NIST SP 800-171 Rev 2

ActiveCommon framework

Best for: Any organization that stores, processes, or transmits Controlled Unclassified Information (CUI) on behalf of the U.S. federal government. Defense contractors and subcontractors under DFARS clause 252.204-7012 are the primary audience, but civilian agency contractors with CUI obligations are equally covered. Company size is irrelevant: a 10-person machine shop with a single DoD subcontract has the same compliance obligation as a Fortune 100 prime.

Mandatory?	Mandatory for federal contractors handling CUI
Who validates?	C3PAO (CMMC) or self-assessment for lower CMMC levels
Renewal	Annual self-assessment; C3PAO every 3 years (CMMC Level 2+)
Scope	Non-federal systems and organizations handling CUI
Governing body	National Institute of Standards and Technology (NIST), U.S. Department of Commerce, NIST SP 800-171 Rev 2. Official source

Get started

Point the module source at the NIST SP 800-171 Rev 2 endpoint and pin a version range you reviewed:

module "..." {
  source  = "nist800171.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

nist800171.compliance.tf lists every NIST SP 800-171 Rev 2 module with its versions, inputs and outputs.

Enforce 72 NIST SP 800-171 Rev 2 controls with one registry endpoint change.

Start free trial Get started

What compliance.tf covers and what you handle

Area	Compliance.tf automates	You handle
Audit Logging and Monitoring	Validates CloudTrail multi-region enablement, S3 data event logging, object-level read/write auditing, and API Gateway stage logging. Covers requirements 3.3.1 and 3.3.2: creating and retaining audit records, and tracing actions to individual users.	Defining audit review procedures, configuring alerting thresholds, establishing log retention periods that meet contractual obligations, and documenting audit findings in the SSP.
Encryption in Transit	Checks ACM certificate expiration (30-day window) and API Gateway SSL certificate attachment. Validates that TLS is enforced on managed API endpoints.	Managing certificate lifecycle beyond expiration checks, enforcing minimum TLS versions (1.2+), and documenting encryption policies in the SSP for requirement 3.13.8.
Encryption at Rest	Validates encryption on API Gateway stage caches and AWS Backup recovery points. Detects unencrypted data stores that could expose CUI.	FIPS-validated cryptographic module selection (where required), KMS key policy management, and verifying that encryption covers all CUI data stores beyond those checked here (EBS, RDS, S3).
Network Boundary Protection	Checks that Auto Scaling launch configurations do not assign public IPs and that WAF web ACLs are associated with API Gateway stages. Detects resources exposed beyond the CUI boundary.	Defining the CUI enclave boundary in the SSP, configuring WAF rule sets appropriate to your threat model, and implementing network segmentation between CUI and non-CUI systems.
Backup and Recovery Integrity	Validates backup plan retention minimums (35 days), recovery point retention periods, and that manual deletion of recovery points is disabled. Covers aspects of requirement 3.8.9 and system resilience.	Recovery procedures need periodic testing, recovery time objectives need documentation, and backup storage locations must meet the same CUI protection requirements as production systems.

Controls by category

72 of 106 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 34 are Mapped only: NIST SP 800-171 Rev 2 lists them, no compliance.tf module checks them.

Audit and Accountability (3.3)

The most common finding in this family is CloudTrail enabled in only one region or missing S3 object-level event logging. Requirements 3.3.1 and 3.3.2 require audit coverage across all regions and services, so assessors check that multi-region trails are active, S3 data events are captured for both read and write operations, and log integrity validation is enabled.

Control	Status
API Gateway stages should have logging enabled	Mapped
CloudTrail trails should have at least one enabled trail present in a region	Mapped

Media Protection (3.8)

Auditors ask to see controls that prevent individual operators from deleting recovery points, typically vault lock policies or an equivalent mechanism. Retention schedules must meet organizational and contractual minimums under requirement 3.8.9. Organizations without vault lock policies routinely fail this section, leaving backups exposed to insider deletion or ransomware scenarios.

Control	Status
Backup plan rules should retain recovery points for at least 35 days	Mapped

System and Communications Protection (3.13)

Auditors examine encryption of CUI in transit (requirement 3.13.8) and at rest (3.13.16), boundary protection (3.13.1), and monitoring at managed interfaces (3.13.6). Expected evidence includes valid TLS certificates on all public and internal endpoints, encryption enforced on cached data, and WAF rules protecting externally accessible APIs. Expired or soon-to-expire certificates are flagged as direct gaps in transmission confidentiality.

Control	Status
API Gateway REST API stages should have a client certificate configured	Mapped
API Gateway stages should have cache encryption at rest enabled	Mapped

Additional controls (101)

AWS CloudTrail (3)

Control	Status
CloudTrail trails should be integrated with CloudWatch logs	Mapped
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped
CloudTrail trails should have log file validation enabled	Mapped

AWS Database Migration Service (1)

Control	Status
DMS replication instances should not be publicly accessible	Enforced

AWS IAM (9)

Control	Status
IAM password policies should have minimum length set to 14 or greater	Mapped
IAM password policies should require at least one lowercase letter	Mapped
IAM password policies should require at least one number	Mapped
IAM password policies should require at least one symbol	Mapped
IAM password policies should require at least one uppercase letter	Mapped
IAM password policies should prevent password reuse	Mapped
IAM password policies should have strong configurations with minimum length of 8 or greater	Mapped
IAM password policies should have strong configurations	Mapped
IAM password policies should expire passwords within 90 days or less	Mapped

AWS KMS (1)

Control	Status
KMS CMK rotation should be enabled	Enforced

AWS Lambda (4)

Control	Status
Lambda functions should have concurrent execution limit configured	Enforced
Lambda functions should be configured with a dead-letter queue	Enforced
Lambda functions should be in a VPC	Enforced
Lambda functions should restrict public URL	Enforced

AWS WAF (1)

Control	Status
WAFv2 rules should have CloudWatch metrics enabled	Enforced

Amazon CloudFront (1)

Control	Status
CloudFront distributions should use the recommended TLS security policy	Enforced

Amazon CloudWatch (2)

Control	Status
CloudWatch alarms should have an action configured	Enforced
CloudWatch log groups should have retention period of at least 365 days	Enforced

Amazon CloudWatch Logs (1)

Control	Status
Log groups should have encryption at rest enabled	Enforced

Amazon DynamoDB (3)

Control	Status
DynamoDB tables should have AWS KMS encryption enabled	Enforced
DynamoDB tables should have encryption enabled	Enforced
DynamoDB tables should have point-in-time recovery enabled	Enforced

Amazon EBS (1)

Control	Status
Attached EBS volumes should have encryption enabled	Enforced

Amazon EC2 (7)

Control	Status
EC2 Client VPN endpoints should have client connection logging enabled	Mapped
EC2 instances should have detailed monitoring enabled	Enforced
EC2 instances should have EBS optimization enabled	Enforced
EC2 instances should have IAM profile attached	Enforced
EC2 instances should be in a VPC	Mapped
EC2 instances should not have a public IP address	Enforced
EC2 instances should use IMDSv2	Enforced

Amazon EFS (2)

Control	Status
EFS file systems should have encryption at rest enabled	Enforced
EFS file systems should be encrypted with CMK	Enforced

Amazon EKS (2)

Control	Status
EKS clusters endpoint public access should be restricted	Enforced
EKS clusters endpoint should restrict public access	Enforced

Amazon EMR (1)

Control	Status
EMR cluster Kerberos should be enabled	Mapped

Amazon ElastiCache (1)

Control	Status
ElastiCache Redis clusters should have automatic backups enabled with a retention period of 15 days or greater	Enforced

Amazon OpenSearch Service (3)

Control	Status
OpenSearch domains should have encryption at rest enabled	Enforced
OpenSearch domains should be in a VPC	Mapped
OpenSearch domains node-to-node encryption should be enabled	Enforced

Amazon RDS (15)

Control	Status
RDS DB clusters should have IAM authentication configured	Enforced
RDS DB instances and clusters should have enhanced monitoring enabled	Enforced
RDS DB instance backup should be enabled	Mapped
RDS DB instances backup retention period should be greater than or equal to 7	Enforced
RDS DB instances should be integrated with CloudWatch logs	Enforced
RDS DB instances should have deletion protection enabled	Enforced
RDS DB instance encryption at rest should be enabled	Enforced
RDS DB instances should have iam authentication enabled	Enforced
RDS DB instances should have logging enabled	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should have multiple AZ enabled	Enforced
RDS DB instances should not use public subnet	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should prohibit public access	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced

Amazon Redshift (6)

Control	Status
Redshift clusters should have automatic snapshots enabled	Enforced
Redshift cluster encryption in transit should be enabled	Enforced
Redshift clusters should have audit logging and encryption enabled	Enforced
Redshift clusters should have enhanced VPC routing enabled	Enforced
Redshift clusters should have required maintenance settings	Enforced
Redshift clusters should prohibit public access	Enforced

Amazon S3 (14)

Control	Status
S3 buckets should have cross-region replication enabled	Enforced
S3 buckets should have default encryption enabled	Enforced
S3 buckets should have default encryption enabled using KMS	Enforced
S3 buckets should have event notifications enabled	Enforced
S3 buckets should have logging enabled	Enforced
S3 buckets should not be accessible to all authenticated users	Enforced
S3 buckets should have object lock enabled	Enforced
S3 buckets should have object logging enabled	Mapped
S3 buckets should have policies that prohibit public access	Enforced
S3 buckets should prohibit public read access	Enforced
S3 buckets should prohibit public write access	Enforced
S3 buckets should have versioning enabled	Enforced
S3 public access should be blocked at account level	Enforced
S3 public access should be blocked at bucket level	Enforced

Amazon SNS (1)

Control	Status
SNS topics should be encrypted at rest	Enforced

Amazon SageMaker (3)

Control	Status
SageMaker endpoint configuration encryption should be enabled	Mapped
SageMaker notebook instances should not have direct internet access	Mapped
SageMaker notebook instance encryption should be enabled	Mapped

Amazon VPC (5)

Control	Status
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Enforced
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)	Mapped
VPC security groups should not allow ingress from ::/0 to remote server administration ports	Mapped
VPC subnet auto assign public IP should be disabled	Enforced

Elastic Load Balancing (10)

Control	Status
ELB application and classic load balancer logging should be enabled	Enforced
ELB application load balancer deletion protection should be enabled	Enforced
ELB application load balancers should be configured to drop HTTP headers	Enforced
ELB application load balancers should drop invalid HTTP headers	Enforced
ELB application and network load balancers should use recommended security policies	Enforced
ELB application and network load balancer listeners should use ACM certificates	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
ELB classic load balancers should have cross-zone load balancing enabled	Enforced
ELB network load balancers should have TLS listener security policy configured	Mapped
ELB listeners should use approved SSL/TLS protocol versions	Mapped

Other (4)

Control	Status
ES domain encryption at rest should be enabled	Mapped
ES domains should be in a VPC	Mapped
Elasticsearch domain should send logs to CloudWatch	Mapped
Elasticsearch domain node-to-node encryption should be enabled	Mapped

Framework	Control overlap	Note
NIST Cybersecurity Framework v1.1	High 86%
PCI DSS v4.0	High 85%
FedRAMP Moderate Baseline Rev 4	High 81%

Frequently asked questions

Does NIST 800-171 Rev 2 apply to my organization?

If your contract includes DFARS clause 252.204-7012, FAR 52.204-21, or any clause requiring CUI protection, then yes. This applies to prime contractors and every subcontractor in the supply chain that handles CUI. The determining factor is whether CUI flows through or resides on your systems, not your company size or revenue.

Rev 3 was published in May 2024. Should I be implementing Rev 2 or Rev 3?

Implement Rev 2 for now. The CMMC 2.0 final rule (effective December 16, 2024) and DFARS clause 252.204-7012 reference Rev 2. DoD has not updated contractual requirements to mandate Rev 3. Monitor the CMMC program for transition timelines, but don't delay Rev 2 compliance waiting for Rev 3 adoption.

What is the relationship between NIST 800-171 and CMMC?

CMMC Level 2 maps directly to the 110 security requirements in NIST 800-171 Rev 2. CMMC adds the assessment methodology and certification process that 800-171 itself does not define. Think of 800-171 as 'what to implement' and CMMC as 'how you prove it.' CMMC Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21 (17 practices in CMMC), a subset of 800-171.

How long does it take to achieve full compliance?

For a mid-size contractor starting from scratch, 12 to 18 months is typical. Organizations with existing security programs (ISO 27001, SOC 2) can often close gaps in 6 to 9 months. The main time sinks are documenting the System Security Plan (SSP), implementing missing technical controls, and building the Plan of Action and Milestones (POA&M) for remaining gaps. POA&Ms must carry defined closure timelines; they are not indefinite waivers.

What is an SPRS score and how is it calculated?

The Supplier Performance Risk System (SPRS) score is a self-assessed number from -203 to 110. You start at 110 and subtract weighted values for each requirement not fully implemented. A score of 110 means all requirements are met. DoD contracting officers can view your score before awarding contracts, and posting an inaccurate score carries False Claims Act liability. The scoring comes from the DoD Assessment Methodology; NIST SP 800-171A defines the assessment procedures.

Enforce 72 NIST SP 800-171 Rev 2 controls with one module source change.