Most SP 800-171 programmes stall on the same question for each requirement: what exactly do we show the assessor? This workbook lists all 97 active security requirements in NIST SP 800-171 Rev. 3 (final, May 2024), family by family, with the official requirement ID and title, whether the requirement carries an organisation-defined parameter (ODP), and concrete evidence examples you can collect. It is built from the NIST OSCAL catalogue for Rev. 3, which marks the remaining identifiers as withdrawn. Use it as a working tracker for a self-assessment, a gap analysis or an evidence library. For how Rev. 2, Rev. 3, DFARS and CMMC fit together, read the NIST SP 800-171 and CMMC 2.0 Guide; for determination statements and assessment methods, read the NIST SP 800-171A Rev 3 Assessment Guide. This page does not repeat either.
How to use this template
Copy the tables into your tracker: add three columns of your own, Owner, Status (Met, Not met, Planned on a POA&M) and Evidence location, and fill them per requirement.
Set ODP values first: 50 rows are marked ODP Yes. Write the value you have chosen (or the value your agency or contract specifies) beside each before collecting evidence, because the evidence has to prove that value.
Evidence examples are starting points: each row lists typical artefacts. An assessor checks the determination statements in SP 800-171A Rev. 3, so test each example against those statements and add interview and test evidence, not documents alone.
Cover non-human identities: account management (03.01.01), identifier management (03.05.05) and authenticator management (03.05.12) apply to services and devices as well as people. Include service accounts, API keys and certificates in the same evidence.
Check which revision you are assessed against: CMMC Level 2 still uses the 110 Rev. 2 requirements. If that is your case, keep this workbook as the Rev. 3 crosswalk. See the NIST SP 800-171 Rev 3 Transition.
Protect the completed workbook: it describes your defences and evidence locations. Store and share it like the system security plan.
Mobile code policy and browser or endpoint controls
03.13.15
Session Authenticity
No
TLS configuration and session protection settings
14. System and Information Integrity (03.14)
ID
Requirement
ODP
Evidence examples
03.14.01
Flaw Remediation
Yes
Patch compliance report against the defined installation timeframe
03.14.02
Malicious Code Protection
Yes
Anti-malware deployment and update status at entry and exit points
03.14.03
Security Alerts, Advisories, and Directives
No
Subscriptions to advisories; internal alert distribution records
03.14.06
System Monitoring
No
Monitoring use cases for attacks and unauthorised connections; sample alerts
03.14.08
Information Management and Retention
No
Retention schedule for CUI and its outputs
15. Planning (03.15)
ID
Requirement
ODP
Evidence examples
03.15.01
Policy and Procedures
Yes
Policy and procedure set with review dates at the defined frequency
03.15.02
System Security Plan
Yes
Current system security plan with components, threats and requirement narratives
03.15.03
Rules of Behavior
Yes
Rules of behaviour and signed acknowledgements
16. System and Services Acquisition (03.16)
ID
Requirement
ODP
Evidence examples
03.16.01
Security Engineering Principles
Yes
Security engineering principles applied in design records
03.16.02
Unsupported System Components
No
End-of-support component list; replacement plan or compensating options
03.16.03
External System Services
Yes
Contract clauses with external service providers; shared responsibility matrix
17. Supply Chain Risk Management (03.17)
ID
Requirement
ODP
Evidence examples
03.17.01
Supply Chain Risk Management Plan
Yes
Supply chain risk management plan with review date
03.17.02
Acquisition Strategies, Tools, and Methods
No
Procurement criteria and contract language addressing supply chain risk
03.17.03
Supply Chain Requirements and Processes
Yes
Supplier assessment process and enforced supply chain requirements
Implementation guidance
Fix the scope: list the components that process, store or transmit CUI, or protect them, before opening the workbook. Every evidence example applies only to in-scope components. See the CMMC Scoping Guide.
Record ODP values in one place: keep a single table of chosen values (lockout attempts, inactivity periods, patch timeframes, review frequencies) and reference it from the policy set (03.15.01) and the system security plan (03.15.02).
Collect evidence by system, not by family: one export of an identity provider's policy often satisfies 03.01.08, 03.01.10, 03.05.03 and 03.05.07 together. Tag the artefact with every requirement it supports.
Date everything: requirements with a review or update frequency need dated records showing the cycle actually ran, not only a written procedure.
Include service identities in samples: when exporting accounts, authenticators and log records, include service accounts, API keys and certificates with their owners and rotation dates. See the Audit Readiness for AI Agents and NHIs.
NHIMG Editorial Note
Researched and written by the NHI Mgmt Group editorial team using AI tools, under the editorial direction of Lalit Choda. Facts are drawn from the sources listed on this page and checked by our automated quality process. Last updated 14 November 2026. Spotted an error? Use our contact page.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM and Agentic AI security.
nhimg.org
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.