trio.so

NIST 800-171 and 800-53 compliance for every device

NIST asks you to lock down the laptops, desktops and phones that handle controlled or federal information. trio.so sets the required settings on every device, checks that they stay on, and keeps the evidence your assessor asks for. It covers Windows, macOS, Linux, iOS/iPadOS and Android from one console.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Frameworks  ›  NIST SP 800-171
  • Screen locks after 5 minutesCTL-LCK-0103.01.10 (AC-11)
    low0 devices
  • Disk encryption is enabledCTL-ENC-0103.13.08 (SC-28)
    critical7 devices
  • Passcode is requiredCTL-PWD-0103.05.07 (IA-5)
    high5 devices
  • Real-time protection is onCTL-AM-0103.14.02 (SI-3)
    critical2 devices
  • Removable storage is blockedCTL-USB-0103.08.07 (MP-7)
    medium6 devices
Configuration policyScreen lock and passcode · All platforms
Resolved
Resolved after next evaluation
Audit trail

09:42Trio · Finding resolved · Screen locks after 5 minutes (03.01.10 (AC-11)) · open → resolved after next evaluation · 8 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

Scope

NIST 800-53 vs 800-171, and where devices fit

NIST SP 800-53 is the full control catalog for federal information systems. NIST SP 800-171 takes the controls that protect controlled unclassified information (CUI) and sets them as requirements for the contractors and other organizations that handle it. Both reach the laptops, desktops and phones your staff use every day.

  • Federal systemsAgencies and the companies that run systems for them work from 800-53, with a Low, Moderate or High baseline.
  • Contractors with CUI800-171 applies, and CMMC Level 2 for defense contractors builds on it.
  • Phones count tooRequirement 03.01.18 asks for full-device or container-based encryption of CUI on mobile devices.
  • Assessors want proofA written policy doesn't show that each device follows it.
Devices passing an access check

How it works

How NIST checks work in trio.so

Most teams track NIST controls in a spreadsheet and check devices by hand before each assessment. trio.so automates the device checks: turn on the framework, see which devices fail which controls, and fix the settings with policies from the same console. The checks then run on the schedule you set.

  1. Turn on NISTActivate NIST SP 800-53, NIST SP 800-171 or both. trio.so maps its device checks to each one.
  2. See the gapsFindings list every failing control with its NIST code, its severity and the devices affected.
  3. Fix and confirmFix the setting with a policy. A finding closes only after the next evaluation passes on that device.
Start free trialBook a demo

Requirements

NIST controls trio.so helps you meet

Most of NIST covers people, processes and your wider systems. These are the device controls, with the 800-53 control and the matching 800-171 requirement side by side, and where the proof lives in trio.so.

NIST controlHow trio.so helpsEvidence in trio.so
AC-11 · 03.01.10Device lock

Locks each device after the idle time you set, enforced by policy on computers, phones and tablets.

Screen lock check results for each device.

AC-7 · 03.01.08Unsuccessful logon attempts

Passcode policies set a lockout after a number of failed attempts, plus a minimum length.

Passcode policy status for each device.

AC-19(5) · 03.01.18Encryption on mobile devices

Enforces encryption on iPhones, iPads and Android devices, and separates work data on personal Android phones with a work profile.

Encryption status for each phone and tablet.

SC-28 · 03.13.08Protection of data at rest

Turns on BitLocker on Windows, FileVault on macOS and disk encryption on Linux, and checks it stays on.

Disk encryption check results for each computer.

CM-6 · 03.04.02Configuration settings

Applies passcode, encryption, firewall and Wi-Fi settings as managed policies, and reports where a device drifts.

Policy status: applied, failed or pending, device by device.

MP-7 · 03.08.07Media use

Blocks USB storage on Windows and Linux computers.

Policy status for each device.

SI-2 · 03.14.01Flaw remediation

Ranks vulnerabilities by CVSS, EPSS and the KEV list, then patches the OS and third party apps within the time you set.

Patch history: each job, the devices it reached and the result.

SI-3 · 03.14.02Malicious code protection

Checks that anti-malware is running on each computer, and shows Microsoft Defender for Endpoint alerts per device.

Check results for each device, with Defender alerts beside them.

CM-8 · 03.04.10System component inventory

Keeps a live list of every device with its owner, serial number, OS and installed apps.

A device list you can export as CSV.

Controls from NIST SP 800-53 Rev. 5. Requirements from NIST SP 800-171 Rev. 3 (May 2024); CMMC Level 2 assessments still use the Rev. 2 numbering.

Controls

Enforce NIST controls on every device

Set each control once as a policy. trio.so pushes it to every enrolled device, and each device reports back whether it applied, failed or is still pending.

  • Device lockIdle timeout, passcode length and lockout after failed attempts.
  • EncryptionDisks on computers, and full-device encryption on phones and tablets.
  • MediaUSB storage blocked on Windows and Linux.
  • FirewallSwitched on and checked on Windows and macOS.

Remediation

Track fixes and keep the record

A gap found on Monday shouldn't wait for next quarter's review. You fix each failing setting with a policy, the next check confirms it, and trio.so records what happened.

  • Fixes through policiesA configuration policy sets the screen lock, encryption or passcode on the failing devices, and each device reports applied, pending or failed.
  • Checked againThe finding closes only when the next evaluation passes on that device.
  • Time-limited exceptionsAn exception covers one control on one device and ends on its expiry date, so accepted gaps don't become permanent.
  • Full historyFramework changes, policy updates, evaluations and resolved findings, with who did what and when.
A laptop failing a check, the setting fixed, and the laptop passing on the next check

See your NIST findings in a free trial

Enroll a few devices, turn on NIST SP 800-171 or 800-53, and the findings fill in from your own fleet.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

NIST checks on every platform

NIST doesn't stop at Windows. Here is how deep trio.so's checks go on each platform, so you know what your evidence covers.

  • Windows
  • macOS

Windows and macOS

Device lock, disk encryption, firewall, Secure Boot, OS updates and anti-malware, plus the status of every policy.

  • Linux

Linux

Posture signals such as disk encryption, firewall and OS updates, USB storage blocking, and the status of core policies.

  • iOS/iPadOS
  • Android

Phones and tablets

Passcode, device lock and encryption policies on every phone and tablet, including Android work profiles on personal devices.

Evidence

Evidence for your NIST assessment

Assessors look for the control working on real devices, not a screenshot from the day before. trio.so collects that record as it checks.

  • Findings by NIST codeWhich devices pass and fail each 800-53 control or 800-171 requirement.
  • Evidence recordsEach check result with its source, time and freshness.
  • Audit trailWho changed what, from framework activation to closed findings.
  • Patch historyEvery patch job, the devices it reached and the result.
  • Inventory exportEvery device with owner, serial number, OS and apps, as CSV.
  • Access exportConsole members with their roles and last activity, as CSV.

Why trio.so

Compliance checks in the same console as your devices

NIST work usually spreads over an MDM, a patch tool and a spreadsheet. trio.so checks, tracks fixes and records in the console that already manages the devices.

  • One record per device

    Policies, checks, patches, inventory and remote actions in one place.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    With support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

Integrations

Works with the tools you already use

Send device compliance data to Vanta, see Microsoft Defender for Endpoint alerts per device, stream events to Splunk, alert your team in Slack or Microsoft Teams, and sync users from Microsoft Entra ID or Okta.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

NIST FAQ

No tool can on its own. trio.so helps you meet the device controls: its policies set the device settings, it checks them and keeps the evidence. Your system security plan, plan of action, policies, training and the assessment itself stay with you and your assessor. Our NIST compliance checklist covers the rest.

Find where CUI lives, define the systems in scope, write your system security plan, put each requirement in place and record the gaps in a plan of action. The device requirements, such as device lock, encryption, configuration and flaw remediation, are the part trio.so sets with policies and checks.

800-53 is the full catalog of controls for federal information systems. 800-171 is a shorter set of requirements, drawn from 800-53, for organizations outside the federal government that handle CUI. trio.so has a framework for each, and the same device checks feed both.

Controls follow NIST SP 800-53 Rev. 5. Requirement numbers follow NIST SP 800-171 Rev. 3, published in May 2024. CMMC Level 2 assessments still use Rev. 2, which numbers the same device requirements differently, for example 3.1.10 for session lock.

Yes. 800-171 requirement 03.01.18 covers mobile devices and asks for full-device or container-based encryption of CUI on them. trio.so enforces passcodes and encryption on iPhones, iPads and Android devices, and keeps work data in a separate work profile on personal Android phones.

Both standards let you set the time period yourself: 800-53 SI-2 and 800-171 03.14.01 ask you to install security updates within the period your organization defines. trio.so shows CVSS, EPSS and KEV data so you can rank updates, and patches on that schedule.

It depends on who asks. US federal work points to NIST, international customers often ask for ISO 27001, and CIS Benchmarks give detailed settings per operating system. In trio.so you can turn on several at once, and the same device checks count toward each.

Usually, yes. Policies, training, vendor reviews and the assessment sit outside device management. trio.so sends device compliance data to Vanta, so the device part stays current there.