NIST SP 800-171 rev2 Compliance

NIST SP 800-171 rev2, developed by the National Institute of Standards and Technology (NIST), is a comprehensive set of guidelines and requirements designed to enhance the security of Controlled Unclassified Information (CUI) within non-federal systems and organizations. Adhering to these guidelines is crucial for organizations that handle sensitive data on behalf of the government or have contractual obligations with federal agencies.

NIST SP 800-171 rev2 outlines a framework of security controls that organizations must implement to protect CUI from unauthorized access, disclosure, or modification. These controls encompass various areas of information security, including access control, incident response, risk assessment, and system monitoring.

To comply with NIST SP 800-171 rev2, organizations need to assess their current security posture, identify any gaps in compliance, and implement appropriate security controls. This involves implementing measures such as multifactor authentication, encryption of sensitive data, continuous monitoring of systems, and conducting regular security assessments.

By aligning with the requirements of NIST SP 800-171 rev2, organizations can enhance their overall security posture, mitigate risks associated with unauthorized access or disclosure of CUI, and demonstrate their commitment to safeguarding sensitive information. Soliton Systems recognizes the importance of NIST SP 800-171 rev2 compliance and offers solutions that assist organizations in meeting these requirements, providing a secure and reliable environment for handling and protecting sensitive data in accordance with federal regulations.

Soliton's solutions fully comply with the security requirements outlined in NIST SP 800-171, ensuring the protection of Controlled Unclassified Information (CUI). By implementing robust security measures, our solutions safeguards the confidentiality, integrity, and availability of CUI in accordance with industry standards.

Our solutions comply with the following security requirements:
  • Access Control: Our solutions enforce strict access control mechanisms, allowing authorized users to access systems and data based on their roles and permissions.
  • Audit and Accountability: We maintain comprehensive audit logs to track and monitor user activities, ensuring accountability and facilitating incident investigations.
  • Configuration Management: We implement robust configuration management processes to establish and maintain secure system configurations, minimizing vulnerabilities and ensuring system integrity.
  • Identification and Authentication: Our solutions employ strong identification and authentication measures to verify the identities of users and devices, ensuring secure access to systems and data.
  • Maintenance: We regularly update and maintain our solutions to address security vulnerabilities, ensuring a secure environment for our users.
  • Media Protection: We implement measures to protect and control access to sensitive data stored on physical media, ensuring its confidentiality and integrity.
  • System and Communications Protection: Our solutions incorporate advanced security measures to safeguard the confidentiality and integrity of data during transmission and storage.

By adhering to these security requirements, our solutions provide a secure environment, mitigating risks and ensuring the protection of sensitive information.

While Soliton may not cover specific areas such as awareness and training, incident response, physical protection, risk assessment, and security assessment, its comprehensive security measures effectively address the remaining requirements, fostering a secure ecosystem for CUI.


NIST SP 800-171 includes access control requirements that form the basis for securing sensitive information. These requirements focus on establishing controls to ensure that only authorized individuals have access to systems, data, and resources.

By implementing these access control measures, organizations can prevent unauthorized access, protect sensitive information, and maintain the confidentiality, integrity, and availability of their systems and data.

  • Identifier 3.1.1.
    Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). 
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.2.
    Limit system access to the types of transactions and functions that authorized users are permitted to execute. 
    Applies to: MailZen, G/On and NetAttest EPS

 

  • Identifier 3.1.3
    Control the flow of CUI in accordance with approved authorizations.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.4
    Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.5
    Employ the principle of least privilege, including for specific security functions and privileged accounts.
    Applies to: MailZen, G/On and NetAttest EPS 

  • Identifier 3.1.6
    Use non-privileged accounts or roles when accessing non-security functions
    Applies: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.7
    Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.8
    Limit unsuccessful logon attempts.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.9
    Provide privacy and security notices consistent with applicable CUI rules.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.10 
    Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.11
    Terminate (automatically) a user session after a defined condition.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.12
    Monitor and control remote access sessions.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.13
    Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.14
    Route remote access via managed access control points.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.15
    Authorize remote execution of privileged commands and remote access to security-relevant information.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.16
    Authorize wireless access prior to allowing such connections.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.17
    Protect wireless access using authentication and encryption
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.18
    Control connection of mobile devices.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.19
    Encrypt CUI on mobile devices and mobile computing platforms.
    Applies to: MailZen and G/On 

  • Identifier 3.1.20
    Verify and control/limit connections to and use of external systems.
    Applies to: MailZen and G/On

  • Identifier 3.1.21
    Limit use of portable storage devices on external systems.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.1.22
    Control CUI posted or processed on publicly accessible systems.
    Applies to: MailZen, G/On and NetAttest EPS

NIST SP 800-171 includes guidelines for audit and accountability. These requirements ensure that organizations establish robust processes for generating, protecting, and retaining audit logs and relevant information. By effectively monitoring and assessing security events, organizations can respond promptly to potential breaches and unauthorized activities. Adhering to these requirements enhances overall security, improves incident response, and demonstrates compliance with regulations and standards.

  • Identifier 3.3.1 
    Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.2
    Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
    Applies to: MailZen, G/On and NetAttest EPS
  • Identifier 3.3.3
    Review and update logged events.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.4
    Alert in the event of an audit logging process failure.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.5
    Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
    Applies to: MailZen

  • Identifier 3.3.6
    Provide audit record reduction and report generation to support on-demand analysis and reporting.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.7
    Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.8
    Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.3.9
    Limit management of audit logging functionality to a subset of privileged users.
    Applies to: MailZen, G/On and NetAttest EPS

NIST SP 800-171 emphasizes the significance of configuration management in maintaining a secure environment. This entails establishing and maintaining baseline configurations for systems and devices, implementing rigorous change control processes, and regularly assessing and monitoring configuration settings. By adhering to these guidelines, organizations can effectively manage their IT assets, minimize vulnerabilities, and ensure the integrity and security of their systems.

  • Identifier 3.4.1
    Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
    Applies to: MailZen and G/On
  • Identifier 3.4.6
    Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.4.7
    Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.4.8
    Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
    Applies to MailZen and G/On

  • Identifier 3.4.9
    Control and monitor user-installed software.
    Applies to: MailZen

NIST SP 800-171 emphasizes the importance of robust identification and authentication mechanisms to protect sensitive information. It requires organizations to implement strong user identification processes, including the use of unique user accounts and multifactor authentication. These measures help ensure that only authorized individuals can access systems and sensitive data, reducing the risk of unauthorized access and data breaches. 

  • Identifier 3.5.1
    Identify system users, processes acting on behalf of users, and devices.
    Applies to: G/On and NetAttest EPS

  • Identifier 3.5.3
    Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
    Applies to: MailZen, G/On and NetAttest EPS
  • Identifier 3.5.3
    Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.[24] [25].  
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.5.4
    Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.5.5
    Prevent reuse of identifiers for a defined period.
    Applies to NetAttest EPS

  • Identifier 3.5.6
    Disable identifiers after a defined period of inactivity.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.5.7
    Enforce a minimum password complexity and change of characters when new passwords are created.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.5.9
    Allow temporary password use for system logons with an immediate change to a permanent password.
    Applies to: MailZen, G/On and NetAttest EPS
  • Identifier 3.5.10
    Store and transmit only cryptographically-protected passwords.
    Applies to: MailZen, G/On and NetAttest EPS

In compliance with NIST SP 800-171, organizations must establish effective maintenance processes to ensure the ongoing integrity and security of their systems. This involves regular monitoring, updates, and patching of software and hardware components to address vulnerabilities and maintain optimal performance.

  • Identifier 3.7.1 
    Perform maintenance on organizational systems.[26]. 
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.7.2.
    Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.7.3
    Ensure equipment removed for off-site maintenance is sanitized of any CUI.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.7.4
    Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.7.5
    Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
    Applies to: MailZen, G/On and NetAttest EPS

NIST SP 800-171 recognizes the significance of personnel security in safeguarding sensitive information. It emphasizes the importance of implementing measures to ensure that individuals with access to such information are trustworthy and properly trained.

Personnel security measures include conducting background checks, establishing clear roles and responsibilities, and providing training on security awareness. By promoting a culture of security and accountability among employees, organizations can mitigate the risks associated with insider threats and unauthorized access to sensitive data.

Through the implementation of comprehensive personnel security protocols, organizations can enhance the overall security posture and protect against potential vulnerabilities stemming from human factors.


  • Identifier 3.9.2
    Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
    Applies to: MailZen, G/On and NetAttest EPS

NIST SP 800-171 emphasizes the criticality of protecting systems and communications to ensure the security and integrity of sensitive information. It highlights the need for robust measures to safeguard against unauthorized access, tampering, and disruption of systems and communications networks.

Protecting systems involves implementing strong security controls such as firewalls, intrusion detection systems, and secure configurations to defend against potential threats. It also requires regularly monitoring systems for vulnerabilities and promptly addressing any identified weaknesses to maintain a secure environment.

Securing communications entails encrypting data transmissions to prevent unauthorized interception or modification. It involves implementing secure protocols, virtual private networks (VPNs), and other encryption mechanisms to protect the confidentiality and integrity of data in transit. 

  • Identifier 3.13.2
    Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
    Applies to MailZen, G/On and NetAttest EPS
  • Identifier 3.13.3
    Separate user functionality from system management functionality.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.4
    Prevent unauthorized and unintended information transfer via shared system resources.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.5
    Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.6
    Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).Identifier 3.13.7
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.7
    Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
    Applies to: MailZen and G/On

  • Identifier 3.13.8
    Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.9
    Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.10
    Establish and manage cryptographic keys for cryptography employed in organizational systems.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.11
    Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.15
    Protect the authenticity of communications sessions.
    Applies to: MailZen, G/On and NetAttest EPS

  • Identifier 3.13.16
    Protect the confidentiality of CUI at rest.
    Applies to: MailZen, G/On and NetAttest EPS

NIST SP 800-171 highlights the criticality of ensuring the integrity of systems and information to maintain a secure environment for sensitive data. It emphasizes the need for robust measures to detect and prevent unauthorized access, tampering, and disruption.

Protecting system integrity involves implementing security controls such as access controls, secure configurations, and monitoring mechanisms to detect and respond to potential threats. By regularly monitoring system activity, organizations can identify and address any anomalies or suspicious behavior, safeguarding against unauthorized modifications or compromises.

Ensuring information integrity entails implementing measures to verify the accuracy and completeness of data throughout its lifecycle. This includes utilizing cryptographic mechanisms, data validation techniques, and secure backups to prevent data corruption, unauthorized modifications, or loss.

By prioritizing system and information integrity, organizations can maintain the trustworthiness and reliability of their systems and protect against potential risks and vulnerabilities.

  • Identifier 3.14.7
    Identify unauthorized use of organizational systems.
    Applies to: G/On and NetAttest EPS