Controlled Unclassified Information, or CUI, must be protected at the moderate confidentiality level defined by NIST SP 800-171.
That standard is built on the moderate control baseline from NIST SP 800-53, and it applies to every nonfederal system, network, and organization that stores, processes, or transmits CUI.
It sits well above consumer grade security but below the requirements for classified systems.
What is CUI and Why the Configuration Level Matters
CUI is information the federal government creates or owns, or that a contractor creates or possesses on the government’s behalf, that requires safeguarding under law, regulation, or government wide policy even though it is not classified.
Examples include export controlled technical data, unclassified controlled technical information, procurement sensitive material, and certain personally identifiable information tied to federal programs.
The configuration level matters because it sets the actual security bar. Too little protection leaves sensitive government data exposed to theft or manipulation.
Too much protection, such as applying classified system controls to ordinary CUI, wastes budget and slows down legitimate work. NIST built SP 800-171 specifically to land on the correct middle point for this category of information.
What Level of System and Network Configuration CUI Actually Requires
The answer is moderate confidentiality, not basic and not enhanced. NIST SP 800-171 states plainly that its requirements protect the confidentiality of CUI when it resides in nonfederal systems, and the document is based on the Federal Information Security Management Act moderate level requirements.
This distinction trips up a lot of readers because a related document, NIST SP 800-172, adds a set of enhanced requirements.
Those enhanced controls only apply to a narrow category called CUI that is a high value target for advanced persistent threats, and they map to CMMC Level 3 rather than the standard Level 2 that covers most contractors.
If your contract or organization simply handles ordinary CUI, moderate confidentiality under SP 800-171 is the level you need to hit, not the enhanced tier.
| Protection Level | Governing Document | Applies To | Typical CMMC Tier |
|---|---|---|---|
| Basic (low impact) | FAR 52.204-21 | Federal Contract Information only, not CUI | Level 1 |
| Moderate confidentiality | NIST SP 800-171 | Standard CUI in nonfederal systems | Level 2 |
| Enhanced | NIST SP 800-172 | CUI that is a high value target | Level 3 |
The 14 Families of NIST SP 800-171 Requirements
NIST SP 800-171 Revision 2, the version the Department of Defense currently requires, organizes its 110 requirements into 14 families derived from FIPS 200 and the moderate baseline of NIST SP 800-53.
Each family covers one domain of system or network behavior.
| Family | Focus Area | Approximate Requirement Count |
|---|---|---|
| Access Control | Who can reach a system and what they can do once inside | 22 |
| Awareness and Training | Teaching staff to recognize and respond to threats | 3 |
| Audit and Accountability | Logging activity and tracing it back to a user | 9 |
| Configuration Management | Locking down baseline system settings | 9 |
| Identification and Authentication | Verifying user and device identity | 11 |
| Incident Response | Detecting, reporting, and recovering from events | 3 |
| Maintenance | Controlling how systems are serviced and patched | 6 |
| Media Protection | Protecting removable media and storage devices | 9 |
| Personnel Security | Screening staff before granting CUI access | 2 |
| Physical Protection | Controlling physical access to facilities and hardware | 6 |
| Risk Assessment | Finding and ranking vulnerabilities | 3 |
| Security Assessment | Testing whether controls actually work | 4 |
| System and Communications Protection | Network boundaries, encryption, and traffic control | 16 |
| System and Information Integrity | Malware defense and flaw remediation | 7 |
Revision 3, finalized in 2024, restructured this list into 97 requirements across 17 families and added Planning, System and Services Acquisition, and Supply Chain Risk Management as new families.
Most agencies outside the Department of Defense are moving toward Revision 3, but Defense Department contractors should keep working from Revision 2 until told otherwise, since CMMC scoring is still tied to it.
Check More: How to Spot a Suspicious Link Before You Click
Network Configuration Requirements for CUI
Network configuration for CUI opens with one goal: keep sensitive traffic separated from everything else on the network.
That separation, combined with encryption and constant monitoring at the edges of the network, forms the core of the System and Communications Protection family.
- Boundary Protection. Systems must monitor and control communications at the external boundary and at key points inside the network, typically through firewalls and managed gateways.
- Network Segmentation. Publicly accessible components, such as a web server, must sit on separate subnetworks from internal systems that hold CUI. This limits how far an attacker can move after breaching a public facing system.
- Encryption in transit and at rest. CUI must be encrypted using FIPS validated or FIPS approved cryptography whenever it travels across a network or sits in storage.
- A defined CUI enclave. Many contractors scope their compliance effort to a dedicated, smaller network segment built specifically to handle CUI rather than trying to harden an entire corporate network. Industry cost estimates put this approach at roughly 40 to 60 percent cheaper than an organization wide overhaul.
- Denial of service protection and mobile code controls. Systems need defenses against traffic floods and restrictions on what mobile code, such as browser scripts, is allowed to run.
System Configuration Requirements for CUI
System level configuration follows a similar logic: reduce what a machine can do to only what is operationally necessary, then prove that setting stays in place over time.
- Least functionality. Disable or remove any service, port, protocol, or software feature that is not required for the job the system performs (Configuration Management family).
- Documented baseline configuration. Every system needs a recorded baseline covering installed software, hardware, and security settings, with any change routed through formal change management.
- Multifactor authentication. Users need more than a password to reach systems holding CUI, particularly for privileged accounts and remote access.
- Audit logging. Systems must generate logs detailed enough to reconstruct what happened during a security event and hold personnel accountable for their actions.
- Patch and vulnerability management. Known flaws must be identified and corrected on a defined schedule rather than an ad hoc one.
- Antivirus and endpoint protection. Malware defenses need to run continuously and update automatically.
CMMC Level 2 and How it Verifies Your Configuration
CMMC Level 2 is the Department of Defense program that checks whether a contractor’s system and network configuration actually meets the moderate confidentiality level required for CUI.
It maps directly to the 110 requirements in NIST SP 800-171 Revision 2, and it flows down from the prime contractor to every subcontractor that touches the same CUI.
| CMMC Level | Information Type | Requirement Source | Assessment Method |
|---|---|---|---|
| Level 1 | Federal Contract Information | 15 to 17 practices, FAR 52.204-21 | Annual self assessment |
| Level 2 | CUI | 110 requirements, NIST SP 800-171 Rev 2 | Self assessment or third party, contract dependent |
| Level 3 | High value CUI | Level 2 plus a subset of NIST SP 800-172 | Government led assessment |
Scoring under the DoD Assessment Methodology runs to a maximum of 110 points, and contractors need at least 88 points, or 80 percent, along with every high weight requirement met, to receive conditional certification backed by a Plan of Action and Milestones. Gaps documented in that plan generally must close within 180 days.
As of September 2026, the mandatory third party assessment stage of CMMC, known as Phase 2, is suspended. The Department of War paused the November 10, 2026 deadline on July 13, 2026 and opened a 60 day review of the program.
Phase 1 self assessment obligations and the underlying DFARS 252.204-7012 duty to implement NIST SP 800-171 remain fully active during the pause, so contractors handling CUI still need to build and document a compliant configuration even though formal third party certification timelines are in flux.
Anyone with an active or upcoming contract should confirm current requirements directly against their solicitation language, since a paused rollout schedule can still change.
Conclusion
CUI requires moderate confidentiality configuration under NIST SP 800-171, not the enhanced tier reserved for high value targets under NIST SP 800-172.
CMMC Level 2 covers 110 security requirements across 14 families, including access control, network segmentation, encryption, logging, and other key areas required for defense contracts.
Build toward a defined CUI enclave, document every control in a System Security Plan, and track gaps in a Plan of Action and Milestones.
Third party certification timelines may keep shifting, but the underlying configuration standard has stayed the same since NIST first published it.
Comments are closed, but trackbacks and pingbacks are open.