Compliance FrameworksAmericas
NIST SP 800-171
Protecting Controlled Unclassified Information (CUI): component identification, integrity.
Protecting Controlled Unclassified Information (CUI): component identification, integrity.
| Short name | 800-171 |
| Region | Americas |
| Country or scope | United States |
| Sector | Defense |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers 800-171
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for 800-171.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for 800-171 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
SP800171-3.4.1-INV Baseline Inventory of Software | Baseline configurations and inventories of organizational systems, including software, must be established and maintained (NIST SP 800-171 Rev. 2, requirement 3.4.1) | Scan |
SP800171-3.4.1-VER Inventory Version Records | System inventories must reflect the software actually installed, which requires version information for components (NIST SP 800-171 Rev. 2, requirement 3.4.1) | Scan |
SP800171-3.11.2 Vulnerability Scanning | Systems must be scanned for vulnerabilities periodically and when new vulnerabilities are identified, requiring components identifiable via PURL or CPE (NIST SP 800-171 Rev. 2, requirement 3.11.2) | Scan |
SP800171-3.14.1 Flaw Identification and Remediation | System flaws must be identified, reported and corrected in a timely manner, supported by unique identifiers that let flaws be traced to specific components (NIST SP 800-171 Rev. 2, requirement 3.14.1) | Scan |
SP800171-3.14.2 Malicious Code Protection | Protection from malicious code at designated locations is supported by the ability to verify component integrity via hashes (NIST SP 800-171 Rev. 2, requirement 3.14.2) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
3.1.1 | Limit system access to authorized users |
3.1.2 | Limit system access to authorized transactions |
3.3.1 | Create and retain audit logs to enable monitoring |
3.4.1 | Establish and maintain baseline configurations |
3.5.3 | Use multi-factor authentication for CUI access |
3.6.1 | Establish an operational incident-handling capability |
3.11.1 | Assess the risk to organizational operations from CUI processing |
3.13.1 | Monitor, control, and protect communications at boundaries |
3.13.10 | Establish and manage cryptographic keys |
3.14.1 | Identify and correct information and system flaws |
3.12.1 | Periodically assess security controls |
3.9.2 | Ensure CUI is protected during and after personnel actions |
Policy templates
Written for 800-171:
- Controlled Unclassified Information Access Control Policy
- CUI Cyber Incident Reporting Policy
- CUI System and Communications Protection Policy
And 22 from the standard set, adapted to 800-171.