NIST SP 800-171
A set of 110 security requirements for protecting controlled unclassified information in non-federal systems.
It applies to defense contractors and others handling CUI, and unlike the CSF it is specific: each requirement is testable and either met or not.
It is the technical basis of CMMC Level 2, so work done against 800-171 counts directly toward that assessment.
Where this comes up
NIST SP 800-171 sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
CMMC The Department of Defense programme that verifies contractors meet required cybersecurity practices before award. Controlled unclassified information Government information that is not classified but still requires protection under law or policy. SPRS score A self-assessed score from -203 to 110 reflecting how many NIST SP 800-171 requirements a contractor meets. NIST Cybersecurity Framework A voluntary framework organizing security work into functions: govern, identify, protect, detect, respond, and recover.