Protect Controlled Unclassified Information the right way.
NIST SP 800-171 defines the security requirements for protecting CUI in non-federal systems. It is the foundation of DFARS cybersecurity clauses and CMMC Level 2. XaaS Techs helps you implement, document and maintain it.
14 control families, 110 requirements
NIST SP 800-171 (Revision 2, used by CMMC Level 2) organizes 110 requirements into 14 families, including access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, media protection and system and communications protection.
Defense contractors subject to DFARS 252.204-7012 and related clauses must implement these requirements and may need to report a self-assessment score in SPRS.
How we help
- CUI scoping and data flow mapping
- Gap assessment and score estimate
- System Security Plan (SSP)
- Plan of Action and Milestones
- Technical remediation
- Continuous monitoring
XaaS Techs provides technical implementation and readiness support. Formal certification, assessment or attestation is performed by independent, authorized assessors or auditors.
Explore related frameworks
Need help with NIST 800-171?
Get a gap assessment and a practical plan to close your gaps.