4.3 NIST Standards Hierarchy: SP 800-171, SP 800-171A & SP 800-172
Key Takeaways
- NIST SP 800-171 Rev 2 establishes 110 security requirements across 14 security families tailored specifically for protecting CUI in non-federal systems based on FIPS 199 Moderate confidentiality impact.
- NIST SP 800-171A is the authoritative assessment companion that decomposes the 110 requirements into 320 discrete assessment objectives evaluated through Examine, Interview, and Test methods.
- Assessors evaluate requirements strictly against SP 800-171A objectives; a requirement is MET if and only if ALL of its individual assessment objectives are verified as SATISFIED.
- NIST SP 800-172 provides enhanced security requirements (selected for CMMC Level 3) designed to defend high-value assets and critical programs against Advanced Persistent Threats (APTs).
- Requirement 3.13.11 requires a validated cryptographic module in its validated configuration whenever cryptography is used to protect CUI confidentiality; an approved algorithm name alone is insufficient, but CMMC does not mandate encryption for every at-rest or remote-session scenario.
NIST Standards Hierarchy: SP 800-171, SP 800-171A & SP 800-172
The technical core of the CMMC framework is built directly upon the cybersecurity publications of the National Institute of Standards and Technology (NIST). Rather than creating a proprietary set of security controls from scratch, the Department of Defense adopted the established NIST Special Publication (SP) 800-series hierarchy.
For a Certified CMMC Professional (CCP), understanding how NIST standards are derived, structured, and assessed is vital. Assessors do not evaluate requirements in the abstract; they evaluate specific assessment objectives defined in NIST SP 800-171A using defined assessment methods (Examine, Interview, Test) and assessment objects.
1. The Federal Cybersecurity Lineage: From FISMA to CMMC
The development of non-federal cybersecurity standards follows a structured federal hierarchy rooted in statutory law.
+-----------------------------------------------------------------------------+
| FEDERAL STANDARDS DERIVATION HIERARCHY |
| |
| [FEDERAL STATUTE] |
| Federal Information Security Modernization Act (FISMA) |
| | |
| v |
| [FEDERAL STANDARDS] |
| FIPS 199 (Security Categorization: Low, Moderate, High) |
| FIPS 200 (Minimum Security Requirements for Federal Systems) |
| | |
| v |
| [FEDERAL CATALOG] |
| NIST SP 800-53 Rev 5 (Security and Privacy Controls for Federal Systems) |
| | |
| v (Tailored for Non-Federal Systems / CUI) |
| [NON-FEDERAL CUI BASELINE] |
| NIST SP 800-171 Rev 2 (110 Requirements across 14 Families) |
| | |
| +----------------+----------------+ |
| | | |
| v v |
| [ASSESSMENT COMPANION] [ENHANCED APT DEFENSE] |
| NIST SP 800-171A NIST SP 800-172 |
| (320 Assessment Objectives) (Enhanced Controls for CMMC Level 3) |
+-----------------------------------------------------------------------------+
The Tailoring Process (Derivation from SP 800-53)
NIST SP 800-171 was derived by tailoring the NIST SP 800-53 Moderate security control baseline. NIST removed controls that were:
- Uniquely Federal: Controls specific to federal agency governance, direct federal acquisition, or inter-agency reporting.
- Not Directly Related to Confidentiality: NIST SP 800-171 focuses primarily on protecting the confidentiality of CUI. Controls addressing only availability or integrity (without impacting confidentiality) were eliminated.
- Presumed Baseline Practices: General system capabilities expected of any standard commercial enterprise IT environment.
2. NIST SP 800-171 Rev 2: Architecture & The 14 Families
NIST SP 800-171 Rev 2 contains 110 security requirements organized into 14 security families. Each requirement is classified as either a Basic Security Requirement (derived from FIPS 200) or a Derived Security Requirement (derived from NIST SP 800-53).
+-----------------------------------------------------------------------------+
| NIST SP 800-171 REV 2: THE 14 SECURITY FAMILIES |
| |
| 1. Access Control (AC) - 22 reqs 8. Media Protection (MP) - 9 |
| 2. Awareness & Training (AT) - 3 reqs 9. Personnel Security (PS) - 2 |
| 3. Audit & Accountability (AU) - 9 reqs 10. Physical Protection (PE) - 6|
| 4. Configuration Mgmt (CM) - 9 reqs 11. Risk Assessment (RA) - 3 |
| 5. Ident & Authentication (IA) - 11 reqs 12. Security Assessment (CA)- 4 |
| 6. Incident Response (IR) - 3 reqs 13. System & Comms (SC) - 16 |
| 7. Maintenance (MA) - 6 reqs 14. System & Integrity (SI) - 7 |
| |
| TOTAL: 110 Requirements (All mapped to CMMC Level 2) |
+-----------------------------------------------------------------------------+
Detailed Breakdown of the 14 Security Families:
| Family | Identifier | Total Reqs | Core Technical & Operational Focus |
|---|---|---|---|
| Access Control | AC | 22 | User authorization, account management, least privilege, session lock, remote access, wireless access, mobile devices, CUI flow control. |
| Awareness & Training | AT | 3 | Security awareness training for all users, role-based training for system administrators, insider threat / social engineering awareness. |
| Audit & Accountability | AU | 9 | Audit record generation, event logging, audit review and analysis, audit log protection and immutability, time synchronization. |
| Configuration Management | CM | 9 | Baseline configurations, change control processes, tracking configuration changes, least functionality, application allowlisting. |
| Identification & Auth | IA | 11 | User identification, password complexity, multi-factor authentication (MFA) for local and network access, cryptographic token protection. |
| Incident Response | IR | 3 | Incident handling capability, incident tracking and logging, testing incident response plans. |
| Maintenance | MA | 6 | Scheduled and preventative maintenance, remote maintenance tool authorization, media sanitization before off-site maintenance. |
| Media Protection | MP | 9 | Physical media sanitization, marking media containing CUI, controlling portable storage (USBs), encrypting CUI on digital media. |
| Personnel Security | PS | 2 | Screening individuals prior to granting CUI access, protecting CUI during personnel termination and transfer. |
| Physical Protection | PE | 6 | Physical access authorizations, visitor escorting and access logs, monitoring physical perimeters, securing physical access devices. |
| Risk Assessment | RA | 3 | Periodic risk assessments, vulnerability scanning of systems and applications, remediation of identified vulnerabilities. |
| Security Assessment | CA | 4 | Periodic assessment of security controls, System Security Plan (SSP) maintenance, Plan of Action & Milestones (POA&M) management. |
| System & Comms Protection | SC | 16 | Boundary protection, network segmentation, FIPS 140 validated encryption in transit/at rest, DNS filtering, architectural separation. |
| System & Info Integrity | SI | 7 | Flaw remediation (patching), malicious code protection, automated signature updates, monitoring system alerts and communications. |
[!NOTE] Rev 2 vs. Rev 3 Context: NIST published SP 800-171 Revision 3 in May 2024. However, under 32 CFR Part 170, CMMC Level 2 is explicitly baseline-anchored to NIST SP 800-171 Revision 2. The DoD will manage future transitions to Revision 3 through formal acquisition rulemaking cycles. Candidates must know Revision 2 requirements for the CCP exam.
3. NIST SP 800-171A: The Authoritative Assessment Methodology
While NIST SP 800-171 defines what must be implemented, NIST SP 800-171A (Assessing Security Requirements for Controlled Unclassified Information) defines how assessors evaluate compliance. This publication is the assessment companion that CCP candidates must understand and qualified CCAs apply to formal Level 2 requirement evaluation.
+-----------------------------------------------------------------------------+
| THE 320 ASSESSMENT OBJECTIVES |
| |
| [NIST SP 800-171 REQUIREMENT] (Example: 3.1.1 Access Control) |
| "Limit system access to authorized users, processes acting on behalf |
| of authorized users, and devices (including other systems)." |
| |
| | |
| v |
| [NIST SP 800-171A DECOMPOSITION INTO OBJECTIVES] |
| - 3.1.1[a]: Authorized users are identified. |
| - 3.1.1[b]: Processes acting on behalf of authorized users are identified.|
| - 3.1.1[c]: Devices (and other systems) authorized to connect are ident. |
| - 3.1.1[d]: System access is limited to authorized users. |
| - 3.1.1[e]: System access is limited to processes acting on behalf of... |
| - 3.1.1[f]: System access is limited to authorized devices. |
| |
| RULE: ALL 6 OBJECTIVES MUST BE 'SATISFIED' FOR 3.1.1 TO BE 'MET'. |
+-----------------------------------------------------------------------------+
The Tripartite Assessment Methods (Examine, Interview, Test)
Assessors must evaluate assessment objects using three standardized assessment methods:
+-----------------------------------------------------------------------------+
| THE THREE ASSESSMENT METHODS |
| |
| 1. EXAMINE: |
| Reviewing, inspecting, observing, or analyzing assessment objects |
| (e.g., SSP, policies, SOPs, network diagrams, audit logs, ACL rules) |
| |
| 2. INTERVIEW: |
| Conducting structured discussions with organizational personnel |
| (e.g., System Admins, CISO, HR Manager, Facility Security Officer) |
| |
| 3. TEST: |
| Exercising mechanisms, tools, or procedures under operational |
| conditions to compare actual vs. expected behavior |
| (e.g., testing MFA prompt, simulating session lock, testing door badge) |
+-----------------------------------------------------------------------------+
Assessment Objects
Assessment methods are applied against four distinct categories of Assessment Objects:
- Specifications: The documented policies, procedures, System Security Plans (SSPs), system design specifications, and architecture diagrams.
- Mechanisms: Hardware, software, firmware, and physical security safeguards (e.g., firewalls, operating system controls, smartcard readers, cryptographic modules).
- Activities: Specific operational tasks, human actions, and procedures executed by personnel (e.g., account reviews, backup restoration drills, visitor logging).
- Individuals: The personnel who implement, manage, or execute the security policies and mechanisms (e.g., system administrators, security officers, developers, end users).
[!IMPORTANT] Evidence sufficiency: NIST SP 800-171A provides Examine, Interview, and Test. CAP requires adequate and sufficient evidence for the objective and scope. Corroboration can be useful, but no universal rule requires two methods for every objective.
4. NIST SP 800-172: Enhanced Security Requirements for CMMC Level 3
For defense programs involving critical national security technologies and high-value assets, CUI is subject to targeted attacks by sophisticated Advanced Persistent Threats (APTs). Standard NIST SP 800-171 controls are insufficient against well-resourced state-sponsored cyber adversaries.
NIST SP 800-172 (Enhanced Security Requirements for Protecting CUI) provides an advanced defense-in-depth framework designed to counter APT capabilities across the cyber kill chain.
+-----------------------------------------------------------------------------+
| NIST SP 800-172 DEFENSIVE PARADIGM |
| |
| [APT ATTACK STAGE] [SP 800-172 DEFENSE STRATEGY] |
| 1. Initial Foothold / Recon ---> Deception & Decoy Systems (Honeypots) |
| 2. Lateral Movement ---> Micro-segmentation & Zero Trust |
| 3. Privilege Escalation ---> Dual Authorization & Hardware Root |
| 4. Data Exfiltration ---> Threat Hunting & Full Packet Capture |
| 5. Persistent Residency ---> Cyber Resiliency & Out-of-Band Mgmt |
+-----------------------------------------------------------------------------+
Core Engineering Concepts of NIST SP 800-172:
- Penetration-Resistant Architecture: Utilizing hardware root of trust, secure boot, memory protection, and strict network isolation.
- Damage-Limiting Operations: Enforcing dual authorization for critical system changes, restricting non-essential tools, and isolating administrative enclaves.
- Cyber Resiliency & Deception: Deploying honeypots, decoy credentials, and dynamic routing to mislead and disrupt adversaries while maintaining operational recovery capabilities.
- CMMC Level 3 Implementation: CMMC Level 3 incorporates all 110 NIST SP 800-171 Rev 2 requirements plus a targeted subset of 24 enhanced practices from NIST SP 800-172, assessed exclusively by government evaluators (DCMA DIBCAC).
5. Cryptographic Standards: FIPS Validation
NIST SP 800-171 requirement 3.13.11 says to employ FIPS-validated cryptography when cryptography is used to protect the confidentiality of CUI. The validation applies to the cryptographic module and its validated configuration, not merely to the algorithm name. A product using AES-256 is not sufficient evidence if the deployed module has no applicable NIST Cryptographic Module Validation Program certificate.
The assessor should identify the product, cryptographic module, version, operational environment, validation certificate, security policy, and configured approved mode or conditions. Then compare those facts with the current CMVP record. A vendor statement that software is “FIPS compliant” or “uses FIPS algorithms” is weaker than evidence that the exact deployed module is validated and operating within its validation boundary.
Do not reverse the conditional rule. Requirement 3.13.11 does not state that every item of CUI must always be encrypted at rest, nor does it prescribe encryption for every remote administrative session regardless of what the session carries. Other requirements and the contract may require protection or cryptography in specific circumstances—for example, CUI transmitted over applicable network paths or protected on certain digital media. When cryptography is the required or selected means of confidentiality protection, the module must satisfy 3.13.11.
A laptop example illustrates the distinction. If the OSC relies on full-disk encryption to protect CUI confidentiality and the encryption software uses an unvalidated module, the evidence does not satisfy 3.13.11. If a different safeguard is claimed for a different objective, the assessor evaluates that claim against the actual requirement instead of inventing a universal encryption mandate. FIPS validation establishes tested module properties; it does not prove correct access control, key management, scope, or operation by itself.
What is the structural relationship between a security requirement in NIST SP 800-171 Rev 2 and an assessment objective in NIST SP 800-171A?
An OSC policy states a password setting, and an administrator repeats that statement in an interview, but the objective asks whether the system enforces the setting. How should the assessor proceed?
An Organization Seeking Assessment (OSA) uses an AES-256 commercial encryption software to protect CUI stored on laptops. However, the software has not been submitted for testing under the NIST Cryptographic Module Validation Program (CMVP) and has no FIPS validation certificate. How should a CMMC assessor score requirement 3.13.11?