Skip to main content

SP 800-171 Rev. 3Final2024

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

At a glanceSecurity requirements that federal agencies place, through contracts or agreements, on organizations that handle Controlled Unclassified Information (CUI). Most districts are not covered, but a federal grant, research partnership or contract could bring it in. Check your agreements before assuming either way.

Reading level
Technical
Length
120 pages · about 60 min for the key parts
Best for
Technology directors, Business officials
CSF 2.0
Protect, Govern
Read it on NIST DOI 10.6028/NIST.SP.800-171r3 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

When it applies. Applies only when a federal contract, grant or agreement involves Controlled Unclassified Information and requires these protections. Whether specific information is CUI is set by the federal agency in the agreement.

Key concepts

Revision 3 organizes requirements into 17 families aligned with the SP 800-53 moderate baseline and adds organization-defined parameters. Its companion SP 800-171A Rev. 3 provides assessment procedures.

How it is organized

  • Fundamentals: assumptions and tailoring
  • Security requirements in 17 families (access control through supply chain risk management)
  • Appendices: tailoring criteria, organization-defined parameters
  • Companion: SP 800-171A Rev. 3 assessment procedures

What a school district should take from it

  • It applies when a federal agreement says so; it is not a general K-12 requirement.
  • Even where it does not apply, its requirement list is a useful benchmark for protecting sensitive data.

How to use it in your district

  1. Review federal grants and contracts for CUI or SP 800-171 clauses with your business office.
  2. If CUI is in scope, limit it to a defined, protected system rather than the whole network.
  3. Otherwise, use the CSF and rubric for district-wide planning.

Common misconceptions

All districts receiving federal money must comply with SP 800-171.
It applies only when an agreement involves Controlled Unclassified Information and requires it.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • PR.AAIdentity Management, Authentication, and Access Control
  • PR.DSData Security
  • GV.POPolicy

Tools in the program portal

Related publications

Citation and source

SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.800-171r3.

Replaces: SP 800-171 Rev. 2 (2020).

Topics: Control catalogs and assessment, Data protection and backups. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.