NIST 800-171 vs NIST CSF

NIST 800-171 vs NIST CSF: which one do you need first?

If your organization stores, processes or transmits controlled unclassified information (CUI) under a federal contract or subcontract, pursue NIST SP 800-171 first. Its requirements reach you through the contract, not through your own choice, and the federal agency that holds the agreement is responsible for how they are applied and for any compliance issues. The version you must meet is a contract question, not a technical one. SP 800-171 Rev. 3 is the current NIST version, with 97 requirements, but the DoD's CMMC Level 2 requirements are identical to the 110 requirements of Rev. 2, and a DoW class deviation issued on 3 September 2026 names Rev. 2 explicitly. Confirm with the contracting officer which revision your contract cites before you build your evidence against either one.

The CSF is a different kind of document. NIST describes it as voluntary, it has no certification or conformity assessment program, and most organizations adopt it because leadership wants a common vocabulary or because a customer asks for it. A CSF profile can still help a contractor that already has an SP 800-171 program. Use it as a management layer: map your governance and risk activities to CSF Functions, then use the NIST CSF 2.0 Reference Tool to trace Subcategories such as GV.SC-05 and ID.RA-01 to the SP 800-171 Rev. 3 requirements they touch. Those mappings are NIST's published references, not a substitute for the contract's assessment, and NIST does not check non-NIST mappings. Treat the CSF as the way you explain your program to executives and customers, not as the thing that satisfies the contract.

How the two frameworks differ on scope, structure and proof

This table compares NIST SP 800-171 and the NIST CSF 2.0 on who requires them, how they are structured, who decides compliance and what proof each produces. Read it as a scope question first: SP 800-171 applies by contract when you handle CUI, while CSF 2.0 is a voluntary outcome framework you can use anywhere.

Factor	NIST SP 800-171 Rev. 3	NIST CSF 2.0
Who requires it	Nonfederal systems that handle CUI, usually flowed down by a federal contract or agreement	Voluntary for most organizations; some customers or suppliers require it, and U.S. federal agencies were made to use it by a 2017 executive order
Number of requirements or outcomes	97 security requirements in 17 families (03.01.01 to 03.17.03)	6 Functions, 22 Categories and 106 Subcategories
Rev. 2 version still enforced by DoD	110 requirements in 14 families, still assessed under CMMC Level 2 and named in DoW Class Deviation 2026-O0025, Revision 3	Not applicable; no earlier numbered requirement set applies
Organization-defined parameters	Yes: 88 ODPs across 50 requirements; NIST assigns no values, and the nonfederal organization must assign them if the federal agency does not	No; outcomes are written to be applied to any organization without assigned parameter values
Who decides compliance	The federal agency holding the contract or agreement, regardless of organization size	No one decides compliance; NIST is not a regulatory agency and the organization sets its own targets
Proof produced	Assessment against SP 800-171A Rev. 3 with examine, interview and test methods, reported under the contract or CMMC process	Organizational Profiles (Current and Target) and Tiers; no assessor-issued report
Does NIST offer certification	No; certification and assessment for CMMC are run by C3PAOs (Level 2) and DCMA DIBCAC (Level 3)	No; NIST offers no certifications or endorsements and has no plans for a conformity assessment program

Who requires SP 800-171 and who chooses the CSF

For SP 800-171, the party that decides compliance is the federal agency that holds the contract or agreement with your organization, and NIST states that this holds irrespective of the nonfederal organization's size. The requirement reaches you through that contract, not through a choice you make. Under 32 CFR 2002.14(h)(2), agencies must use SP 800-171 when they set requirements to protect CUI on nonfederal information systems, unless the CUI category's authority prescribes other safeguards or an agreement sets protection above the moderate level. Before you bid, read the contract clauses and ask the contracting officer which revision and which organization-defined parameter values apply, because the revision that governs your work can change as DoD guidance is updated. Confirm the current version with the contracting officer rather than assuming it from older documents.

The CSF is different because it is voluntary for most organizations. NIST describes itself as a regulator-free framework, and most organizations adopt it on their own initiative. The main exception is U.S. federal agencies, which the 2017 executive order made required to use it. Outside that group, the CSF usually arrives as a request from a customer or supplier who wants evidence that you have assessed your cybersecurity risk. Ask each customer whether they expect a CSF profile, a questionnaire, or a specific attestation, since NIST does not define a single format for that evidence.

NIST does not certify CSF implementations, products or services, and it has no plans to create a conformity assessment program. Any firm that offers a CSF certificate is offering its own service, and that certificate carries no NIST endorsement. If a buyer asks for proof of CSF alignment, the defensible artifact is your own documented Current and Target Profiles and the assessment behind them, which you can explain in person. For a contractor, the SP 800-171 assessment result is the document that the contracting agency will actually weigh, so treat the CSF as the management frame and SP 800-171 as the contract obligation.

Where the CSF 2.0 to SP 800-171 Rev. 3 mapping overlaps

NIST's CSF 2.0 Reference Tool links individual CSF Subcategories to SP 800-171 Rev. 3 requirements, which shows where the two documents touch. The links are useful starting points for planning, but each one is a reference, not proof that a control meets a requirement.

GV.SC-05 to supply chain requirements

The tool links GV.SC-05 to requirements 03.11.01, 03.16.03, 03.17.02 and 03.17.03. These cover risk assessment, system and communications protection, and supply chain risk management, so the overlap is mostly about how you manage third parties that touch CUI. Open each linked requirement in SP 800-171 Rev. 3 and confirm that your supplier controls address what the requirement text asks, not only what the CSF Subcategory names.

ID.RA-01 to risk assessment requirements

ID.RA-01 links to six requirements: 03.11.01, 03.11.02, 03.12.01, 03.12.03, 03.14.03 and 03.14.06. The set spans risk assessment, security assessment, and monitoring, so one CSF Subcategory can point to several requirements that each need their own evidence. Check whether your vulnerability identification process produces records that satisfy each linked requirement, including the organization-defined parameters the Rev. 3 requirement text may leave to you.

Mappings are not coverage claims

NIST does not check the correctness of non-NIST mappings, and listing a mapping does not imply endorsement. A link tells you two statements are related, not that meeting the CSF Subcategory satisfies the SP 800-171 requirement in full. Treat the tool as a cross-reference for gap analysis, and record your own reasoning for each link you rely on.

Verify each link in the tool

Before you cite a mapping in a plan, open the CSF 2.0 Reference Tool, filter by the Subcategory, and read the linked requirement text in full. Export dates and mapping content can change as NIST updates its online references, so note the export you used. Ask your assessor or contracting officer whether they will accept a CSF crosswalk as supporting evidence.

Mapping direction matters

The Reference Tool shows links from the CSF side, starting at Subcategories. Working from SP 800-171 requirements back to the CSF can surface different gaps, especially for requirements in families such as Planning or Supply Chain Risk Management that the CSF covers only indirectly. Build your crosswalk in both directions before you decide which requirements your existing CSF program already covers.

Who assesses each framework and what it produces

This table compares who assesses SP 800-171 and the CSF, and what each produces, so you can see which result a contract or customer will ask for. Read the SP 800-171 column for contract-driven assessment and the CSF column for an optional, organization-defined engagement.

Question	SP 800-171 under CMMC	NIST CSF 2.0
Who assesses	For CMMC Level 2, C3PAOs authorized or accredited by the CMMC Accreditation Body (currently The Cyber AB). For Level 3, DCMA DIBCAC.	NIST does not assess or certify. Any review is an internal or third-party engagement the organization defines.
Output produced	A CMMC certification assessment result at the level the contract requires. Certification evidence follows the CMMC program rules in 32 CFR Part 170.	No certificate or conformity assessment program from NIST. Output is whatever the organization agrees to document, such as a Current or Target Profile.
Who sets the obligation	The federal agency holding the contract or agreement is responsible for application and compliance issues, regardless of contractor size (NIST FAQ).	Voluntary for most organizations. Some customers or suppliers may require it by contract, and a 2017 executive order made it mandatory for U.S. federal agencies.
Assessment method	SP 800-171A Rev. 3 uses determination statements with examine and interview methods, plus the test method for 93 of the 97 requirements.	CSF does not prescribe how outcomes are achieved. Any method is chosen by the organization, and CSWP 29 says outcomes are not a checklist.
Cycle and timing	Set by the contract and the CMMC program rules. Confirm the assessment window and CMMC phase with the contracting officer before planning.	Set by the organization. Informative References and Quick-Start Guides are updated online more often than the framework itself.
Current status to confirm	DoW Class Deviation 2026-O0025, Revision 3 names SP 800-171 Rev. 2 and cites a 13 July 2026 CIO memo while CMMC Phase 2 is suspended. Confirm the deviation and phase status with the contracting officer.	Confirm with your customers whether they expect a CSF Profile or only a mapping to SP 800-171 Rev. 3 in the NIST Reference Tool.

Which SP 800-171 revision applies to your contract right now

The revision that governs your work is set by your contract, not by the latest NIST publication. SP 800-171 Rev. 3 has 97 requirements, but DoD still assesses contractors against the 110 requirements of Rev. 2 under CMMC Level 2, because 32 CFR 170.14(c)(3) makes those Level 2 requirements identical to Rev. 2. The DoW Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly, and it cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A FAR overhaul proposed rule published 23 June 2026 would move contractors to Rev. 3, but it was not final as of October 2026. Confirm which of these governs each solicitation and subcontract you hold before you build a plan around either number.

Rev. 3 adds a second layer that Rev. 2 does not have: organization-defined parameters (ODPs). Several requirements contain values that someone must fill in, such as how often a control is reviewed or which events trigger an action. NIST's OSCAL catalog defines 88 ODPs across 50 of the 97 requirements, and NIST does not assign those values. If the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Under the proposed FAR rule, the values would instead come from those published by the DoW CIO. That makes an unassigned ODP a gap in your own documentation, and an assessor will look for it.

Ask the contracting officer for two things in writing: the exact SP 800-171 revision and the ODP values that apply to the CUI in scope. Ask whether the answer changes if a FAR rule becomes final during performance, and who will issue updated values. Record the answers in the contract file and map each ODP to a named owner and a policy document in your own system security plan. A verbal answer from a program manager is not enough to plan a Rev. 3 gap assessment, and the same written answer also tells you whether a CSF 2.0 crosswalk alone will satisfy the contract.

Doing both: the order that avoids repeated evidence work

This sequence builds SP 800-171 evidence once, then maps it to CSF outcomes so the same artifacts answer both frameworks. It also shows where CSF gaps need their own Target Profile work.

Confirm contract revision and CUI boundary
Start by reading the contract, task order or flowdown clause to establish which SP 800-171 revision applies. For DoD work, confirm whether the contracting officer's DFARS 252.204-7012 language names Revision 2 or Revision 3, because the answer changes the requirement count you will assess. Ask the contracting officer or prime to confirm the CUI categories in scope and draw the system boundary around the systems that store, process or transmit CUI. Done means a written scope statement signed off by the compliance lead, listing the revision, the systems inside the boundary and the systems excluded with a reason.
Resolve organization-defined parameters early
Review the organization-defined parameters (ODPs) in SP 800-171 Rev. 3 before writing any control narrative. NIST does not assign ODP values, and if the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Ask the agency or prime in writing which values they expect, and record your own decision for any ODP left open. The security or compliance lead owns these decisions. Done means a decision log that names each ODP, its value, who approved it and the date.
Build SP 800-171 requirement evidence
For each requirement in the revision that governs the contract, write the implementation statement and collect the artifacts that SP 800-171A assesses: policies, configurations, logs, interview records and test results. Assign one owner per requirement family and store each artifact once in a single evidence repository with a stable identifier. Done means every in-scope requirement has an implementation statement, at least one linked artifact and a named owner, and the gaps are tracked in a plan of action with owners assigned.
Map the evidence to CSF 2.0 outcomes
Use the CSF 2.0 to SP 800-171 Rev. 3 mapping in NIST's Reference Tool to link existing evidence to CSF Subcategories, rather than writing new narratives. The mapping links, for example, GV.SC-05 and ID.RA-01 to specific SP 800-171 requirements, so each artifact can be tagged once and reused. Confirm the mapping against the revision in use, since the Reference Tool points to Rev. 3, and note any CSF Subcategory the mapping does not reach. NIST does not check the correctness of non-NIST mappings, so have a reviewer verify the tags. Done means an evidence index that lists each artifact against both its SP 800-171 requirement and its CSF Subcategory.
Identify CSF gaps outside SP 800-171
Compare the unmapped CSF Subcategories with the organization's risk priorities and business context. CSWP 29 states the framework does not prescribe how outcomes are achieved and that its order does not imply sequence or importance, so choose the gaps based on your own risk assessment. Involve the risk owner, because some outcomes, such as enterprise governance or incident recovery planning, may sit outside the CUI boundary. Done means a list of uncovered Subcategories, each marked as in scope or out of scope with a documented reason.
Set the CSF Target Profile for remaining gaps
Draft a Target Profile that records the outcomes and the desired priority for the gaps identified in the previous step, and a Current Profile that reflects the evidence already built. The Target Profile is an organizational choice, so the executive sponsor should approve it rather than the assessment team alone. Include the Tier you intend to reach if your governance requires one. Done means an approved Target Profile with a dated Current Profile, and a short list of actions linked to the owners who will deliver them.
Confirm the outputs before the assessment
Before the assessment, check that each SP 800-171 requirement, each CSF tag and each Target Profile action points to the same evidence index. Ask the assessor, whether a C3PAO or a federal agency representative, how they want the artifacts packaged. This step also confirms who can answer for each claim. Done means a reviewed evidence index, a short cross-reference note explaining which CSF outcomes are covered by SP 800-171 and which are covered by the Target Profile, and a named person accountable for updates when the contract revision changes.

When a contractor needs one framework, the other, or both

If your organization stores, processes or transmits CUI in a nonfederal system under a DoD contract, SP 800-171 is the requirement set your contract points to, and the CSF is a supporting tool you can use alongside it. The revision that applies depends on the contract and current DoD instructions. NIST's current version is Rev. 3, with 97 requirements, but DoD assesses against the 110 Rev. 2 requirements under CMMC Level 2, and a 2026 DoW class deviation names Rev. 2 explicitly while CMMC Phase 2 is suspended.

The requirement is fixed: Your contract requires the 800-171 revision it names, so CSF outcomes cannot stand in for those requirements.
The CSF helps organize work: NIST's Reference Tool maps GV.SC-05 to requirements 03.11.01, 03.16.03, 03.17.02 and 03.17.03, and ID.RA-01 to six Rev. 3 requirements, which helps supply-chain and risk teams use shared vocabulary.
The agency decides compliance: NIST states that application, implementation and compliance issues belong to the federal agency holding the contract, regardless of the organization's size.
Proof comes from the assessment route: CMMC Level 2 certification assessments are performed by C3PAOs, so a CSF-only program may not produce evidence the contract accepts.
Revision timing may change: A proposed FAR overhaul published 23 June 2026 would require Rev. 3 with ODP values published by the DoW CIO, and the rule was not final as of October 2026.

Confirm with your contracting officer which 800-171 revision, organization-defined parameter values and CMMC level the solicitation requires before you scope your system boundary.

What do buyers ask before they hire help for NIST 800-171 and the CSF?

Can the NIST CSF replace NIST SP 800-171 for our contract?

No, not when the contract requires SP 800-171. The CSF is a voluntary outcome framework that NIST says does not prescribe how outcomes are achieved, while SP 800-171 is the set of security requirements for protecting CUI in nonfederal systems that the contracting agency applies. NIST also says the application of SP 800-171 and any compliance issues are the responsibility of the federal agency that holds the contract. The practical step is to confirm in the contract and the DFARS clause which version applies, because the CSF mapping in NIST's Reference Tool helps with planning but does not replace the requirements.

What drives the effort of a NIST 800-171 implementation?

Effort follows the scope of the work more than the framework name. The main drivers are:

The requirement count and version: Rev. 3 has 97 requirements, while the Rev. 2 set that DoD still enforces has 110.
Organization-defined parameters: Rev. 3 defines 88 ODPs across 50 requirements, and if the agency does not set them, the nonfederal organization must assign them.
The CUI boundary: how many systems, enclaves and users touch CUI.
Existing documentation: whether policies and procedures already exist and match what is done.

Ask the provider which version and ODP values it will work against before you compare estimates.

Can our internal team do NIST 800-171 work alone?

Often yes for part of the work, but the decision depends on the team's capacity, its familiarity with the requirements and the CUI boundary, and whether it can produce evidence that an assessor will accept. Internal staff usually own the system inventory, policies and day-to-day operation. Teams often bring in outside help for boundary design, gap assessment, hardening and assessment readiness. Confirm the assessment path with the contracting agency, because the required assessment method depends on the contract and the CMMC requirements in effect.

What should we ask a provider to include in a fixed-scope quote?

Ask for a written scope that names the version of SP 800-171 and the ODP values used, the systems and sites in the CUI boundary, the deliverables and the acceptance criteria. Also ask who writes the policies and procedures, who runs the testing, what evidence is handed over and in what format, and what is excluded. Confirm whether the work includes remediation or only assessment readiness, and whether retainer support for upgrades follows a version change. Fixed-scope engagements are agreed in writing before work starts, so unclear scope is the main reason quotes diverge.

How long does a NIST 800-171 project take?

The duration depends on the drivers already listed: the number of requirements in scope, how many ODPs the agency sets, how many systems sit inside the CUI boundary, and how complete the current documentation is. A clean, small enclave with existing policies will move faster than a broad environment with undocumented systems. We do not give a fixed duration here. Ask the provider for a timeline tied to named milestones and to the assessment date your contract requires.

Does a CSF profile count as a NIST 800-171 or any other certification?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services and has no plans to develop a conformity assessment program. A CSF Current or Target Profile is a planning and communication artifact. For CUI work, the evidence that matters is the SP 800-171 assessment result and whatever the contract requires, such as a CMMC assessment performed by an authorized or accredited body. Ask any provider to state plainly what their work produces and who issues it.

What recurring costs should we plan for after the first assessment?

The recurring costs are usually ongoing operation of the controls, periodic review of policies, change management when systems or versions change, and the re-assessment cycle the contract sets. The CSF mapping may also need review as NIST publishes new informative references, which NIST updates separately from the framework document. Ask whether a retainer covers upgrades, continuous testing and version changes, and whether those are priced separately from the initial scope.

How DeployOpen prepares SP 800-171 and CSF readiness

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares the systems, controls and evidence that a compliance assessment will examine. We do not issue audit reports, attestations or certifications, and the assessor for SP 800-171 is the agency or certifying body your contract names.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope lists which systems handle CUI and which SP 800-171 Rev. 3 requirements each system must meet.
We confirm with your contracting officer which SP 800-171 revision applies and which organization-defined parameter values they have specified.

How we build

We implement and harden the self-hosted platforms in your cloud accounts, data centers or air-gapped networks.
We map CSF 2.0 Subcategories to SP 800-171 requirements using NIST's Reference Tool, then check each mapping against your environment.
We run security testing against the in-scope systems and record findings against the requirements they affect.

How we hand over

You receive documentation of configurations, policies, procedures and the evidence that supports each assessed requirement.
Handover covers the mapping between CSF outcomes and SP 800-171 requirements so your team can maintain it after delivery.
We agree in advance which artifacts go to your assessor and which stay in your own evidence repository.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
Retainers can cover re-mapping when NIST updates informative references or when your contract moves to a new SP 800-171 revision.
Confirm retainer scope, response expectations and upgrade terms in the written proposal before you sign.

NIST 800-171 vs NIST CSF