NIST SP 800-171
NIST SP 800-171 is the control set for protecting Controlled Unclassified Information (CUI) when it lives on a non-federal system — which is to say, on your systems, not the government's. It's the technical backbone underneath CMMC Level 2, and it's required by DFARS clause 252.204-7012 for defense contractors, but it shows up well beyond defense too, anywhere a federal agency shares CUI with a contractor or grantee.
The standard lays out 110 controls across 14 families — access control, incident response, configuration management, media protection, and so on. None of it is exotic; it's recognizable security hygiene. What makes it demanding is the breadth and the documentation burden: you need to show, not just claim, that each control is in place, which usually means a System Security Plan describing your implementation and a Plan of Action and Milestones (POA&M) for anything not yet met.
Where this actually bites
The two places I see companies lose the most time: not knowing exactly where CUI lives in their environment, so the scope of "what has to meet 800-171" balloons to cover systems that never needed to be in scope; and having real security practices that were never written down in a way that maps cleanly to the control language an assessor or a contracting officer expects to see. Both are fixable, and both are much cheaper to fix proactively than during a contract review.
How I'd approach it
First, find and bound exactly where CUI actually flows — that scoping decision drives almost everything downstream. Then an honest control-by-control gap assessment, not a self-flattering one, followed by a remediation plan that tackles the highest-risk gaps first rather than whatever's easiest to check off. I'll help you build the System Security Plan and POA&M that document where you stand, written so they hold up under real scrutiny rather than just looking complete.
If you're handling CUI and need to know where you genuinely stand against 800-171 — whether that's your first assessment or a refresh before a contract renewal — get in touch.