How many requirements are in NIST 800-171?

Revision 2, which DoD contracts and CMMC Level 2 use, has 110 requirements in 14 families. Revision 3 (May 2024) has 97 requirements in 17 families.

Should I use NIST 800-171 Rev. 2 or Rev. 3?

For DoD contracts, Rev. 2. CMMC Level 2 and the current DFARS 252.204-7012 deviation (September 2026) both reference Rev. 2, even though NIST has withdrawn it in favor of Rev. 3.

How is the NIST 800-171 SPRS score calculated?

Start at 110 and subtract 5, 3 or 1 point for each requirement not met, using the weights in 32 CFR 170.24. Only 3.5.3 and 3.13.11 allow partial credit. The lowest possible score is -203.

What is a good SPRS score?

110 means every requirement is met. For a CMMC Level 2 conditional status you need at least 88, with only one-point items left on the POA&M, closed within 180 days.

How do I do a NIST 800-171 self-assessment?

Scope where CUI lives, write the system security plan, assess the 320 objectives in SP 800-171A, score against 110, write a POA&M for the gaps, and post the score in SPRS.

How often do I need to update my SPRS score?

The assessment must be no more than three years old when you're awarded a contract, unless the solicitation sets a shorter period. Update it sooner when your systems or your score change.

Is there a NIST 800-171 certification?

No. NIST doesn't certify organizations. You show compliance through an assessment under the DoD Assessment Methodology (your own Basic self-assessment, or a DoD Medium or High assessment) or a CMMC assessment, not a NIST certificate.

Is CMMC required now?

CMMC Phase 1 began November 10, 2025 with Level 1 and Level 2 self-assessments. DoD suspended Phase 2, third-party Level 2 assessments, in July 2026. The 800-171 requirements under DFARS 252.204-7012 still apply.

NIST 800-171 Compliance Checklist: 110 Requirements and SPRS

If your company handles Controlled Unclassified Information (CUI) under a DoD contract, NIST SP 800-171 is the standard you're measured against. DoD contracts still use Revision 2: 110 security requirements. All but one are worth 5, 3 or 1 point in the score you post to the Supplier Performance Risk System (SPRS).

This NIST 800-171 compliance checklist lists all 110 requirements by family, with the points each one is worth. It explains Rev. 2 vs Rev. 3, how to run the self-assessment, how the SPRS score works, and where CMMC stands in October 2026. It also points out the requirements that live on laptops and phones.

To work through it, download our free NIST checklist workbook. Its SP 800-171 tab lists all 110 requirements and calculates your SPRS score once every requirement is marked Met, Partial or Not met. A PDF guide comes with it.

In short

DFARS 252.204-7012 requires SP 800-171 on contractor systems that handle CUI. DoD uses Revision 2: 110 requirements in 14 families.
Rev. 3 (May 2024, 97 requirements) is NIST's current version, but DoD and CMMC have not adopted it.
Your self-assessment score starts at 110 and loses 5, 3 or 1 point for each requirement not met. It can go as low as -203.
Write the system security plan (SSP) first: without one, you can't report a score.
CMMC Phase 1 (self-assessments) started November 10, 2025. DoD suspended Phase 2 (third-party assessments) in July 2026.

What NIST 800-171 is and who needs it

SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations", sets the security requirements for company systems that store, process or transmit CUI. CUI is information the government creates or possesses, or that a contractor creates for it, that needs protection but isn't classified: technical drawings, specifications, export-controlled data and similar.

DoD contractors and subcontractors. DFARS 252.204-7012 requires 800-171 on covered contractor systems and cyber incident reports to DoD within 72 hours. It flows down to subcontractors that handle CUI.
Assessment and SPRS. DFARS 252.204-7019 requires a current assessment, no more than three years old, with the summary score posted in SPRS. Under DFARS class deviation 2026-O0025 (latest revision September 2026), the same rules sit in clause 252.240-7997.
Other agencies. A FAR rule that would apply 800-171 to CUI across all federal contracts was proposed in January 2025 and has not been finalized.

There is no NIST 800-171 certification. NIST does not certify organizations. You prove compliance with an assessment: your own (Basic), or one by DoD (Medium or High), and under CMMC, a CMMC assessment. For the bigger picture, see our guide to NIST compliance.

NIST 800-171 Rev. 2 vs Rev. 3: which one to use

Comparison of SP 800-171 Rev. 2 (110 requirements, used by DoD and CMMC today) and Rev. 3 (97 requirements, May 2024)

NIST published Revision 3 in May 2024 and withdrew Revision 2 at the same time. Rev. 3 has 97 requirements in 17 families. It adds Planning, System and Services Acquisition, and Supply Chain Risk Management, folds some requirements together, and introduces organization-defined parameters: values such as time periods that the organization sets.

DoD hasn't moved. CMMC Level 2 (32 CFR Part 170) incorporates "NIST SP 800-171 R2" by reference, and the DFARS deviation signed in September 2026 names Revision 2 in 252.204-7012. For DoD contracts, assess against Rev. 2's 110 requirements. Use Rev. 3 as a preview of where the requirements are heading, not as the standard you report.

The NIST 800-171 checklist: all 110 requirements

The 110 requirements of Revision 2 sit in 14 families. Points are the value subtracted from 110 if the requirement isn't met, from the DoD scoring method in 32 CFR 170.24.

The 110 SP 800-171 Rev. 2 requirements by family, each shaded by its SPRS weight of 5, 3 or 1 points

ID	Family	Requirements	Points at stake
3.1	Access Control	22	54
3.2	Awareness and Training	3	11
3.3	Audit and Accountability	9	19
3.4	Configuration Management	9	33
3.5	Identification and Authentication	11	27
3.6	Incident Response	3	11
3.7	Maintenance	6	18
3.8	Media Protection	9	23
3.9	Personnel Security	2	8
3.10	Physical Protection	6	14
3.11	Risk Assessment	3	9
3.12	Security Assessment	4	13
3.13	System and Communications Protection	16	42
3.14	System and Information Integrity	7	31
	Total	110	313

Requirement text is quoted from NIST SP 800-171 Rev. 2. Requirements marked (device) have a device side; more on those below.

3.1 Access Control (22)

	ID	Requirement	SPRS points
☐	3.1.1	Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).	5
☐	3.1.2	Limit system access to the types of transactions and functions that authorized users are permitted to execute.	5
☐	3.1.3	Control the flow of CUI in accordance with approved authorizations.	1
☐	3.1.4	Separate the duties of individuals to reduce the risk of malevolent activity without collusion.	1
☐	3.1.5	Employ the principle of least privilege, including for specific security functions and privileged accounts.	3
☐	3.1.6	Use non-privileged accounts or roles when accessing nonsecurity functions.	1
☐	3.1.7	Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.	1
☐	3.1.8	Limit unsuccessful logon attempts.	1
☐	3.1.9	Provide privacy and security notices consistent with applicable CUI rules.	1
☐	3.1.10	Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. (device)	1
☐	3.1.11	Terminate (automatically) a user session after a defined condition.	1
☐	3.1.12	Monitor and control remote access sessions.	5
☐	3.1.13	Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.	5
☐	3.1.14	Route remote access via managed access control points.	1
☐	3.1.15	Authorize remote execution of privileged commands and remote access to security-relevant information.	1
☐	3.1.16	Authorize wireless access prior to allowing such connections.	5
☐	3.1.17	Protect wireless access using authentication and encryption.	5
☐	3.1.18	Control connection of mobile devices. (device)	5
☐	3.1.19	Encrypt CUI on mobile devices and mobile computing platforms. (device)	3
☐	3.1.20	Verify and control/limit connections to and use of external systems.	1
☐	3.1.21	Limit use of portable storage devices on external systems.	1
☐	3.1.22	Control CUI posted or processed on publicly accessible systems.	1

3.2 Awareness and Training (3)

	ID	Requirement	SPRS points
☐	3.2.1	Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.	5
☐	3.2.2	Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.	5
☐	3.2.3	Provide security awareness training on recognizing and reporting potential indicators of insider threat.	1

3.3 Audit and Accountability (9)

	ID	Requirement	SPRS points
☐	3.3.1	Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. (device)	5
☐	3.3.2	Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.	3
☐	3.3.3	Review and update logged events.	1
☐	3.3.4	Alert in the event of an audit logging process failure.	1
☐	3.3.5	Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.	5
☐	3.3.6	Provide audit record reduction and report generation to support on-demand analysis and reporting.	1
☐	3.3.7	Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.	1
☐	3.3.8	Protect audit information and audit logging tools from unauthorized access, modification, and deletion.	1
☐	3.3.9	Limit management of audit logging functionality to a subset of privileged users.	1

3.4 Configuration Management (9)

	ID	Requirement	SPRS points
☐	3.4.1	Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. (device)	5
☐	3.4.2	Establish and enforce security configuration settings for information technology products employed in organizational systems. (device)	5
☐	3.4.3	Track, review, approve or disapprove, and log changes to organizational systems.	1
☐	3.4.4	Analyze the security impact of changes prior to implementation.	1
☐	3.4.5	Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.	5
☐	3.4.6	Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. (device)	5
☐	3.4.7	Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. (device)	5
☐	3.4.8	Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. (device)	5
☐	3.4.9	Control and monitor user-installed software. (device)	1

3.5 Identification and Authentication (11)

	ID	Requirement	SPRS points
☐	3.5.1	Identify system users, processes acting on behalf of users, and devices.	5
☐	3.5.2	Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.	5
☐	3.5.3	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. (device)	5 (partial credit)
☐	3.5.4	Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.	1
☐	3.5.5	Prevent reuse of identifiers for a defined period.	1
☐	3.5.6	Disable identifiers after a defined period of inactivity.	1
☐	3.5.7	Enforce a minimum password complexity and change of characters when new passwords are created.	1
☐	3.5.8	Prohibit password reuse for a specified number of generations.	1
☐	3.5.9	Allow temporary password use for system logons with an immediate change to a permanent password.	1
☐	3.5.10	Store and transmit only cryptographically-protected passwords.	5
☐	3.5.11	Obscure feedback of authentication information.	1

3.6 Incident Response (3)

	ID	Requirement	SPRS points
☐	3.6.1	Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.	5
☐	3.6.2	Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.	5
☐	3.6.3	Test the organizational incident response capability.	1

3.7 Maintenance (6)

	ID	Requirement	SPRS points
☐	3.7.1	Perform maintenance on organizational systems.	3
☐	3.7.2	Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.	5
☐	3.7.3	Ensure equipment removed for off-site maintenance is sanitized of any CUI.	1
☐	3.7.4	Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.	3
☐	3.7.5	Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.	5
☐	3.7.6	Supervise the maintenance activities of maintenance personnel without required access authorization.	1

3.8 Media Protection (9)

	ID	Requirement	SPRS points
☐	3.8.1	Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.	3
☐	3.8.2	Limit access to CUI on system media to authorized users.	3
☐	3.8.3	Sanitize or destroy system media containing CUI before disposal or release for reuse. (device)	5
☐	3.8.4	Mark media with necessary CUI markings and distribution limitations.	1
☐	3.8.5	Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.	1
☐	3.8.6	Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.	1
☐	3.8.7	Control the use of removable media on system components. (device)	5
☐	3.8.8	Prohibit the use of portable storage devices when such devices have no identifiable owner.	3
☐	3.8.9	Protect the confidentiality of backup CUI at storage locations.	1

3.9 Personnel Security (2)

	ID	Requirement	SPRS points
☐	3.9.1	Screen individuals prior to authorizing access to organizational systems containing CUI.	3
☐	3.9.2	Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.	5

3.10 Physical Protection (6)

	ID	Requirement	SPRS points
☐	3.10.1	Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.	5
☐	3.10.2	Protect and monitor the physical facility and support infrastructure for organizational systems.	5
☐	3.10.3	Escort visitors and monitor visitor activity.	1
☐	3.10.4	Maintain audit logs of physical access.	1
☐	3.10.5	Control and manage physical access devices.	1
☐	3.10.6	Enforce safeguarding measures for CUI at alternate work sites.	1

3.11 Risk Assessment (3)

	ID	Requirement	SPRS points
☐	3.11.1	Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.	3
☐	3.11.2	Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. (device)	5
☐	3.11.3	Remediate vulnerabilities in accordance with risk assessments.	1

3.12 Security Assessment (4)

	ID	Requirement	SPRS points
☐	3.12.1	Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.	5
☐	3.12.2	Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.	3
☐	3.12.3	Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.	5
☐	3.12.4	Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.	Not scored

3.13 System and Communications Protection (16)

	ID	Requirement	SPRS points
☐	3.13.1	Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.	5
☐	3.13.2	Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.	5
☐	3.13.3	Separate user functionality from system management functionality.	1
☐	3.13.4	Prevent unauthorized and unintended information transfer via shared system resources.	1
☐	3.13.5	Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.	5
☐	3.13.6	Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).	5
☐	3.13.7	Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).	1
☐	3.13.8	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.	3
☐	3.13.9	Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.	1
☐	3.13.10	Establish and manage cryptographic keys for cryptography employed in organizational systems.	1
☐	3.13.11	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.	5 (partial credit)
☐	3.13.12	Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.	1
☐	3.13.13	Control and monitor the use of mobile code.	1
☐	3.13.14	Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.	1
☐	3.13.15	Protect the authenticity of communications sessions.	5
☐	3.13.16	Protect the confidentiality of CUI at rest. (device)	1

3.14 System and Information Integrity (7)

	ID	Requirement	SPRS points
☐	3.14.1	Identify, report, and correct system flaws in a timely manner. (device)	5
☐	3.14.2	Provide protection from malicious code at designated locations within organizational systems.	5
☐	3.14.3	Monitor system security alerts and advisories and take action in response.	5
☐	3.14.4	Update malicious code protection mechanisms when new releases are available.	5
☐	3.14.5	Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.	3
☐	3.14.6	Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.	5
☐	3.14.7	Identify unauthorized use of organizational systems.	3

The 800-171 requirements that live on laptops and phones

16 of the 110 requirements have a device side. Many of them can be shown with a device management report for every device at once, though two (3.3.1 and 3.5.3) are only partly device work:

ID	What it asks	Points	What a device management tool can do
3.1.10	Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.	1	Screen lock after inactivity
3.1.18	Control connection of mobile devices.	5	Enroll mobile devices and apply passcode and encryption policy
3.1.19	Encrypt CUI on mobile devices and mobile computing platforms.	3	Enforce encryption on phones and report status
3.3.1	Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, …	5	Partly: admin event log of console actions, with export
3.4.1	Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, …	5	Device inventory and policy baselines
3.4.2	Establish and enforce security configuration settings for information technology products employed in organizational sys…	5	Enforce passcode, encryption, USB and firewall settings
3.4.6	Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities…	5	App and USB restrictions
3.4.7	Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.	5	App block list, USB and host firewall controls
3.4.8	Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-excepti…	5	App allow and block lists
3.4.9	Control and monitor user-installed software.	1	App lists (partly: monitoring of user installs stays with you)
3.5.3	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privile…	5 (partial credit)	Partly: MFA for trio.so console admins only
3.8.3	Sanitize or destroy system media containing CUI before disposal or release for reuse.	5	Wipe company-owned devices before reuse
3.8.7	Control the use of removable media on system components.	5	Restrict USB storage (Mac, Windows)
3.11.2	Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting …	5	Vulnerability findings with CVSS, EPSS and CISA KEV
3.13.16	Protect the confidentiality of CUI at rest.	1	BitLocker and FileVault enforcement
3.14.1	Identify, report, and correct system flaws in a timely manner.	5	OS updates plus vulnerability findings

Some endpoint requirements need other tools. Malware protection, its updates and scans (3.14.2, 3.14.4, 3.14.5) come from your EDR or antivirus. FIPS-validated cryptography (3.13.11) depends on how the operating system's encryption module is configured, so confirm it separately. Device logs (3.3.1) come from your logging tools.

How to do a NIST 800-171 self-assessment

The Basic assessment in the DoD Assessment Methodology is a self-assessment. It's the one most contractors post in SPRS.

Six steps of an SP 800-171 self-assessment: scope, write the SSP, assess, score, plan fixes, post to SPRS

Scope. Find where CUI is stored, processed and sent: the systems, the people and the devices. A smaller boundary means fewer systems to protect, so many companies put CUI in a separate enclave.
Write the system security plan (SSP). Describe the boundary, the environment and how each requirement is implemented (requirement 3.12.4). Without an SSP, you can't report a score.
Assess each requirement. SP 800-171A (June 2018) breaks the 110 requirements into 320 assessment objectives. NIST withdrew it in May 2024 along with Rev. 2, but CMMC still references it. A requirement is met only when every one of its objectives is. Collect the evidence as you go.
Score. Start at 110 and subtract the points for each requirement that isn't met. The Excel tracker does this for you.
Plan the fixes. Write a plan of action (POA&M) for each gap with an owner and a date. A POA&M doesn't earn the points back: the requirement still counts as not met until it's done.
Post the result in SPRS. Enter the assessment date, the summary score (for example, 95 out of 110), the scope and CAGE codes, the SSP it covers, and the date you expect to reach 110. Repeat at least every three years, and update when things change.

How the SPRS score works

The score runs from 110 down to -203, the lowest possible score if nothing is met (worked out from the weights in 32 CFR 170.24). There are 44 five-point requirements, 14 three-point requirements and 51 one-point requirements. 3.12.4, the SSP, has no points because without it there's no score at all.

SPRS score scale from 110 down to the lowest possible score of minus 203, with requirement weights of 5, 3 and 1 points

Partial credit exists for two requirements only: 3.5.3 (MFA) and 3.13.11 (FIPS-validated cryptography) can lose 3 points instead of 5 when they're partly in place.
Everything else is met or not met. A requirement that's 90% done counts as not met.
For CMMC Level 2, a conditional status needs a score of at least 88 (80% of 110), and the open POA&M items can only be one-point requirements (plus 3.13.11 in a limited case). They have to be closed within 180 days.

Where CMMC stands in October 2026

CMMC is how DoD checks that 800-171 is in place. Level 2 uses the same 110 requirements.

The rules. The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and the DFARS rule that puts CMMC into contracts took effect November 10, 2025. That date started Phase 1: Level 1 and Level 2 self-assessments.
Phase 2 suspended. On July 13, 2026, DoD suspended the planned November 2026 start of Phase 2, which would have required third-party (C3PAO) Level 2 assessments. Under the September 2026 deviation, contracts can require at most a Level 1 or Level 2 self-assessment for now.
800-171 still applies. The suspension doesn't change DFARS 252.204-7012. You still need to implement the 110 requirements and keep a current SPRS score.

Level 3 adds 24 requirements from SP 800-172 (February 2021). NIST published SP 800-172 Rev. 3 in May 2026, but CMMC still references the 2021 version.

Download the free NIST checklist and SPRS tracker

The download is the trio.so NIST compliance checklist, an Excel workbook and a PDF guide. For 800-171, use:

SP 800-171 tab: all 110 requirements with the NIST text and point values. Mark each one Met, Partial or Not met; the SPRS score is complete once all 110 are marked.
POA&M tab: gaps with owners, milestones and dates.
Device controls tab: the 800-171 requirements a device management tool can support, and what stays with you.
PDF: the SPRS score explained on one page, and the 65-item NIST compliance checklist mapped to 800-171.

Federal systems use the full catalog instead: see the NIST 800-53 controls list.

More NIST guides for IT teams

How trio.so helps with the device requirements

Your 800-171 program, the SSP and the score stay your organization's responsibility. trio.so supports the device requirements from one console:

Inventory and baselines (3.4.1, 3.4.2): every enrolled Windows, Mac, iOS and Android device, with passcode, screen lock and encryption enforced as policy (BitLocker and FileVault on Windows and Mac), and USB and firewall settings on Mac and Windows.
Encryption (3.1.19, 3.13.16): enforce BitLocker and FileVault on laptops and encryption on phones, and see encryption status per device. Confirm FIPS validation (3.13.11) for your OS configuration.
Session lock (3.1.10): screen lock after inactivity.
Software (3.4.6 to 3.4.8): app allow and block lists; USB storage restriction on Mac and Windows (3.8.7).
Patching and vulnerabilities (3.14.1, 3.11.2): OS updates on Windows, macOS, iOS and Android, and vulnerability findings ranked by CVSS, EPSS and CISA KEV.
Lost devices and reuse: lock Macs, iPhones and Android devices, and wipe company-owned devices before reuse (3.8.3).
Evidence: an admin event log of console actions with export, and compliance evidence you can export for your assessment.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026. Requirement text is quoted from NIST SP 800-171 Rev. 2. The device mapping is ours, not NIST's or DoD's. This article is guidance, not legal advice.