NIST SP 800-171 REV. 3 Handbook

• Access Control

  Ensure that only authorized persons can access your systems and information.

  16 controls

• Awareness and Training

  Ensure that users have proper security training before being allowed to access or administer your systems and information.

  2 controls

• Audit and Accountability

  Create, protect, and retain system logs, to monitor, analyze, investigate, and report unauthorized activity occurring on your systems.

  8 controls

• Configuration Management

  Securely configure and maintain your systems in accordance with best practices and prevent unauthorized changes from being made.

  10 controls

• Identification and Authentication

  Properly verify the identities of users, processes, and devices before allowing them to access your systems and information.

  8 controls

• Incident Response

  Build an incident response capability to react to cybersecurity incidents.

  5 controls

• Maintenance

  Schedule and perform authorized maintenance on your systems in accordance with manufacturer requirements.

  3 controls

• Media Protection

  Protect the confidentiality and integrity of digital media (e.g. hard drives) and non-digital media (e.g. paper).

  7 controls

• Personnel Security

  Minimize the risk your staff pose to your systems and information.

  2 controls

• Physical Protection

  Protect your facilities, personnel, and systems from physical threats such as unauthorized facility access.

  5 controls

• Risk Assessment

  Assess the risks your systems face from various threats and vulnerabilities and develop plans to mitigate risk.

  3 controls

• Security Assessmennt Monitoring

  Assess the risks your systems face from various threats and vulnerabilities and develop plans to mitigate risk.

  4 controls

• System and Communication Protection

  Implement encrypted communications and control communications to protect your data.

  10 controls

• System and Information Integrity

  Keep your systems updated with security patches to prevent malware infections, ensure that you have anti-malware software deployed and secure your email systems.

  5 controls

• Planning

  Ensure that the organization has policies, procedures, and plans to implement security controls for protecting CUI

  3 controls

• System and Services Acquisition

  Ensure that the organization uses products, systems, and services from organziations that meet organization defined security requirements.

  3 controls

• Supply Chain Risk Management

  Develop plans to ensure that the organization manages supply chain risk and has methods for securely acquiring services.

  3 controls

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.