← All checklists
NIST SP 800-171 Rev. 3 readiness checklist
The NIST SP 800-171 Rev. 3 requirements that matter most for protecting CUI, across all 17 families, mapped to their requirement number, with the evidence an assessor will ask for. Preview 16 of the 95 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers NIST SP 800-171 Rev. 3Reviewed 30 Oct 202695 items · 10 sections
Access control
14 items
- 03.01.01Define the account types allowed on the system, approve and create accounts through a process, and disable accounts that expire, sit unused or belong to people who no longer need them.Evidence: Account management procedure and a user list reconciled against HR records.
- 03.01.02Enforce approved authorizations for logical access to CUI and system resources.Evidence: Role and group definitions with screenshots of access settings.
Awareness, training and audit logging
10 items
- 03.02.01Give all system users security literacy training at onboarding and on a set schedule, including how to spot and report insider threats and social engineering.Evidence: Training content and completion records for all users.
- 03.02.02Give role-based security training to people with security duties before they get access and on a set schedule after that.Evidence: Role-based training plan and completion records for admins and security staff.
Configuration management
10 items
- 03.04.01Build and maintain a baseline configuration for the system and review and update it on a set schedule and when components change.Evidence: Approved baseline documents with version history.
- 03.04.02Set and enforce the most restrictive security configuration settings that still allow the system to operate.Evidence: Hardening standards mapped to CIS or STIG and compliance scan results.
Identification and authentication
8 items
- 03.05.01Uniquely identify and authenticate every user and every process acting for a user, and require reauthentication when defined conditions occur.Evidence: Identity provider configuration showing no shared accounts.
Incident response and maintenance
8 items
- 03.06.01Run an incident handling capability that covers preparation, detection, analysis, containment, eradication and recovery.Evidence: Incident handling procedure and tickets from recent incidents.
Media, personnel and physical protection
14 items
- 03.08.01Physically control and securely store digital and paper media that contain CUI.Evidence: Media storage procedure and photos or records of locked storage.
- 03.08.02Restrict access to CUI on system media to authorized people.Evidence: Access lists for media storage and removable media controls.
Risk, assessment and planning
10 items
- 03.11.01Assess the risk of unauthorized disclosure of CUI, including supply chain risk, and update the assessment on a set schedule.Evidence: Dated risk assessment with risk register.
- 03.11.02Scan for vulnerabilities on a set schedule and when new ones are reported, and fix them within defined timeframes.Evidence: Scan results and remediation tickets with closure dates.
System and communications protection
10 items
- 03.13.01Monitor and control communications at external and key internal boundaries and connect to outside networks only through managed interfaces.Evidence: Network diagram and boundary firewall configuration.
- 03.13.04Prevent CUI from leaking through shared system resources such as memory or storage reused between users.Evidence: Platform configuration or vendor attestation on resource isolation.
System and information integrity
5 items
- 03.14.01Identify, report and fix system flaws, installing security updates within defined timeframes.Evidence: Patch policy with SLAs and patch compliance report.
Acquisition and supply chain
6 items
- 03.16.01Apply security engineering principles when designing, building and changing the system.Evidence: Secure design standard and architecture review records.
Changelog
- v1.030 Oct 2026First release. Covers NIST SP 800-171 Rev. 3 (May 2024), with selected requirements from all 17 families.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.