What is NIST SP 800-171?

NIST SP 800-171 defines what you must do to protect Controlled Unclassified Information (CUI) in non-federal systems. It contains 110 security requirements organized into 14 control families (Access Control, Incident Response, System Integrity, etc.). NIST 800-171 is the baseline. It tells you what to implement.

CMMC (Cybersecurity Maturity Model Certification) is the DoD's verification and enforcement program built on top of NIST 800-171. CMMC Level 2 maps directly to the 110 controls in NIST 800-171 Rev 2. CMMC adds assessment requirements, maturity levels, and third-party audit obligations. It tells you whether you can prove you implemented it.

GRC Fundamentals

CMMC vs NIST 800-171 vs SCF - What Is The Relationship?

Q: What is the Secure Controls Framework (SCF)?

The Secure Controls Framework (SCF) is not a government requirement. It is a Common Controls Framework (CCF) (often called the 'Rosetta Stone for security frameworks') that maps across NIST 800-171, NIST 800-53, CMMC, ISO 27001, SOC 2, HIPAA, FedRAMP, and 200+ other laws, regulations, and frameworks. Instead of building separate control sets for each framework, SCF lets organizations implement controls once and demonstrate coverage across many obligations simultaneously.

CMMC is the enforcement program built on NIST 800-171. The SCF is the optional mapping framework that unifies both (along with 200+ other possible laws, regulations and frameworks) into a single internal control set that eliminates duplicated compliance efforts.

Download the SCF

Learn More About GRC

ONE SECURITY FRAMEWORK TO RULE THEM ALL

Three Layers, One Ecosystem

CMMC, NIST SP 800-171 and the Secure Controls Framework (SCF) are often mentioned together and confused with each other. They are not competing frameworks - they occupy three distinct layers of the same defense-sector compliance ecosystem.

Layer 1 - NIST SP 800-171: The Requirements

NIST SP 800-171 defines what you must do to protect Controlled Unclassified Information (CUI) as a US Government contractor or subcontractor. NIST 800-171 is the baseline, where it tells you the absolute minimum requirements to implement.

Layer 2 - CMMC: The Enforcement Program

Cybersecurity MaturityModel Certification (CMMC) is the US Department of Defense (DoD) / Department of War (DoW) verification and enforcement program built ontop of NIST 800-171. CMMC Level 2 maps directly to the requirements in NIST 800-171 but adds assessment requirements, and reporting obligations (e.g., SPRS). CMMC validates the implementation of NIST 800-171 requirements.

Layer 3 - SCF: The Mapping Layer

The Secure Controls Framework (SCF) is not a US Government requirement. It is a Common Controls Framework (CCF), often called the "Rosetta Stone for security frameworks," that maps across NIST 800-171, NIST 800-53, CMMC, ISO 27001, SOC 2, HIPAA, FedRAMP, and 200+other laws, regulations, and frameworks. Instead of building separate controlsets for each framework, SCF lets organizations implement controls once and demonstrate coverage across many obligations simultaneously.

SCF Operationalizes CMMC & NIST 800-171

How CMMC, NIST 800-171 & SCF Relate - Practical Use Cases

The SCF scales like no other security framework, where it can rapidly scale to meet the most complex cybersecurity and data protection challenges:

✓

DoD contractor pursuing CMMC Level 2: Your obligations come from CMMC and are implemented via NIST 800-171 controls, where the SCF helps you manage them alongside other laws, regulations and other compliance obligations that must be addressed.

✓

Organization subject to multiple frameworks (e.g., CMMC + HIPAA + SOC 2): The SCF maps all three into a single control set, so youimplement once and satisfy all three.

✓

Organization looking for a free cybersecurity framework: The SCF is fully free to download and includes NIST 800-171, CMMC, and 200+ other crosswalk mappings out of the box.