NIST SP 800-171

NIST Special Publication 800-171 is a U.S. standard that specifies 110 security requirements, organized into 14 families, for protecting Controlled Unclassified Information (CUI) in non-federal systems. The families span access control, identification and authentication, audit and accountability, configuration management, incident response, and system and information integrity, among others.

It applies to organizations — often in the defense supply chain — that store, process, or transmit CUI. Meeting it is commonly tracked through a self-assessment and a plan of action and milestones (POA&M) for any gaps.