NIST 800-171 Requirements: All 110 Controls

NIST SP 800-171 Revision 2 is the standard DFARS 252.204-7012 points at. It contains 110 requirements across 14 families, and the DoD Assessment Methodology assigns each one a weight of five, three or one point — with a single exception worth zero.

Those weights are what produce your SPRS score, and they are not evenly distributed. Four families account for more than half the points at risk.

Where the points actually sit

Access Control alone carries 54 of the 313 points. Add System and Communications Protection, Configuration Management and System and Information Integrity and those four families account for 160 points — over half the total exposure. If you are deciding where to spend first, that is the answer.

Density tells a different story. System and Information Integrity averages 4.43 points per control and contains no one-pointers at all: every SI requirement hurts. Audit and Accountability is the inverse — the lowest density in the standard at 2.11, yet it holds three of the DIBCAC top ten failures. Low stakes, high failure rate.

The two controls with partial credit

Almost every requirement is scored pass or fail. Two are not:

These two are also why published counts of five-point controls differ. Forty-two carry a straight five-point weight; counting 3.5.3 and 3.13.11 gives 44 at risk of a five-point hit. Both numbers are right.

Three angles worth knowing before you start

Access Control has an escape hatch. Requirements 3.1.12 (remote access), 3.1.16 (wireless) and 3.1.18 (mobile devices) are five-pointers that incur no deduction where the organisation genuinely disallows those connections and has policy preventing inadvertent enablement. That is 15 of AC’s 54 points removable by a scoping decision rather than a technical control — the single cheapest improvement available to a small contractor running a tight enclave.

Audit and Accountability is the trap. It carries the lowest point density in the standard, 2.11 per requirement, which makes it look like a low priority. It also holds three of the ten most-failed requirements in DIBCAC’s data — 3.3.3, 3.3.4 and 3.3.5, all concerning whether logged events are defined, reviewed and alerted on. Cheap to lose, commonly lost.

Security Assessment contains a zero-point landmine. Requirement 3.12.4, the System Security Plan, is the only unscored item in the standard. Failing it deducts nothing. But the methodology treats a missing SSP as meaning the assessment could not be completed for want of information — so you do not get a low score, you get no valid score at all.

Assessment objectives, not requirements

The most consequential thing to understand about this standard is that you are not assessed against 110 requirements. You are assessed against the 320 assessment objectives defined in NIST SP 800-171A, and a requirement counts as implemented only when every objective beneath it is satisfied.

This is where self-assessments and real assessments diverge. “We use multi-factor authentication” is a requirement-level claim. 800-171A breaks 3.5.3 into objectives covering which account types, which access paths, and how enforcement is verified. Answer at requirement level and you will overstate; answer at objective level and your score falls, which is uncomfortable and correct.

It is also why an SSP written at requirement level fails. See the SSP template for how to write to objective level.

What you cannot defer

Under 32 CFR 170.21, only one-point requirements may generally sit on a POA&M, with 3.13.11 as the sole exception under its partial-credit condition. Six requirements can never be deferred regardless of weight:

3.1.20 · 3.1.22 · 3.12.4 · 3.10.3 · 3.10.4 · 3.10.5

Conditional Level 2 status requires at least 88 of 110 points, with a 180-day closeout on whatever remains.

Revision 2 or Revision 3?

Revision 2. NIST finalised Revision 3 in May 2024 — 97 requirements across 17 families, with 88 organisation-defined parameters and 422 determination statements — and DoD immediately issued Class Deviation 2024-O0013 pinning DFARS 252.204-7012 to Revision 2. NIST’s catalogue lists Rev 3 as superseding Rev 2. DFARS does not. That divergence is the single most confusing thing in this space.

To see what all this adds up to for your organisation, use the SPRS calculator, read how the score is built, or start with what CUI actually is if you are not yet certain you are in scope. When you want it done properly, a readiness assessment scores all 110 against the objectives.

If you already run a security programme under another regime, the overlap is real but partial, and the gaps are not where most people expect them. CMMC compared with HIPAA maps what carries across and what does not.

To see where you stand against all 110 requirements, a CMMC gap analysis scores each one at objective level. The CMMC readiness checklist is a faster first pass.

Revision 3 restructures this baseline into 17 families; see NIST SP 800-171 Rev 3 for what changed and when it might apply.