NIST SP 800-171
The security requirements for Controlled Unclassified Information in a contractor's own systems, and the two documents an assessor reads before anything else.
NIST SP 800-171 sets the security requirements for protecting Controlled Unclassified Information in nonfederal systems. Revision 3, published in May 2024, organises them into seventeen requirement families, with the system security plan and the plan of action and milestones as the artifacts that govern what is implemented and what is not.
Security requirements covering access control, audit and accountability, configuration management, identification, incident response, and media protection.
National Institute of Standards and Technology
Nonfederal systems that process, store or transmit Controlled Unclassified Information. NIST SP 800-171.
Not a certification. Conformance is self-assessed or assessed under a programme such as CMMC, against the revision the contract cites.
Any nonfederal organization that processes, stores, or transmits Controlled Unclassified Information on behalf of a federal agency.
| Requirement | Module | What It Does |
|---|---|---|
| Access Control (03.01) | Engineering | Drawings, bills of material, routings, and job records are reachable only through role-based permissions, with tenant isolation enforced at the data layer rather than in application code, so least privilege over engineering data is a configuration an assessor can inspect. In a shop of fifty people the honest starting position is usually that everyone can see everything, and the work is deciding which roles genuinely need engineering data at all before the assessor asks. The limits are real: no data classification, no CUI marking or labelling, no data loss prevention, and no automatic decision about which records are controlled. That determination is yours, and so is the evidence that you reviewed it. |
| Identification and Authentication (03.05) | Workforce | Users are named, employees exist as records, roles attach to them, and single sign-on means authentication and whatever multi-factor policy you enforce stay with your identity provider rather than being reinvented here. Joiners and leavers move one record. The account review itself, the authorization behind each role, and the evidence that you ran the review remain your process and your artifacts to produce. |
| Audit and Accountability (03.03) | Analytics | Transactions carry an audit trail, so a change to a bill of material, a routing, a job, an inventory movement, or a posting is attributable to a user and a timestamp after the fact. That trail is queryable and exports through the REST API and webhooks, so the system holding your controlled data feeds the event monitoring you run across the rest of the estate instead of becoming a second island of evidence. |
| Configuration Management (03.04) | Engineering | Worth separating two things that share a name. WorkCell versions bills of material and routings with effective dates, so a job shows the structure it was built to, which is product configuration control and matters for AS9100. The 800-171 family is about baseline configuration of your information systems, and that is governed by your IT practices, not by the revision history on a part. |
| Media Protection (03.08) | Production | Operators clock on and record quantities, scrap, and inspection results at the terminal, which keeps the work order record in the database instead of circulating as printed packets that have to be collected, stored, and eventually destroyed. Less paper on the floor is less physical media in scope. Marking, handling, sanitisation, and destruction procedures are still yours to write and to evidence. |
| Supply Chain Risk Management (03.17) | Purchasing | The supplier catalog, purchase orders, and receipts give you one record of who you buy from, what you bought, and what you sent them, which is the factual base under a supply chain discussion. The supplier record is where an assessment status and the certificate behind it are held, and approval is granted per part and per process, so the flow-down review reads one list. What the record also gives you is an accurate answer to who touched a controlled part, which is the question that actually gets asked. |
This is the document an assessor opens first. It describes the system, its boundary, and how each requirement is met, and Revision 3 is explicit that where a specialised system has limitations on applying a requirement, the system security plan is used to describe any enduring exceptions. An exception that lives only in someone's understanding of the shop is not an exception; it is a finding waiting to be written.
Revision 3 draws the line cleanly: individual, isolated, or temporary deficiencies are managed through plans of action and milestones, while enduring exceptions belong in the system security plan. So the plan of action is for things you intend to fix, with owners and dates, and an item that has sat open for two years with no movement tells an assessor more about the programme than the control it refers to.
Revision 3 uses organization-defined parameters to provide flexibility through assignment and selection operations, letting a federal agency or a nonfederal organization specify the values. That flexibility cuts both ways. If you never wrote down the value you chose for a parameter, you cannot show the requirement was met, because the requirement is only defined once the parameter has a value.
Before any control is examined, the question is what is in the boundary. Every system that processes, stores, or transmits CUI is in scope, which is why the number of shared drives, spreadsheets, and side tools in a shop matters so much. Consolidating the job record, the quality record, and the engineering data into one system reduces the number of places the answer has to cover. In most shops the honest inventory is longer than anyone expects: the ERP, the file share holding customer prints, the email tenant they arrived in, the CAM seat, the controllers on the machines, the laptops, and the personal cloud drive somebody set up to get a drawing to a vendor over a weekend. Every one of those is either in the boundary and controlled, or demonstrably out of it, and the ones nobody can account for are where an assessment stalls.
Do not assume the version. Revision 3 reorganised the material into seventeen families, adding Planning, System and Services Acquisition, and Supply Chain Risk Management alongside Access Control, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment and Monitoring, System and Communications Protection, and System and Information Integrity. The requirement set you are assessed against follows the revision cited in the contract, not the newest publication.
How many requirements does NIST SP 800-171 contain?
It depends on the revision, which is why the question causes so much confusion. Revision 3, published in May 2024, organises the material into seventeen requirement families. Count and numbering changed between revisions, so work from the revision your contract or DFARS clause actually cites rather than a vendor's figure.
What are the system security plan and the plan of action and milestones?
They are the two governing artifacts. Revision 3 uses the system security plan, requirement 03.15.02, to describe enduring exceptions to the requirements, and plans of action and milestones, requirement 03.12.02, to manage individual, isolated, or temporary deficiencies. An assessor reads both before looking at a single control.
Which of our records count as CUI?
That is a determination driven by your contract and the information the Government gives you, not by your software. You decide and document it, and WorkCell is where the decision becomes enforceable: the role that can open a drawing or an inspection record is the control an assessor can test, rather than a label on a folder nobody checks.
Is WorkCell NIST 800-171 compliant?
The requirements apply to an organisation's systems and are assessed against your boundary, your plan, and your evidence, so compliance is something you hold rather than something a product confers. What WorkCell contributes is what an assessor tests in the system: least privilege over controlled technical information, an attributable audit trail, one user list with roles and leavers, a smaller boundary, and an on-premises option that keeps the data inside your own perimeter. We also run a SOC 2 programme and will walk your security reviewer through its controls under NDA.
What is an organization-defined parameter?
A value you or the sponsoring agency fills in. Revision 3 uses assignment and selection operations so that organisations can specify parameters such as periods and thresholds, which is how one requirement serves many contexts. Unrecorded parameter values are the quiet reason a control cannot be evidenced.
Does hosting our system in the cloud help or hurt an assessment?
Either, depending on the provider and the clause. An external service becomes part of the story you have to tell about your boundary. WorkCell gives you both routes: a hosted deployment backed by a SOC 2 programme we will walk your reviewer through, or an on-premises deployment that keeps controlled data inside a perimeter you assess yourself.
Keep the records as the work happens.
The plan, the parameters, and the evidence stay with you. WorkCell reduces how many systems the boundary has to cover, and keeps access and an audit trail on the records that hold your controlled technical data.