NIST SP 800-171 Rev 3: every control, and what you already have

97 controls 41 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

NIST SP 800-171 Rev 3 CUI Security Evidence & Implementation Kit

97 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
FedRAMP Moderate	97	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	96	measure it →
FedRAMP High	96	measure it →
ISO 27001:2022	96	measure it →
NIST SP 800-53 Rev 5	95	measure it →
NIST SP 800-53 Rev 5 MODERATE	92	measure it →
NIST SP 800-53 Revision 5.1 HIGH	92	measure it →
CMMC 2.0	88	measure it →
NIST Cybersecurity Framework 2.0	88	measure it →
C5 (Germany)	87	measure it →
PCI DSS 4.0	87	measure it →
NIST SP 800-161 Rev 1	82	measure it →

Every control

Code	Control	Also in
`03.01.01`	Account Management	27
`03.01.02`	Access Enforcement	25
`03.01.03`	Information Flow Enforcement	23
`03.01.04`	Separation of Duties	21
`03.01.05`	Least Privilege	27
`03.01.06`	Least Privilege - Privileged Accounts	24
`03.01.07`	Least Privilege - Privileged Functions	22
`03.01.08`	Unsuccessful Logon Attempts	18
`03.01.09`	System Use Notification	9
`03.01.10`	Device Lock	16
`03.01.11`	Session Termination	13
`03.01.12`	Remote Access	24
`03.01.16`	Wireless Access	16
`03.01.18`	Access Control for Mobile Devices	22
`03.01.20`	Use of External Systems	20
`03.01.22`	Publicly Accessible Content	12
`03.02.01`	Literacy Training and Awareness	29
`03.02.02`	Role-Based Training	28
`03.03.01`	Event Logging	26
`03.03.02`	Audit Record Content	20
`03.03.03`	Audit Record Generation	24
`03.03.04`	Response to Audit Logging Process Failures	13
`03.03.05`	Audit Record Review, Analysis, and Reporting	27
`03.03.06`	Audit Record Reduction and Report Generation	18
`03.03.07`	Time Stamps	14
`03.03.08`	Protection of Audit Information	19
`03.04.01`	Baseline Configuration	27
`03.04.02`	Configuration Settings	26
`03.04.03`	Configuration Change Control	23
`03.04.04`	Impact Analyses	19
`03.04.05`	Access Restrictions for Change	18
`03.04.06`	Least Functionality	24
`03.04.08`	Authorized Software - Allow by Exception	27
`03.04.10`	System Component Inventory	28
`03.04.11`	Information Location	22
`03.04.12`	System and Component Configuration for High-Risk Areas	9
`03.05.01`	User Identification and Authentication	27
`03.05.02`	Device Identification and Authentication	16
`03.05.03`	Multi-Factor Authentication	23
`03.05.04`	Replay-Resistant Authentication	16
`03.05.05`	Identifier Management	23
`03.05.07`	Password Management	22
`03.05.11`	Authentication Feedback	14
`03.05.12`	Authenticator Management	25
`03.06.01`	Incident Handling	30
`03.06.02`	Incident Monitoring, Reporting, and Response Assistance	29
`03.06.03`	Incident Response Testing	25
`03.06.04`	Incident Response Training	24
`03.06.05`	Incident Response Plan	29
`03.07.04`	Maintenance Tools	14
`03.07.05`	Nonlocal Maintenance	20
`03.07.06`	Maintenance Personnel	15
`03.08.01`	Media Storage	18
`03.08.02`	Media Access	18
`03.08.03`	Media Sanitization	24
`03.08.04`	Media Marking	18
`03.08.05`	Media Transport	17
`03.08.07`	Media Use	21
`03.08.09`	System Backup - Cryptographic Protection	25
`03.09.01`	Personnel Screening	25
`03.09.02`	Personnel Termination and Transfer	26
`03.10.01`	Physical Access Authorizations	22
`03.10.02`	Monitoring Physical Access	20
`03.10.06`	Alternate Work Site	15
`03.10.07`	Physical Access Control	21
`03.10.08`	Access Control for Transmission	18
`03.11.01`	Risk Assessment	31
`03.11.02`	Vulnerability Monitoring and Scanning	31
`03.11.04`	Risk Response	24
`03.12.01`	Security Assessment	30
`03.12.02`	Plan of Action and Milestones	28
`03.12.03`	Continuous Monitoring	31
`03.12.05`	Information Exchange	25
`03.13.01`	Boundary Protection	27
`03.13.04`	Information in Shared System Resources	16
`03.13.06`	Network Communications - Deny by Default - Allow by Exception	20
`03.13.08`	Transmission Confidentiality and Integrity	25
`03.13.09`	Network Disconnect	12
`03.13.10`	Cryptographic Key Establishment and Management	21
`03.13.11`	Cryptographic Protection	23
`03.13.12`	Collaborative Computing Devices and Applications	9
`03.13.13`	Mobile Code	18
`03.13.15`	Session Authenticity	18
`03.14.01`	Flaw Remediation	28
`03.14.02`	Malicious Code Protection	28
`03.14.03`	Security Alerts, Advisories, and Directives	25
`03.14.06`	System Monitoring	27
`03.14.08`	Information Management and Retention	22
`03.15.01`	Policy and Procedures	27
`03.15.02`	System Security Plan	28
`03.15.03`	Rules of Behavior	21
`03.16.01`	Security Engineering Principles	25
`03.16.02`	Unsupported System Components	21
`03.16.03`	External System Services	29
`03.17.01`	Supply Chain Risk Management Plan	23
`03.17.02`	Acquisition Strategies, Tools, and Methods	24
`03.17.03`	Supply Chain Requirements and Processes	25

Tell me when NIST SP 800-171 Rev 3 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

OT asset inventory
Zone and conduit diagram
Patch register
Remote access policy
Infrastructure/virtualization security policy
Network segmentation + defense architecture
IAM policy
MFA enforcement report
Federation configuration
API token inventory

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Flat networks named by 8 frameworks
Long-lived tokens named by 5 frameworks
no key rotation named by 4 frameworks
split tunneling enabled named by 3 frameworks
Lessons learned not actioned named by 3 frameworks
Emergency changes bypass review named by 3 frameworks

What this page is

A control-level reference for NIST SP 800-171 Rev 3, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition