The 110 NIST SP 800-171 Controls in Plain English

Who can log in, what they can reach, and how their session is limited.

In a small shop, this looks like:

• •Named accounts (no shared logins).
• •Least-privilege roles (sales doesn't need the CUI file share).
• •Session lock after 15 minutes of inactivity.
• •Remote-access controls — MFA, encrypted channels, no split-tunnel VPN.
• •Separate admin accounts from day-to-day user accounts.

Everyone with CUI access knows what they're protecting and what the threats look like.

In a small shop, this looks like:

• •Role-based training (a CAD operator and a buyer need different things).
• •Annual refresher at minimum.
• •Insider-threat awareness — yes, this is a required control.

Every meaningful action in the CUI environment is logged, the logs are protected, and someone actually reviews them.

In a small shop, this looks like:

• •Logs of every login, file access, and admin action.
• •Logs stored where attackers can't delete them.
• •Time-synced clocks so logs from different systems line up.
• •Documented log-review cadence and named reviewer.

Systems are built to a documented baseline and changes go through a process.

In a small shop, this looks like:

• •Hardened build standards for laptops, servers, network gear.
• •Software allow-list (or at minimum, blocklist) so random EXEs can't run.
• •Change tickets for every CUI-environment change.
• •Documented system inventory — every device that touches CUI.

Everyone proves who they are before getting access, and the proof is strong.

In a small shop, this looks like:

• •Multi-factor authentication on every CUI-accessing account.
• •Phishing-resistant MFA (FIDO2 keys or passkeys) for privileged users.
• •Password complexity and rotation rules per NIST guidance.
• •Device authentication for systems that machine-to-machine to CUI services.

You have a documented plan, you practise it, and you report to DoD on time.

In a small shop, this looks like:

• •Written IR plan with named roles.
• •Tabletop exercise at least annually.
• •72-hour incident reporting to DoD under DFARS 252.204-7012.

Maintaining systems doesn't become a back-door for CUI exposure.

In a small shop, this looks like:

• •Sanitise devices before sending them out for repair.
• •Supervise remote-maintenance sessions.
• •Personnel checks on outside maintenance technicians.
• •Approved tools only for maintenance work.

Anything that can carry CUI off the network is controlled, encrypted, or destroyed.

In a small shop, this looks like:

• •Encrypt CUI at rest on drives, USB sticks, backup media.
• •Mark physical media that holds CUI.
• •Sanitise media before disposal (NIST 800-88 erase or physical destruction).
• •Controlled transport when media leaves the facility.

People are vetted before getting access and access is removed when they leave.

In a small shop, this looks like:

• •Background check appropriate to role before CUI access.
• •Access revoked the day someone leaves — not the week.

Bad guys can't walk in and take CUI off your shop floor.

In a small shop, this looks like:

• •Locked doors and badge access to CUI areas.
• •Visitor log with escort policy.
• •Monitor and review physical-access logs.
• •Protect CUI from being seen through unattended monitors.

You've looked at your risks honestly, written it down, and you keep looking.

In a small shop, this looks like:

• •Annual written risk assessment of the CUI environment.
• •Vulnerability scanning of the CUI environment.
• •Remediation tracking with documented decisions.

You verify that your controls actually work, and you have an SSP and POAM.

In a small shop, this looks like:

• •Documented System Security Plan (SSP) covering all 14 families.
• •Plan of Action & Milestones (POAM) for residual gaps.
• •Periodic control assessments (internal or external).
• •Continuous monitoring programme.

The CUI environment is bounded, encrypted in transit, and segmented from everything else.

In a small shop, this looks like:

• •Firewall and network segmentation isolating the CUI enclave.
• •Encrypted communications across boundaries (TLS 1.2+).
• •Denial-of-service safeguards on internet-facing services.
• •Separate VLAN/subnet for guest Wi-Fi vs CUI systems.

You patch promptly, run anti-malware, and notice when something goes wrong.

In a small shop, this looks like:

• •Patch management with timelines for high/critical CVEs.
• •Anti-malware on every endpoint, signature-and-behaviour based.
• •Monitor inbound network communications for malicious activity.
• •Detect unauthorised changes to systems and files.