NIST SP 800-171
NIST SP 800-171 is the federal standard that sets the security requirements for protecting Controlled Unclassified Information on contractor systems.
Revision 2, the version DoD contracts reference as of October 2026, lists 110 security requirements in 14 families, including access control, audit and accountability, configuration management, identification and authentication, incident response, media protection, physical protection, and system and communications protection. A newer Revision 3 was published in 2024, but DoD has continued to point contractors to Revision 2.
Implementing 800-171 means documenting your environment in a system security plan (SSP), tracking gaps in a plan of action, and scoring yourself against the requirements for SPRS. Most of the work is not about any single application: it's accounts, MFA, patching, logging, backups, physical access, and policies across every system that touches CUI.
Shop Server Defense is designed to support 800-171 for the shop system: a hardened configuration designed around FIPS-validated encryption, MFA, and audit logging, an encrypted backup drive with customer-held keys, and a control mapping with an SSP template excerpt that states what the box covers and what stays your responsibility. These are planned features of a pre-launch product.
Related
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: Is My Shop Data CUI or ITAR-Controlled? (2-Minute Check) →