NIST SP 800-171 · Free readiness checklist

NIST SP 800-171 Readiness Checklist

Check how well you protect Controlled Unclassified Information (CUI) under National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, know which revision your contracts require, and get your Supplier Performance Risk System (SPRS) score ready.

17 checks in 4 sections. About 20 min. It opens on this page as soon as you send the form. Last reviewed October 23, 2026.

Get the free checklist

Required

Optional email updates

Your checklist opens on this page right away. See our Privacy Policy for how we use your details.

Which revision? NIST published Revision 3 in May 2024, but a Department of Defense (DoD, now styled Department of War) class deviation requires DoD contractors to keep complying with Revision 2 (110 requirements) until it is rescinded. Since CMMC (Cybersecurity Maturity Model Certification) Phase II was suspended in July 2026, the department continues to enforce Revision 2 through self-assessments and select government-led assessments.

What this checklist covers

  1. Know your CUI and your scope 3 checks
  2. Core requirements (Revision 2 families) 9 checks
  3. Documentation and score 4 checks
  4. Get ahead of Revision 3 1 checks

Questions

Who is this checklist for?

Defense and federal contractors and subcontractors that store, process or transmit CUI.

Will this checklist make us compliant or certified?

No. It is a readiness aid that helps you find gaps before you start work with an auditor or assessor. It is general guidance, not legal advice, and it does not know your specific systems.

What happens after I send the form?

The full checklist opens on this page straight away. Your ticks are saved in this browser only, and you can print the checklist or save it as a PDF.

Will you email me?

Only if you tick one of the boxes. We then send one email asking you to confirm your address, and the updates start only after you confirm. You can unsubscribe at any time. Our Privacy Policy explains how we use your details.

This checklist is a general readiness aid, not legal advice. It does not know your specific systems or environment, and completing it does not make an organization compliant or certified. Check obligations that apply to you with qualified counsel.