Manufacturing

NIST SP 800-171 implementation for manufacturers in the defense supply chain

If you make parts or products for the Department of Defense or its prime contractors and handle controlled unclassified information (CUI), your contracts generally require you to protect it under NIST SP 800-171. We help you implement those requirements in a way your team can operate.

Book an advisory consultation

What usually drives the work

  • Defense contract clauses (DFARS 252.204-7012) that require NIST SP 800-171 for covered defense information
  • Prime contractors asking suppliers to show how they protect CUI
  • Security reviews from large commercial customers

NIST SP 800-171 implementation support

  • Scoping: where CUI lives in your systems, and who and what can reach it
  • Gap assessment against the NIST SP 800-171 requirements, using the revision your contracts call for
  • Implementing the controls, sized to your plant and IT environment
  • The documentation the standard calls for, such as a system security plan and a plan of action for open items

NIST SP 800-171 implementation lays the groundwork for CMMC, because CMMC Level 2 assessments evaluate the same NIST SP 800-171 security requirements.

How else we help

All industries · SOC 2 readiness

A NIST SP 800-171 clause in your next contract?