NIST SP 800-171A: every control, and what you already have

97 controls 19 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
CMMC 2.0	4	measure it →
FedRAMP High	4	measure it →
FedRAMP Moderate	4	measure it →
ISO 22301:2019	4	measure it →
NIST SP 800-171 Rev 3	4	measure it →
NIST SP 800-53 Rev 5	4	measure it →
NIST SP 800-53 Rev 5 MODERATE	4	measure it →
NIST SP 800-53 Revision 5.1 HIGH	4	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	3	measure it →
HIPAA Security Rule	3	measure it →
NIST Cybersecurity Framework 2.0	3	measure it →
NIST SP 800-66 Rev 2	3	measure it →

Every control

Code	Control	Also in
`171A-03.01.01`	Account Management	0
`171A-03.01.02`	Access Enforcement	0
`171A-03.01.03`	Information Flow Enforcement	0
`171A-03.01.04`	Separation of Duties	0
`171A-03.01.05`	Least Privilege	0
`171A-03.01.06`	Least Privilege - Privileged Accounts	0
`171A-03.01.07`	Least Privilege - Privileged Functions	0
`171A-03.01.08`	Unsuccessful Logon Attempts	0
`171A-03.01.09`	System Use Notification	0
`171A-03.01.10`	Device Lock	0
`171A-03.01.11`	Session Termination	0
`171A-03.01.12`	Remote Access	0
`171A-03.01.16`	Wireless Access	0
`171A-03.01.18`	Access Control for Mobile Devices	0
`171A-03.01.20`	Use of External Systems	0
`171A-03.01.22`	Publicly Accessible Content	0
`171A-03.02.01`	Literacy Training and Awareness	0
`171A-03.02.02`	Role-Based Training	0
`171A-03.03.01`	Event Logging	0
`171A-03.03.02`	Audit Record Content	0
`171A-03.03.03`	Audit Record Generation	0
`171A-03.03.04`	Response to Audit Logging Process Failures	0
`171A-03.03.05`	Audit Record Review, Analysis, and Reporting	0
`171A-03.03.06`	Audit Record Reduction and Report Generation	0
`171A-03.03.07`	Time Stamps	0
`171A-03.03.08`	Protection of Audit Information	0
`171A-03.04.01`	Baseline Configuration	0
`171A-03.04.02`	Configuration Settings	0
`171A-03.04.03`	Configuration Change Control	0
`171A-03.04.04`	Impact Analyses	0
`171A-03.04.05`	Access Restrictions for Change	0
`171A-03.04.06`	Least Functionality	0
`171A-03.04.08`	Authorized Software - Allow by Exception	0
`171A-03.04.10`	System Component Inventory	0
`171A-03.04.11`	Information Location	0
`171A-03.04.12`	System and Component Configuration for High-Risk Areas	0
`171A-03.05.01`	User Identification, Authentication, and Re-Authentication	0
`171A-03.05.02`	Device Identification and Authentication	0
`171A-03.05.03`	Multi-Factor Authentication	0
`171A-03.05.04`	Replay-Resistant Authentication	0
`171A-03.05.05`	Identifier Management	0
`171A-03.05.07`	Password Management	0
`171A-03.05.11`	Authentication Feedback	0
`171A-03.05.12`	Authenticator Management	0
`171A-03.06.01`	Incident Handling	0
`171A-03.06.02`	Incident Monitoring, Reporting, and Response Assistance	0
`171A-03.06.03`	Incident Response Testing	14
`171A-03.06.04`	Incident Response Training	0
`171A-03.06.05`	Incident Response Plan	0
`171A-03.07.04`	Maintenance Tools	0
`171A-03.07.05`	Nonlocal Maintenance	0
`171A-03.07.06`	Maintenance Personnel	0
`171A-03.08.01`	Media Storage	0
`171A-03.08.02`	Media Access	0
`171A-03.08.03`	Media Sanitization	0
`171A-03.08.04`	Media Marking	0
`171A-03.08.05`	Media Transport	0
`171A-03.08.07`	Media Use	0
`171A-03.08.09`	System Backup - Cryptographic Protection	0
`171A-03.09.01`	Personnel Screening	0
`171A-03.09.02`	Personnel Termination and Transfer	0
`171A-03.10.01`	Physical Access Authorizations	0
`171A-03.10.02`	Monitoring Physical Access	0
`171A-03.10.06`	Alternate Work Site	0
`171A-03.10.07`	Physical Access Control	0
`171A-03.10.08`	Access Control for Transmission	0
`171A-03.11.01`	Risk Assessment	0
`171A-03.11.02`	Vulnerability Monitoring and Scanning	0
`171A-03.11.04`	Risk Response	0
`171A-03.12.01`	Security Assessment	18
`171A-03.12.02`	Plan of Action and Milestones	12
`171A-03.12.03`	Continuous Monitoring	16
`171A-03.12.05`	Information Exchange	0
`171A-03.13.01`	Boundary Protection	0
`171A-03.13.04`	Information in Shared System Resources	0
`171A-03.13.06`	Network Communications - Deny by Default - Allow by Exception	0
`171A-03.13.08`	Transmission and Storage Confidentiality	0
`171A-03.13.09`	Network Disconnect	0
`171A-03.13.10`	Cryptographic Key Establishment and Management	0
`171A-03.13.11`	Cryptographic Protection	0
`171A-03.13.12`	Collaborative Computing Devices and Applications	0
`171A-03.13.13`	Mobile Code	0
`171A-03.13.15`	Session Authenticity	0
`171A-03.14.01`	Flaw Remediation	0
`171A-03.14.02`	Malicious Code Protection	0
`171A-03.14.03`	Security Alerts, Advisories, and Directives	0
`171A-03.14.06`	System Monitoring	0
`171A-03.14.08`	Information Management and Retention	0
`171A-03.15.01`	Policy and Procedures	0
`171A-03.15.02`	System Security Plan	0
`171A-03.15.03`	Rules of Behavior	0
`171A-03.16.01`	Systems Security Engineering Principles	0
`171A-03.16.02`	Unsupported System Components	0
`171A-03.16.03`	External System Services	0
`171A-03.17.01`	Supply Chain Risk Management Plan	0
`171A-03.17.02`	Acquisition Strategies, Tools, and Methods	0
`171A-03.17.03`	Supply Chain Requirements and Processes	0

Tell me when NIST SP 800-171A files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Screening criteria and procedure
Screening records for individuals granted access
Evidence screening precedes access authorization
Pre-access screening records
screening criteria and procedure
screening completion records for sampled individuals
Cybersecurity risk management policy approved by leadership
Policy linkage matrix to standards and procedures
Risk based rationale documented for policy positions
Policy distribution and acknowledgement records

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Access granted before screening completes named by 3 frameworks
Exceptions granted with no expiry named by 3 frameworks

What this page is

A control-level reference for NIST SP 800-171A, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition