↗
- ISO/IEC 27001:2022 (ISO) ↗
- IAF MD 29:2024 Transition requirements for ISO/IEC 27006-1:2024 ↗
- CIS Critical Security Controls Navigator (v8.1) ↗
