NIST 800-171 refers to National Institute of Standards and Technology Special Publication 800-171, which governs Controlled Unclassified Information (CUI) in Non-Federal Information Systems and Organizations. It is essentially a set of standards that defines how to safeguard and distribute material deemed sensitive but not classified.

NIST 800-171 was developed after FISMA (Federal Information Security Management Act) was passed in 2003, resulting in several security standards and guidelines, created in part to improve cybersecurity, especially after numerous, recent well-documented breaches, including the U.S. Postal Service and National Oceanic and Atmospheric Administration. According to the National Institute of Standards and Technology, the primary reason is “a national imperative” to ensure unclassified information, which isn’t part of federal information systems and organizations, is properly protected and consistent. This helps the federal government “successfully carry out its designated missions and business operations.”

For certain government agencies, most notably the DoD (Department of Defense), GSA (General Services Administration) and NASA (National Aeronautics and Space Administration), a revised set of rules for NIST compliances took effect on December 31, 2017, requiring anyone who works with CUI from those agencies to implement specific security measures for how they handle data and report non-compliance to the agency’s CIO. Under federal regulations, such as DFARS clause 252.204-7012, every affected company and agency is now required to assess and document their compliance in handling this info in more than a dozen areas, from the way their networks are configured; how any and all media is protected, and how employees receive access to the NIST 800-171 standard.

Prior to these requirements, every agency had a unique set of rules for data handling, safeguarding and disposing of this material. These inconsistent standards posed a challenge – and a potential security concern – when information needed to be shared, especially when multiple contractors become part of the process.