NIST SP 800-171

Only when it meets the clause's cloud requirement and sits inside your security boundary. DFARS 252.204-7012 requires cloud services that store, process or transmit covered defense information to meet security equivalent to the FedRAMP Moderate baseline. The tool also has to be covered by your system security plan and the NIST SP 800-171 controls that apply to the rest of the system.

Yes, where they affect the boundary. Requirement 3.12.4 calls for a system security plan describing the system boundary and how each requirement is met. AI tools approved for CUI belong inside it, and tools barred from CUI should be noted along with the controls that keep CUI out, such as web filtering and data loss prevention rules.

Yes, if the cloud service meets the FedRAMP Moderate baseline or FedRAMP Moderate equivalency. DFARS 252.204-7012(b)(2)(ii)(D) sets that bar for any external cloud service that stores, processes or transmits covered defense information, and the provider must also support the clause's incident reporting, media preservation and forensic access requirements.

Only in an edition that meets the DFARS 252.204-7012 cloud requirement. Any cloud service that stores, processes or transmits covered defense information must meet security equivalent to the FedRAMP Moderate baseline. Check the FedRAMP Marketplace listing for the exact service and edition, and record the decision in your system security plan before allowing CUI in it.

Under 32 CFR 170.22, the affirmation comes from a senior level representative of the contractor who is responsible for ensuring compliance with CMMC requirements and has the authority to affirm it. The official's name, title and contact information are entered in SPRS, and the affirmation states the firm has implemented and will maintain the applicable security requirements.

Three, drawn from NIST SP 800-171A: examine, interview and test. Examining means reviewing documents, configurations and diagrams. Interviewing means talking with staff about how controls work. Testing means exercising mechanisms or activities to compare actual with expected behavior. DoD's Level 2 Assessment Guide expects most assessment objectives to require testing, so documentation alone is rarely enough.

Under 32 CFR 170.17, a new Level 2 certification assessment is required within three years, and an affirming official must affirm continuing compliance at each assessment and annually thereafter. A Conditional status based on a POA&M expires unless open items are closed out by a C3PAO within 180 days of the CMMC Status Date.

Yes. The implementing memo for the Phase 2 suspension states that the cybersecurity requirements of DFARS 252.204-7012 remain in effect. That includes protecting covered defense information under NIST SP 800-171 and reporting cyber incidents to DoD within 72 hours of discovery.

Table 3 of 32 CFR 170.19(c)(1) sorts assets into five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. Only Out-of-Scope Assets, which cannot process, store or transmit CUI and provide no security protection for CUI Assets, fall outside the assessment. The in-scope categories need to be identified in the asset inventory and system security plan.

Yes, where a solicitation or contract calls for it. The Department of War said all Phase 1 self-assessment requirements remain in place. Under 32 CFR 170.16, a Level 2 self-assessment is repeated every three years with results in SPRS, and an affirming official must affirm compliance annually.

No. NIST SP 800-171 Rev 2 requirement 3.5.3, which CMMC Level 2 assesses, requires multifactor authentication for privileged accounts and for network access to all accounts, without naming a method. Requirement 3.5.4 adds replay resistance. Phishing-resistant methods such as FIDO2 keys, Windows Hello for Business, and smart cards meet the requirement and reduce the risk of credentials being relayed through a fake login page.

It depends on the original assessment. Under 32 CFR 170.21(b), the contractor performs its own closeout for Level 2 (Self), using the same method as the initial self-assessment. An authorized or accredited C3PAO performs it for Level 2 (C3PAO), and DCMA DIBCAC performs it for Level 3. The closeout covers only the requirements listed on the POA&M.

POA&M stands for plan of action and milestones. In CMMC, it lists each Level 2 security requirement still NOT MET after an assessment, with the tasks, resources and milestones to fix it. 32 CFR 170.21 limits which requirements it may include and requires a closeout assessment within 180 days.

The Conditional CMMC status expires. For Level 2 (Self), 32 CFR 170.16 says standard contractual remedies apply if this happens during a contract's period of performance, and the contractor cannot receive new awards requiring Level 2 (Self) or higher for the affected systems until it achieves a new status. The rule does not provide for an extension.

No. Under 32 CFR 170.24, a POA&M is not a substitute for a completed requirement, so an item on the POA&M is scored NOT MET until it is fixed and confirmed in a closeout assessment. The score with those items counted as NOT MET must still be at least 88 of 110 to qualify for Conditional Level 2 status.

It may be a reportable cyber incident. DFARS 252.204-7012 defines compromise to include unintentional disclosure to unauthorized persons and requires reporting to DoD at dibnet.dod.mil within 72 hours of discovery, using a medium assurance certificate. Whether a specific upload meets the threshold is a judgment for the firm and its counsel, so start the assessment as soon as it is discovered.

Firms handling Controlled Unclassified Information under DFARS 7012 must meet NIST SP 800-171, and requirement 3.1.22 requires them to control CUI posted or processed on publicly accessible systems. A public AI service is a publicly accessible system, so CUI, including technical drawings, should stay out of public AI tools. Check your contract for any approved environments.

At least 90 days. Paragraph (e) of DFARS 252.204-7012 requires contractors to preserve and protect images of all known affected information systems and relevant monitoring or packet capture data for at least 90 days from submitting the cyber incident report, so DoD can request them for forensic analysis. For an AI spill, that can include the user's workstation and AI account records.

It is a DoD-approved digital certificate a contractor needs to submit a cyber incident report under DFARS 252.204-7012. Paragraph (c)(3) of the clause requires contractors to have or acquire one. DoD's Cyber Crime Center says a firm without one should contact its DCISE team by email or at (410) 981-0104. Obtain the certificate before an incident, since the report is due within 72 hours of discovery.

Not as proposed. DFARS 252.204-7012 remains in effect on DoD contracts today. The June 2026 proposal names DIBNet as the reporting location for DoD contracts and says its Revision 3 parameters align with values DoD plans to codify in 32 CFR part 170, but how the two clauses would work together on DoD contracts will depend on the final FAR rule and DoD's own rulemaking.

Partly. Much of the work carries over, because Revision 3 builds on the same control families and the same systems. Revision 3 also reorganizes requirements, adds families such as supply chain risk management and relies on organization-defined parameters. Firms with existing Revision 2 documentation would typically need a mapping and gap review rather than a new program.

It is a proposed Standard Form titled Controlled Unclassified Information (CUI) Requirements. Agencies would include it in solicitations and contracts to state whether CUI is involved, what information must be protected, and where incidents must be reported. The form number is a placeholder in the proposed rule, and the June 2026 version updates it to list Revision 3 organization-defined parameters.

There is no set date. The comment period on the June 2026 proposal closed July 23, 2026, and no final rule had been published as of October 17, 2026. An earlier Unified Agenda projected a final rule in December 2025, which did not happen. Requirements would apply only after a final rule is issued and the clause appears in a specific contract.

The contracting agency. Under NARA's CUI program at 32 CFR part 2002 and the proposed FAR rule, the agency identifies CUI and, under the proposal, would communicate it through the SF XXX in the contract. A firm cannot opt out of a designation, but it can ask the contracting officer to clarify what information is covered before award.

Under DFARS 252.204-7019 and 252.204-7020, a NIST SP 800-171 DoD Assessment is current if it is not more than three years old, unless a solicitation sets a shorter period. Separately, CMMC Level 2 (Self) requires a new self-assessment every three years under 32 CFR 170.16, with an affirmation entered in SPRS at each assessment and annually in between.

Under 32 CFR 170.21, only requirements worth 1 point may be on a POA&M, plus 3.13.11 when encryption is used but not FIPS-validated. The score must be at least 88 of 110. Six requirements, including the system security plan (3.12.4) and three physical access controls, can never be deferred. Open items must be closed within 180 days.

Not in the requirement text. Rev 2 requirements such as 3.1.8 give no values. The companion assessment guide, SP 800-171A, asks whether the organization has defined a value, for example the means of limiting unsuccessful logon attempts or the inactivity period before a session lock. Under Rev 2 the contractor chooses and documents the value, and the assessor checks that it is enforced.

No date has been set. DoD says it will adopt Revision 3 through future rulemaking that amends the CMMC rule at 32 CFR Part 170. A planned interim final rule (RIN 0790-AM01) was listed for July 2026 but had not been published as of mid-October 2026. Until then, DFARS 252.204-7012 and CMMC assessments use Revision 2.

Yes, according to DoD's CMMC FAQs, but with conditions. A company may implement Revision 3 using the Department's organization-defined parameters, yet assessments are still conducted against Revision 2, so any gap between the two revisions has to be closed. Your SPRS score and any CMMC assessment still measure Revision 2.

Yes, as long as the SSP says so clearly. For each affected requirement, state which part the provider performs, which part your firm performs, and where the provider's responsibility documentation lives. The firm remains responsible for the requirement as a whole, so the provider's evidence needs to be available when an assessor asks for it.

Yes, if it handles CUI under a DoD contract. DFARS 252.204-7012 and the CMMC rule do not exempt firms by size, and NIST SP 800-171 requirement 3.12.4 applies to every covered environment. A small firm's SSP is usually shorter because its CUI boundary is smaller, but each applicable requirement still needs a specific entry.

Yes. NIST publishes a CUI SSP template in Word format as supplemental material to SP 800-171 Rev 2. It is a reasonable structure to start from, but it only helps if every entry is rewritten with your own CUI boundary, tools, responsible roles and evidence locations. A filled-in template full of generic statements gives an assessor nothing to verify.

Requirement 3.12.4 says periodically and does not set a frequency, so define one in the plan and follow it. Many firms review annually and after significant changes, such as a new cloud service, office or IT provider. CMMC requires an annual affirmation of continuing compliance under 32 CFR 170.22, which is hard to support with a stale SSP.

It is a value left blank inside a Rev 3 requirement, shown as [Assignment: ...] or [Selection: ...], such as the number of failed logons before lockout. NIST does not set the values. A federal agency may, and otherwise the contractor must. DoD published its values in an April 2025 memorandum and says companies implementing Rev 3 must use them.

A NIST SP 800-171 score runs from 110 down to -203. Each of the 110 Revision 2 requirements carries a value of 1, 3, or 5 points, and the value of each requirement not met is subtracted from 110. Multifactor authentication and CUI encryption can earn partial credit. The summary score is posted in the Supplier Performance Risk System (SPRS).

It can be. Table 3 of 32 CFR 170.19(c)(1) treats an endpoint hosting a VDI client as an Out-of-Scope Asset when it is configured so that nothing beyond keyboard, video and mouse reaches it. If users can download, print, copy or map drives to CUI, the laptop can process or store CUI and stays in scope. The configuration needs to be tested and documented.

It is the document required by requirement 3.12.4 of NIST SP 800-171 Rev 2. It describes the system boundary, the environment of operation, how each security requirement is implemented, and connections to other systems. Under 32 CFR 170.24, a CMMC assessment cannot be completed without an up-to-date SSP, so it is the first thing an assessor reviews.

Only AI services that meet FedRAMP Moderate or a verified equivalent and sit inside the environment your system security plan covers. DFARS 252.204-7012 applies that bar to any cloud service that stores, processes or transmits covered defense information, and a December 2023 DoD memo defines equivalency as 100 percent of the Moderate baseline validated by a FedRAMP-recognized assessor.

The contractor, and everyone at the firm who handles the information. DFARS 252.204-7012 requires the contractor to provide adequate security for covered defense information on its systems and to flow the clause down to subcontractors whose work involves it. NIST SP 800-171 requirement 3.2.1 also requires that users be made aware of the security risks of their activities.

NIST SP 800-171 Rev. 2 does not name a remote access technology. Requirements 3.1.12 through 3.1.14 call for monitoring and controlling remote sessions, protecting them with cryptography and routing them through managed access control points. A firm can document how its ZTNA broker, policies and logs address each one in its system security plan for an assessor to review.