How the two relate
NIST SP 800-171's requirements are derived from the NIST SP 800-53 moderate baseline, tailored for nonfederal organizations (NIST SP 800-171 Rev. 2).
Which revision applies to DoD contractors
Rev. 2 has 110 requirements. Rev. 3 (May 2024) has 97, but DoD class deviation 2024-O0013 keeps DoD contracts on Rev. 2 (DFARS class deviations). See NIST 800-171 Rev 3.
Comparison table
| NIST SP 800-53 Rev. 5 | NIST SP 800-171 Rev. 2 | |
|---|---|---|
| Who it's for | Federal agencies and their systems | Nonfederal organizations handling CUI |
| Scope | Full security and privacy control catalog | Confidentiality of CUI |
| Count | Hundreds of controls, selected by baseline | 110 requirements |
| Assessment | Agency authorization process | CMMC Level 2 self-assessment or C3PAO assessment, per the contract |