NIST SP 800-171 defines 110 security requirements, organized into 14 control families, that any organization handling Controlled Unclassified Information (CUI) must implement. Each control carries an official DoD SPRS point weight of 5, 3, or 1, and a perfect self-assessment score is 110 (the scale starts at -203).
This page lists every control with its family, exact SPRS weight, and whether it is also part of CMMC Level 1. The weights come straight from the DoD NIST SP 800-171 Assessment Methodology (32 CFR 170) — the same dataset that powers our free SPRS score calculator and our open-source scoring repository on GitHub.
Why these 110 controls matter
If you hold a US DoD contract with DFARS 252.204-7012, you are already contractually required to implement NIST SP 800-171 and report a current SPRS score (DFARS 252.204-7019). CMMC Level 2 assesses exactly these 110 requirements — the CMMC Phase II timeline may shift, but the underlying DFARS obligations remain in force today. Non-US suppliers to US primes inherit the same flow-down requirements, which is where CMMC for international companies becomes relevant.
The 14 control families at a glance
| Family | Requirements | Max SPRS points at stake |
|---|---|---|
| 3.1 Access Control | 22 | 54 |
| 3.2 Awareness and Training | 3 | 11 |
| 3.3 Audit and Accountability | 9 | 19 |
| 3.4 Configuration Management | 9 | 33 |
| 3.5 Identification and Authentication | 11 | 27 |
| 3.6 Incident Response | 3 | 11 |
| 3.7 Maintenance | 6 | 18 |
| 3.8 Media Protection | 9 | 23 |
| 3.9 Personnel Security | 2 | 8 |
| 3.10 Physical Protection | 6 | 14 |
| 3.11 Risk Assessment | 3 | 9 |
| 3.12 Security Assessment | 4 | 13 |
| 3.13 System and Communications Protection | 16 | 42 |
| 3.14 System and Information Integrity | 7 | 31 |
| Total | 110 | 313 |
Complete NIST 800-171 controls list with SPRS weights
Weights marked with * have special scoring rules explained below the table.
3.1 — Access Control (22 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.1.1 | Limit system access to authorized users | 5 | Yes |
| 3.1.2 | Limit access to permitted transactions and functions | 5 | Yes |
| 3.1.3 | Control the flow of CUI | 1 | — |
| 3.1.4 | Separate duties of individuals | 1 | — |
| 3.1.5 | Employ least privilege | 3 | — |
| 3.1.6 | Use non-privileged accounts for non-security functions | 1 | — |
| 3.1.7 | Prevent non-privileged users executing privileged functions | 1 | — |
| 3.1.8 | Limit unsuccessful logon attempts | 1 | — |
| 3.1.9 | Provide privacy and security notices | 1 | — |
| 3.1.10 | Session lock with pattern-hiding displays | 1 | — |
| 3.1.11 | Terminate user sessions automatically | 1 | — |
| 3.1.12 | Monitor and control remote access sessions | 5 | — |
| 3.1.13 | Cryptography for remote access confidentiality | 5 | — |
| 3.1.14 | Route remote access via managed access points | 1 | — |
| 3.1.15 | Authorize remote privileged commands | 1 | — |
| 3.1.16 | Authorize wireless access before connections | 5 | — |
| 3.1.17 | Protect wireless access (authentication and encryption) | 5 | — |
| 3.1.18 | Control connection of mobile devices | 5 | — |
| 3.1.19 | Encrypt CUI on mobile devices | 3 | — |
| 3.1.20 | Verify and control connections to external systems | 1 | Yes |
| 3.1.21 | Limit use of portable storage on external systems | 1 | — |
| 3.1.22 | Control CUI posted on publicly accessible systems | 1 | Yes |
3.2 — Awareness and Training (3 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.2.1 | Security awareness training | 5 | — |
| 3.2.2 | Role-based security training | 5 | — |
| 3.2.3 | Insider threat awareness training | 1 | — |
3.3 — Audit and Accountability (9 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.3.1 | Create and retain system audit logs | 5 | — |
| 3.3.2 | Trace actions to individual users | 3 | — |
| 3.3.3 | Review and update logged events | 1 | — |
| 3.3.4 | Alert on audit logging process failure | 1 | — |
| 3.3.5 | Correlate audit records for investigation | 5 | — |
| 3.3.6 | Audit record reduction and report generation | 1 | — |
| 3.3.7 | Synchronized system clocks for audit records | 1 | — |
| 3.3.8 | Protect audit information from unauthorized access | 1 | — |
| 3.3.9 | Limit audit management to privileged subset | 1 | — |
3.4 — Configuration Management (9 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.4.1 | Establish and maintain baseline configurations | 5 | — |
| 3.4.2 | Enforce security configuration settings | 5 | — |
| 3.4.3 | Track, review and approve system changes | 1 | — |
| 3.4.4 | Analyze security impact of changes | 1 | — |
| 3.4.5 | Access restrictions for changes | 5 | — |
| 3.4.6 | Employ least functionality | 5 | — |
| 3.4.7 | Restrict nonessential programs, ports and services | 5 | — |
| 3.4.8 | Deny-by-exception software policy | 5 | — |
| 3.4.9 | Control and monitor user-installed software | 1 | — |
3.5 — Identification and Authentication (11 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.5.1 | Identify system users and devices | 5 | Yes |
| 3.5.2 | Authenticate users, processes and devices | 5 | Yes |
| 3.5.3 | Multi-factor authentication (MFA) | 5* | — |
| 3.5.4 | Replay-resistant authentication | 1 | — |
| 3.5.5 | Prevent reuse of identifiers | 1 | — |
| 3.5.6 | Disable identifiers after inactivity | 1 | — |
| 3.5.7 | Enforce password complexity | 1 | — |
| 3.5.8 | Prohibit password reuse | 1 | — |
| 3.5.9 | Temporary passwords with immediate change | 1 | — |
| 3.5.10 | Store and transmit only protected passwords | 5 | — |
| 3.5.11 | Obscure authentication feedback | 1 | — |
3.6 — Incident Response (3 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.6.1 | Operational incident-handling capability | 5 | — |
| 3.6.2 | Track, document and report incidents | 5 | — |
| 3.6.3 | Test incident response capability | 1 | — |
3.7 — Maintenance (6 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.7.1 | Perform system maintenance | 3 | — |
| 3.7.2 | Controls on maintenance tools and personnel | 5 | — |
| 3.7.3 | Sanitize equipment removed for maintenance | 1 | — |
| 3.7.4 | Check diagnostic media for malicious code | 3 | — |
| 3.7.5 | MFA for nonlocal maintenance sessions | 5 | — |
| 3.7.6 | Supervise unescorted maintenance personnel | 1 | — |
3.8 — Media Protection (9 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.8.1 | Protect and store media containing CUI | 3 | — |
| 3.8.2 | Limit media access to authorized users | 3 | — |
| 3.8.3 | Sanitize or destroy media before disposal | 5 | Yes |
| 3.8.4 | Mark media with CUI markings | 1 | — |
| 3.8.5 | Control and account for media during transport | 1 | — |
| 3.8.6 | Cryptography on media during transport | 1 | — |
| 3.8.7 | Control use of removable media | 5 | — |
| 3.8.8 | Prohibit portable storage without identifiable owner | 3 | — |
| 3.8.9 | Protect confidentiality of backup CUI | 1 | — |
3.9 — Personnel Security (2 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.9.1 | Screen individuals prior to CUI access | 3 | — |
| 3.9.2 | Protect CUI during personnel actions | 5 | — |
3.10 — Physical Protection (6 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.10.1 | Limit physical access to authorized individuals | 5 | Yes |
| 3.10.2 | Protect and monitor the physical facility | 5 | — |
| 3.10.3 | Escort and monitor visitors | 1 | Yes |
| 3.10.4 | Keep physical access audit logs | 1 | Yes |
| 3.10.5 | Control physical access devices | 1 | Yes |
| 3.10.6 | Safeguard CUI at alternate work sites | 1 | — |
3.11 — Risk Assessment (3 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.11.1 | Periodically assess risk | 3 | — |
| 3.11.2 | Scan for vulnerabilities periodically | 5 | — |
| 3.11.3 | Remediate vulnerabilities per risk assessments | 1 | — |
3.12 — Security Assessment (4 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.12.1 | Periodically assess security controls | 5 | — |
| 3.12.2 | Develop and implement plans of action (POA&M) | 3 | — |
| 3.12.3 | Monitor controls on an ongoing basis | 5 | — |
| 3.12.4 | System Security Plan (SSP) | NA* | — |
3.13 — System and Communications Protection (16 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.13.1 | Monitor and protect communications at boundaries | 5 | Yes |
| 3.13.2 | Secure architectural and engineering principles | 5 | — |
| 3.13.3 | Separate user and system management functionality | 1 | — |
| 3.13.4 | Prevent unauthorized transfer via shared resources | 1 | — |
| 3.13.5 | Public-access subnetworks separated from internal | 5 | Yes |
| 3.13.6 | Deny-all, permit-by-exception network traffic | 5 | — |
| 3.13.7 | Prevent split tunneling on remote devices | 1 | — |
| 3.13.8 | Cryptography to protect CUI in transit | 3 | — |
| 3.13.9 | Terminate network connections after sessions | 1 | — |
| 3.13.10 | Establish and manage cryptographic keys | 1 | — |
| 3.13.11 | FIPS-validated cryptography for CUI | 5* | — |
| 3.13.12 | Control collaborative computing devices | 1 | — |
| 3.13.13 | Control and monitor mobile code | 1 | — |
| 3.13.14 | Control and monitor VoIP | 1 | — |
| 3.13.15 | Protect authenticity of communications sessions | 5 | — |
| 3.13.16 | Protect confidentiality of CUI at rest | 1 | — |
3.14 — System and Information Integrity (7 requirements)
| ID | Requirement | SPRS weight | CMMC Level 1 |
|---|---|---|---|
| 3.14.1 | Identify, report and correct system flaws | 5 | Yes |
| 3.14.2 | Malicious code protection at designated locations | 5 | Yes |
| 3.14.3 | Monitor security alerts and advisories | 5 | — |
| 3.14.4 | Update malicious code protection mechanisms | 5 | Yes |
| 3.14.5 | Periodic and real-time system scans | 3 | Yes |
| 3.14.6 | Monitor traffic for attacks and indicators | 5 | — |
| 3.14.7 | Identify unauthorized use of systems | 3 | — |
Special scoring rules (the three controls that trip people up)
3.5.3 Multifactor authentication: subtract 5 points if you have no MFA at all, but only 3 points if MFA covers remote and privileged access while general user MFA is still rolling out. 3.13.11 FIPS-validated cryptography: subtract 5 points with no encryption of CUI, 3 points if you encrypt but the modules are not FIPS-validated. 3.12.4 System Security Plan: this control has no point value — without a current SSP you cannot submit a score to SPRS at all.
How SPRS scoring works
Start at 110 and subtract each unimplemented control’s weight. Scores range from -203 to 110. A control counts as implemented only when it is fully in place — partial implementation scores zero, with the two partial-credit exceptions above. Your score, assessment date, scope, and SSP status are then submitted to the Supplier Performance Risk System. Full methodology, worked examples, and per-profile costs are in our CMMC Cost Index and CMMC certification cost guide.
Revision 2 vs Revision 3
DoD assessment methodology and SPRS scoring remain anchored to NIST SP 800-171 Revision 2 for current DFARS/CMMC purposes. Revision 3 (published May 2024) reorganizes and consolidates requirements, but until DFARS clauses formally adopt Rev 3, score against the 110 Rev 2 requirements listed here. We track this on our CMMC program status page.
Frequently asked questions
How many controls are in NIST 800-171?
110 security requirements across 14 families in Revision 2, the version DoD SPRS scoring uses today. The 14 families range from Access Control (22 requirements) to Personnel Security (2).
What is a good SPRS score?
110 is perfect. Many primes now screen subcontractors at 88 or higher, and a negative score is a red flag. The average first self-assessment for an unprepared SMB typically lands between -50 and 40.
Are NIST 800-171 and CMMC Level 2 the same controls?
Yes — CMMC Level 2 assesses the same 110 NIST SP 800-171 requirements. The difference is verification: SPRS is a self-assessment, while CMMC Level 2 can require a certified third-party (C3PAO) assessment. See what a C3PAO does and C3PAO assessment costs.
Which controls are in CMMC Level 1?
17 of the 110 (marked “Yes” in the table) — the FAR 52.204-21 basic safeguarding requirements for Federal Contract Information. Level 1 is an annual self-assessment with no SPRS score.
All 110 controls, official DoD weights, instant score.Plan your CMMC cost & roadmap →
9 questions, realistic budget and timeline.Book a fixed-fee gap analysis →
Real SPRS score, evidence list, 30-50% below US rates.
ITSECOPS provides CMMC and NIST 800-171 readiness services worldwide from offices in Norway and India. This page is informational and not legal advice.
Related: confused about how these controls relate to certification? See NIST 800-171 vs CMMC explained.