NIST 800-171 Explained: A Guide for Oklahoma Defense Contractors
NIST 800-171 is the federal standard that tells contractors how to protect Controlled Unclassified Information (CUI) on their own systems. If your company handles CUI under a Department of Defense contract, NIST 800-171 is the security baseline you are measured against, and CMMC Level 2 is built on it. This guide explains who must comply, how Revision 2 and Revision 3 differ, how the SPRS score works, and where CMMC stands in 2026 for Oklahoma suppliers around Tinker Air Force Base.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees.
What Is NIST 800-171?
NIST SP 800-171 is a set of security requirements for protecting CUI in nonfederal systems, such as a manufacturer's office network or an engineering firm's file server. It covers access control, training, logging, incident response and more.
DFARS 252.204-7012 remains in effect, and contractors that handle Controlled Unclassified Information (CUI) must still implement NIST SP 800-171. That obligation exists whether or not your contract mentions CMMC yet.
Who Needs to Comply With NIST 800-171?
Any contractor or subcontractor that stores, processes or sends CUI under a DoD contract with the DFARS 7012 clause needs to comply. That includes small machine shops, software vendors and engineering firms several tiers below the prime.
Flow-down is how most small Oklahoma businesses get pulled in. DFARS 252.204-7021 requires prime contractors to flow CMMC requirements down to subcontractors that handle FCI or CUI.
Oklahoma has a large share of these suppliers. Tinker Air Force Base in Midwest City is the largest single-site employer in Oklahoma, according to the base's installation commander. Tinker Air Force Base reported a fiscal year 2023 economic impact of $6.69 billion, including $1.3 billion in locally produced goods and services. If your business sells to Tinker or its prime contractors, check whether your contract includes the DFARS 7012 clause.
What Is the Difference Between Revision 2 and Revision 3?
Revision 3 is the newer version, but DoD contracts currently require Revision 2. That is the most important point in this section.
NIST SP 800-171 Revision 2, published January 28, 2021, has 110 security requirements. NIST SP 800-171 Revision 3 was finalized May 14, 2024, and has 97 security requirements in 17 families, adding Planning, System and Services Acquisition, and Supply Chain Risk Management families.
| Revision 2 | Revision 3 | |
|---|---|---|
| Published | January 28, 2021 | May 14, 2024 |
| Requirements | 110 | 97 |
| Required by DoD contracts today | Yes | Not yet |
| Used by CMMC Level 2 | Yes | No |
DoD class deviation 2024-O0013, issued May 2, 2024, requires contractors subject to DFARS 252.204-7012 to implement NIST SP 800-171 Revision 2, not Revision 3. Build to Revision 2 now and watch for the switch.
What Is an SPRS Score?
An SPRS score is the number you report to the Supplier Performance Risk System after assessing yourself against NIST 800-171. DFARS 252.204-7019 requires contractors to have a NIST SP 800-171 assessment no more than three years old posted in the Supplier Performance Risk System (SPRS).
The NIST SP 800-171 DoD Assessment Methodology summary score starts at a maximum of 110, and points are subtracted for each requirement not met. Some requirements cost more points than others, so a missing control such as multi-factor authentication hurts more than a missing policy detail.
Be honest in the score. An inflated SPRS number creates far more risk than a low one with a clear plan to fix the gaps.
How Does NIST 800-171 Relate to CMMC?
CMMC is the program that verifies you actually meet NIST 800-171. CMMC Level 2 covers the 110 security requirements in NIST SP 800-171 Revision 2.
CMMC Phase 1 implementation began November 10, 2025. On July 13, 2026, the DoW CIO announced that CMMC Phase 2, scheduled for November 10, 2026, was suspended and a reform task force was established, according to the DoW CIO CMMC page.
Under CMMC Level 2 (Self), contractors complete a self-assessment every three years with an annual affirmation, and POA&Ms must be closed within 180 days. A POA&M is a plan of action and milestones for each unmet requirement.
The suspension does not pause NIST 800-171 itself. The DFARS 7012 obligation still applies, so keep working on your controls. Our CMMC compliance page tracks what changes next.
Get Protected
Many NIST 800-171 requirements call for monitoring, logging and incident response. Endpoint Detectives covers those in one plan.
Which NIST 800-171 Requirements Does MDR Help Meet?
Managed detection and response helps with the technical requirements that need constant attention, such as audit logging, system monitoring and incident handling. It does not write your policies or complete your SSP for you.
| Requirement family | How MDR helps |
|---|---|
| Audit and Accountability | Security information and event management (SIEM) log aggregation keeps an audit trail |
| System and Information Integrity | Endpoint detection and response (EDR) watches for malicious activity |
| Incident Response | Analysts investigate, contain and document incidents |
| Risk Assessment | Vulnerability scanning finds weaknesses to fix |
Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. The SOC is a security operations center staffed around the clock. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
Vulnerability scanning matters because the Verizon 2026 DBIR found exploitation of vulnerabilities was the top initial access vector at 31% of breaches, and credential abuse accounted for 13%. See our vulnerability scanning services page for how scans fit into an assessment.
How Should an Oklahoma Contractor Get Started?
Start by finding where CUI lives, then score yourself honestly and fix the highest-value gaps first.
- Scope your CUI. List every system, user and location that touches it.
- Write a system security plan (SSP). Describe how each requirement is met.
- Score yourself. Use the DoD Assessment Methodology and post the result in SPRS.
- Close the big gaps. Multi-factor authentication, logging and monitoring usually come first.
- Keep evidence. Screenshots, logs and dated reviews prove the controls work.
Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide. Endpoint Detectives is a CrowdStrike partner headquartered at 720 NE 63rd St in Oklahoma City and serves businesses nationwide. See our Oklahoma City cybersecurity and Tulsa cybersecurity pages for local coverage.
FAQ
What is NIST 800-171 in simple terms?
It is a federal checklist of security requirements for protecting Controlled Unclassified Information on a contractor's own systems.
Should I build to Revision 2 or Revision 3?
Build to Revision 2. DoD contracts with the DFARS 7012 clause currently require it, and CMMC Level 2 uses its 110 requirements.
Is CMMC still happening in 2026?
Phase 1 began in November 2025, but the DoW CIO suspended Phase 2 in July 2026 while a task force reviews the program. NIST 800-171 obligations under DFARS 7012 continue.
How often do I need to update my SPRS score?
Your assessment in SPRS must be no more than three years old. Update it sooner if your systems or controls change significantly.
Conclusion
NIST 800-171 is the baseline for any contractor handling CUI, and it applies today whether or not CMMC moves forward on schedule. Build to Revision 2, post an honest SPRS score, close the biggest gaps first and keep evidence of every control.
This article is general information, not legal advice. Consult your contracting officer or attorney about your specific obligations.
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees. Talk to us about your NIST 800-171 gaps.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026