NIST SP 800-171 compliance: the 110 requirements behind CMMC Level 2

CMMC Level 2 assesses the 110 security requirements of NIST SP 800-171 Rev 2, in 14 families. DFARS 252.204-7012 already required them for contractors holding CUI; CMMC adds the assessment, the SPRS score and the affirmation. Each requirement below shows the points it costs when not met (32 CFR 170.24, CMMC Scoring Methodology).

Families

3.1 Access Control (AC): 22 requirements
3.2 Awareness and Training (AT): 3 requirements
3.3 Audit and Accountability (AU): 9 requirements
3.4 Configuration Management (CM): 9 requirements
3.5 Identification and Authentication (IA): 11 requirements
3.6 Incident Response (IR): 3 requirements
3.7 Maintenance (MA): 6 requirements
3.8 Media Protection (MP): 9 requirements
3.9 Personnel Security (PS): 2 requirements
3.10 Physical Protection (PE): 6 requirements
3.11 Risk Assessment (RA): 3 requirements
3.12 Security Assessment (CA): 4 requirements
3.13 System and Communications Protection (SC): 16 requirements
3.14 System and Information Integrity (SI): 7 requirements

"Basic" requirements come from FIPS 200 and "derived" ones from NIST SP 800-53 controls. Rev 3 of SP 800-171 exists, but DFARS 7012 and CMMC Level 2 still assess Rev 2.

3.1 Access Control

3.1.1 5 pts basic
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 5 pts basic
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
3.1.3 1 pt derived
Control the flow of CUI in accordance with approved authorizations.
3.1.4 1 pt derived
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
3.1.5 3 pts derived
Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 1 pt derived
Use non-privileged accounts or roles when accessing nonsecurity functions
3.1.7 1 pt derived
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.8 1 pt derived
Limit unsuccessful logon attempts.
3.1.9 1 pt derived
Provide privacy and security notices consistent with applicable CUI rules.
3.1.10 1 pt derived
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity
3.1.11 1 pt derived
Terminate (automatically) a user session after a defined condition.
3.1.12 5 pts derived
Monitor and control remote access sessions.
3.1.13 5 pts derived
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
3.1.14 1 pt derived
Route remote access via managed access control points.
3.1.15 1 pt derived
Authorize remote execution of privileged commands and remote access to security-relevant information.
3.1.16 5 pts derived
Authorize wireless access prior to allowing such connections
3.1.17 5 pts derived
Protect wireless access using authentication and encryption
3.1.18 5 pts derived
Control connection of mobile devices.
3.1.19 3 pts derived
Encrypt CUI on mobile devices and mobile computing platforms.
3.1.20 1 pt derived
Verify and control/limit connections to and use of external systems.
3.1.21 1 pt derived
Limit use of portable storage devices on external systems.
3.1.22 1 pt derived
Control CUI posted or processed on publicly accessible systems.

3.2 Awareness and Training

3.2.1 5 pts basic
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
3.2.2 5 pts basic
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.2.3 1 pt derived
Provide security awareness training on recognizing and reporting potential indicators of insider threat.

3.3 Audit and Accountability

3.3.1 5 pts basic
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
3.3.2 3 pts basic
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
3.3.3 1 pt derived
Review and update logged events.
3.3.4 1 pt derived
Alert in the event of an audit logging process failure.
3.3.5 5 pts derived
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
3.3.6 1 pt derived
Provide audit record reduction and report generation to support on-demand analysis and reporting.
3.3.7 1 pt derived
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records
3.3.8 1 pt derived
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
3.3.9 1 pt derived
Limit management of audit logging functionality to a subset of privileged users.

3.4 Configuration Management

3.4.1 5 pts basic
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
3.4.2 5 pts basic
Establish and enforce security configuration settings for information technology products employed in organizational systems.
3.4.3 1 pt derived
Track, review, approve or disapprove, and log changes to organizational systems.
3.4.4 1 pt derived
Analyze the security impact of changes prior to implementation.
3.4.5 5 pts derived
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6 5 pts derived
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.4.7 5 pts derived
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
3.4.8 5 pts derived
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
3.4.9 1 pt derived
Control and monitor user-installed software.

3.5 Identification and Authentication

3.5.1 5 pts basic
Identify system users, processes acting on behalf of users, and devices.
3.5.2 5 pts basic
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.3 3 or 5 pts derived
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
3.5.4 1 pt derived
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
3.5.5 1 pt derived
Prevent reuse of identifiers for a defined period.
3.5.6 1 pt derived
Disable identifiers after a defined period of inactivity.
3.5.7 1 pt derived
Enforce a minimum password complexity and change of characters when new passwords are created.
3.5.8 1 pt derived
Prohibit password reuse for a specified number of generations.
3.5.9 1 pt derived
Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10 5 pts derived
Store and transmit only cryptographically-protected passwords.
3.5.11 1 pt derived
Obscure feedback of authentication information

3.6 Incident Response

3.6.1 5 pts basic
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
3.6.2 5 pts basic
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
3.6.3 1 pt derived
Test the organizational incident response capability.

3.7 Maintenance

3.7.1 3 pts basic
Perform maintenance on organizational systems.
3.7.2 5 pts basic
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
3.7.3 1 pt derived
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
3.7.4 3 pts derived
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
3.7.5 5 pts derived
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
3.7.6 1 pt derived
Supervise the maintenance activities of maintenance personnel without required access authorization.

3.8 Media Protection

3.8.1 3 pts basic
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
3.8.2 3 pts basic
Limit access to CUI on system media to authorized users
3.8.3 5 pts basic
Sanitize or destroy system media containing CUI before disposal or release for reuse.
3.8.4 1 pt derived
Mark media with necessary CUI markings and distribution limitations.
3.8.5 1 pt derived
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
3.8.6 1 pt derived
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
3.8.7 5 pts derived
Control the use of removable media on system components.
3.8.8 3 pts derived
Prohibit the use of portable storage devices when such devices have no identifiable owner.
3.8.9 1 pt derived
Protect the confidentiality of backup CUI at storage locations.

3.9 Personnel Security

3.9.1 3 pts basic
Screen individuals prior to authorizing access to organizational systems containing CUI.
3.9.2 5 pts basic
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers

3.10 Physical Protection

3.10.1 5 pts basic
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
3.10.2 5 pts basic
Protect and monitor the physical facility and support infrastructure for organizational systems.
3.10.3 1 pt derived
Escort visitors and monitor visitor activity.
3.10.4 1 pt derived
Maintain audit logs of physical access.
3.10.5 1 pt derived
Control and manage physical access devices.
3.10.6 1 pt derived
Enforce safeguarding measures for CUI at alternate work sites.

3.11 Risk Assessment

3.11.1 3 pts basic
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI
3.11.2 5 pts derived
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
3.11.3 1 pt derived
Remediate vulnerabilities in accordance with risk assessments.

3.12 Security Assessment

3.12.1 5 pts basic
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
3.12.2 3 pts basic
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
3.12.3 5 pts basic
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
3.12.4 no points; required basic
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

3.13 System and Communications Protection

3.13.1 5 pts basic
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 5 pts basic
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
3.13.3 1 pt derived
Separate user functionality from system management functionality.
3.13.4 1 pt derived
Prevent unauthorized and unintended information transfer via shared system resources.
3.13.5 5 pts derived
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
3.13.6 5 pts derived
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
3.13.7 1 pt derived
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
3.13.8 3 pts derived
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
3.13.9 1 pt derived
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
3.13.10 1 pt derived
Establish and manage cryptographic keys for cryptography employed in organizational systems.
3.13.11 3 or 5 pts derived
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
3.13.12 1 pt derived
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
3.13.13 1 pt derived
Control and monitor the use of mobile code.
3.13.14 1 pt derived
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
3.13.15 5 pts derived
Protect the authenticity of communications sessions.
3.13.16 1 pt derived
Protect the confidentiality of CUI at rest.

3.14 System and Information Integrity

3.14.1 5 pts basic
Identify, report, and correct system flaws in a timely manner.
3.14.2 5 pts basic
Provide protection from malicious code at designated locations within organizational systems.
3.14.3 5 pts basic
Monitor system security alerts and advisories and take action in response.
3.14.4 5 pts derived
Update malicious code protection mechanisms when new releases are available.
3.14.5 3 pts derived
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
3.14.6 5 pts derived
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
3.14.7 3 pts derived
Identify unauthorized use of organizational systems.

Check your answers for all 110

Sources

NIST SP 800-171 Rev 2
NIST SP 800-171A (assessment objectives)
32 CFR 170.24, CMMC Scoring Methodology
Checked on 1 October 2026.