Why was NIST 800 171 Framework Chosen?

The NIST 800-171 framework is a set of guidelines developed by the National Institute of Standards and Technology (NIST) to ensure contractors and suppliers of the Department of Defense (DoD) have the appropriate security measures in place to protect Controlled Unclassified Information (CUI). In addition, the framework is designed to help organizations comply with the DFARS clause 252.204-7012, which requires all DoD contractors and suppliers to implement these security measures.

In response to the increasing cybersecurity threats to the US supply chain, the DoD has introduced the Cybersecurity Maturity Model Certification (CMMC). This certification ensures that all DoD suppliers meet a minimum level of cybersecurity standards appropriate to the sensitivity of CUI within their control.

The CMMC builds upon the NIST 800-171 framework and adds additional requirements to ensure that the DoD suppliers have appropriate cybersecurity hygiene. The CMMC framework consists of three cybersecurity maturity levels, each building upon the previous one. The levels range from basic cybersecurity hygiene (Level 1) to advanced cybersecurity hygiene (Level 3).

However, the CMMC 2.0 Level 3 is currently under development and will have additional practices from NIST 800-172 framework, Enhanced Security Requirements for Protecting Controlled Unclassified Information – A Supplement to NIST Special Publication 800-171.

Overall, cybersecurity specialists will find that NIST 800-171 framework provides a strong foundation for securing CUI data and preparing for CMMC certification. However, organizations should take a risk-based approach to implement the recommendations presented in the framework and work towards achieving a higher CMMC maturity level.