Automate NIST 800-171 readiness with adaptive compliance

NIST publishes the standard. Enforcement, though, runs through contracts.

For defense work, DFARS clause 252.204-7012 requires contractors handling covered defense information to implement 800-171, and the requirement flows down to subcontractors. Verification of that implementation runs through CMMC

So NIST writes it, the Department requires it, and your prime contractor passes it down to you.

Revision 2 is what you’ll have to meet for assessment purposes .

NIST published Revision 3 and marked Revision 2 as withdrawn on its website. But assessments are conducted against Revision 2 under a Department class deviation memo, and will continue to be until that memo is withdrawn or superseded. The Department has said Revision 3 will be incorporated through future rulemaking, without announcing a date.

You may implement Revision 3 voluntarily. If you do, you must use the Department's Organization-Defined Parameters, published in an April 2025 memorandum, rather than setting your own.

The practical advice: don't switch because NIST's website says Rev 2 is withdrawn. Check what your contract and your assessment require.

The most structural change is three new requirement families, added for consistency with the SP 800-53B moderate baseline: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR). Existing families also gained and lost individual requirements.

Revision 3 also introduced Organization-Defined Parameters — values the implementing organization sets — which is why the Department had to publish its own ODPs for contractors choosing to work to Rev 3 early.

NIST 800-171 is the rulebook. CMMC is the inspection.

NIST 800-171 sets the security requirements — what you have to implement to protect CUI. CMMC is the Department's program for verifying you've done it, establishing levels, who can assess, and what has to be submitted.

They aren't interchangeable. CMMC Level 1 covers basic safeguarding of Federal Contract Information and isn't 800-171 at all. Level 2 is where the two essentially align. Level 3 goes further, drawing on the enhanced requirements in NIST 800-172.

And 800-171 isn't only a defense matter; civilian agencies reference it on contracts where CMMC doesn't apply.

NIST 800-53 is the catalog — a comprehensive set of security and privacy controls, used by federal agencies and by organizations that need that depth. It's the source material the others draw on.

NIST 800-171 is derived from it. Its requirements are tailored from the 800-53 moderate baseline for nonfederal systems handling CUI. That's direct lineage rather than loose resemblance — Revision 3 added three new families specifically for consistency with the 800-53B moderate baseline. If you've implemented 800-53 at moderate, you've done much of 800-171 already.

NIST CSF 2.0 isn't a control set at all. It's an organizing framework built around Functions — Govern, Identify, Protect, Detect, Respond and Recover — that helps you structure a security program and talk about it with people who don't read control catalogs. It points at catalogs like 800-53 rather than replacing them. You don't implement CSF the way you implement 800-171.

And CMMC is none of the above — it's the Department's program for verifying that you've implemented 800-171.

No. NIST doesn't certify anyone, and there is no NIST credential to hold.

What exists is assessment. Depending on your contract, that's either a self-assessment — scored and submitted — or an assessment conducted by an authorized third party. The output is a score and a status, not a certificate from NIST.

If a supplier claims to be "NIST certified," ask what they actually mean: which revision, what level, self-assessed or third-party, and when.

Usually, yes. The DFARS safeguarding requirement flows down. If you handle covered defense information as part of a contract — at any tier — the obligation reaches you, and your prime will expect evidence of it.

Subcontractors are frequently the weakest link in a supply chain assessment, which is why primes have become considerably more demanding about seeing evidence rather than assurances.

No. They overlap in evidence but answer different questions.

SOC 2 and ISO 27001 assess control criteria and management systems. NIST 800-171 is a prescriptive requirement set tied to a specific data type — CUI — and enforced through your contract rather than the market.

Much of the underlying evidence transfers. Access control, audit logging, configuration management, and incident response appear in all three. What doesn't transfer is the contractual obligation: a prime requiring NIST 800-171 will not accept a SOC 2 report instead.

No platform can make you compliant — that depends on your system boundary, your policies, your people, and an assessment you undergo.

What Iru does is the technical requirement families. The platform enforces access control and multi-factor authentication on the identities that reach CUI, maintains secure configuration across your devices, detects and contains incidents, manages media and device disposal, and keeps software patched — with the evidence collected continuously, so your assessment reflects current state rather than a snapshot taken the week before.

If you need an assessment, we can connect you with one of the assessors in our auditor network. Book a demo to explore the compliance solution, or if you're already a customer, reach out to your rep for details on our audit partners.