NIST 800–171 Compliance: A Guide for Government Contractors

If your company is part of the federal supply chain, you likely need to comply with NIST 800–171. NIST 800–171 compliance applies to contractors for the DoD, GSA, NASA, and other federal and state agencies; universities and research institutions that accept federal grants; consulting firms with federal contracts; manufacturers who supply goods to federal agencies; service organizations that provide services to federal agencies; and these organizations’ subcontractors. What Is NIST 800–171? NIST 800–171 is based on NIST 800–53. Complying with 800–171 automatically puts you in compliance with the majority of 800–53. NIST 800–171 is the first government security mandate to apply to both primes and subcontractors. NIST 800–171 was created to address how government contractors should handle Controlled Unclassified Information (CUI), which is information that is not classified but still sensitive. What information is classified as CUI is defined by each individual federal agency, which must provide details to the National Archives and Records Administration. As a general rule of thumb, data that is considered sensitive under other regulations, such as credit card numbers or Social Security Numbers, would be classified as CUI. What Are the Requirements for NIST 800–171 Compliance? NIST 800–171 outlines 110 security controls grouped into 14 “families” of security requirements, including basic and derived requirements: * Access Control: Limiting system access to authorized users and limiting user access to the types of transactions and functions they are allowed to execute. * Awareness & Training: Ensuring that your staff knows how to handle CUI in compliance with NIST 800–171 and cyber security best practices. * Audit & Accountability: Creating and retaining system audit records to identify unauthorized access. * Configuration Management: Change management and maintaining secure configurations. * Identification & Authentication: Identifying and authenticating system users and devices. * Incident Response: Create a plan to respond to breaches and test it. * Maintenance: Ensuring secure system maintenance. * Media Protection: Securing hardware, such as portable storage devices, and paper records containing CUI. * Personnel Security: Avoiding insider threats. * Physical Protection: Limiting physical access to CUI. * Risk Assessment: Conducting vulnerability scans and other risk assessments. * Security Assessment: Monitoring security controls to ensure continued effectiveness. * System & Communications Protection: Securing organizational communications. * System & Information Integrity: Identifying and addressing cyber threats. NIST 800–171 compliance must be continuous. NIST 800–171 compliance isn’t just about passing an annual audit; organizations must maintain their controls year-round. Is It Too Late to Comply with NIST 800–171? The deadline for DoD contractors to fully comply, or at least have a “system security plan” in place, was December 31, 2017. While the December 31 deadline was specifically aimed at DoD contractors, all federal contractors must comply with NIST 800–171. If you are not compliant, you risk losing your federal contracts. Many small and mid-sized organizations missed the December 31 deadline, often because they felt they did not have the resources to comply. However, it is not too late. If you begin compliance efforts now, should your prime contractor, subcontractor, or DoD contracting officer inquire about your status, you can demonstrate that you have a plan to comply and are making progress with it. Don’t let fears of time and cost stop you. GRC automation solutions such as Continuum GRC’s IT Audit Machine (ITAM) greatly simplify the compliance process and significantly cut the time and costs involved, putting NIST 800–171 compliance within reach of small and mid-sized organizations.