Written and maintained by CASRAI Editorial Board
Last updated
NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, is the NIST publication that tells an assessor how to judge whether each security requirement in NIST SP 800-171 is met. It does not add requirements. It supplies the assessment procedures for the ones that already exist. One fact matters before any other: the June 2018 edition was withdrawn on May 14, 2024 and superseded by SP 800-171A Rev. 3, as described on the NIST CSRC pages on 2026-10-29.
What NIST SP 800-171A is and who runs it
NIST SP 800-171A is a National Institute of Standards and Technology Special Publication written by Ron Ross, Kelley Dempsey and Victoria Pillitteri and finalized on 06/13/2018 (DOI 10.6028/NIST.SP.800-171A). Its abstract describes it as assessment procedures and a methodology for assessing the CUI security requirements in SP 800-171. NIST describes the procedures as adaptable, so they can be used for self-assessments, third-party assessments or government-sponsored assessments, with varying levels of rigor.
Which edition applies: the 2018 edition or Rev. 3
The NIST CSRC page for the 2018 publication lists its status as withdrawn on May 14, 2024, with the note “Superseded by SP 800-171A Rev. 3.” Rev. 3, by Ron Ross and Victoria Pillitteri, was published in May 2024 (DOI 10.6028/NIST.SP.800-171Ar3) and has the status Final.
The NIST edition and the edition a contract or rule points to are separate questions. CASRAI’s guide to CMMC Level 2 assessment records that the CMMC program rule incorporates the June 2018 edition (32 CFR 170.16). If you work under that rule, read that guide for the edition your assessment is tied to, and read the NIST page for the status of each document.
Who uses it: eligibility and scope
There is no application or eligibility test for SP 800-171A, because it is a public NIST publication rather than a funded program. It is used by whoever needs to assess an organization’s implementation of the SP 800-171 requirements. For universities and research institutions that handle CUI under federal awards, that usually means the research security and compliance office; see NIST 800-171 and CUI in university research.
How an assessment procedure works
The publication states that an assessment procedure consists of an assessment objective and a set of potential assessment methods and assessment objects. Each objective includes a determination statement, and that statement is tied back to the security requirement it comes from, which gives traceability from requirement to evidence.
The publication’s own worked example (its Figure 1) uses requirement 3.1.3, “Control the flow of CUI in accordance with approved authorizations.” The procedure for that requirement is laid out as lists of what to examine, whom to interview and what to test, written as “[SELECT FROM: …]” choices that the assessor picks from.
Examine, interview and test
The publication defines three assessment methods:
- Examine: reviewing, inspecting, observing, studying or analyzing assessment objects.
- Interview: discussions with individuals or groups.
- Test: exercising assessment objects under specified conditions to compare actual with expected behavior.
The assessment objects the methods act on are specifications, mechanisms, activities and individuals. Depth and coverage attributes define the level of effort, that is, the rigor and scope of the assessment.
Findings: satisfied and other than satisfied
Each determination statement yields one of two findings, “satisfied” or “other than satisfied.” The publication notes that “other than satisfied” can also mean the assessor was unable to obtain enough information, and that organizations may define severity subcategories of their own.
Compliance steps
Read as a workflow, the publication supports this sequence for an institution:
- Confirm which edition of SP 800-171A your contract, rule or assessor uses, and note its status on the NIST CSRC page.
- For each SP 800-171 requirement in scope, take the matching assessment procedure and its determination statements.
- Choose the methods (examine, interview, test) and the assessment objects (specifications, mechanisms, activities, individuals) the procedure lists, and set depth and coverage for the level of rigor required.
- Record a finding per determination statement, satisfied or other than satisfied, with the evidence gathered.
- Use the results where your process needs them. For federal self-assessment scoring, see the SPRS score and NIST 800-171 self-assessment guide; for defining the assessment boundary first, see the CMMC scoping guide.
Typical phases
The publication sets no calendar. Following its structure, the work falls into these phases: choose the procedures for the requirements in scope; select methods and objects and set depth and coverage; gather evidence by examining, interviewing and testing; record determinations; and report results. How long each phase takes depends on the scope and rigor chosen.
Common mistakes
- Citing the 2018 edition as current. NIST lists it as withdrawn on May 14, 2024, and Rev. 3 as final. State the edition and its status.
- Reading “other than satisfied” only as a failed control. The publication says it can also mean the assessor could not get enough information, so a gap in evidence can produce it.
- Relying on a spreadsheet copy. NIST’s planning note of 04/13/2022 says the PDF of SP 800-171A is the authoritative source of the assessment procedures.
Related programs and documents
| Document | Status or role | Source |
|---|---|---|
| SP 800-171A (June 2018) | Withdrawn May 14, 2024; superseded by Rev. 3 | NIST CSRC, checked 2026-10-29 |
| SP 800-171A Rev. 3 (May 2024) | Final; supersedes the 2018 edition | NIST CSRC, checked 2026-10-29 |
| NIST SP 800-171 | The CUI security requirements that 800-171A assesses; see the dictionary entry | CASRAI |
| CMMC Level 2 assessment | CASRAI records that the rule incorporates the June 2018 edition; see the guide | CASRAI |
FAQ
Is NIST SP 800-171A still current?
The June 2018 edition is not. NIST withdrew it on May 14, 2024 and lists SP 800-171A Rev. 3, published May 2024, as the superseding final publication.
What does 800-171A actually assess?
It provides assessment procedures for the CUI security requirements in SP 800-171, built from objectives, determination statements, methods and objects.
Can an organization assess itself with it?
Yes. NIST describes the procedures as usable for self-conducted, third-party or government-sponsored assessments.
Sources
- NIST CSRC, SP 800-171A (2018 edition, withdrawn): csrc.nist.gov/pubs/sp/800/171/a/final, date checked 2026-10-29.
- NIST CSRC, SP 800-171A Rev. 3: csrc.nist.gov/pubs/sp/800/171/a/r3/final, date checked 2026-10-29.
- NIST SP 800-171A (2018) PDF: nvlpubs.nist.gov, date checked 2026-10-29.
