To handle Controlled Unclassified Information on a Department of Defense contract, the system network configuration required for CUI is the full set of 110 security requirements in NIST Special Publication 800-171 Revision 2, organized across 14 requirement families and enforced through the Cybersecurity Maturity Model Certification program.1eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program Every one of those 110 controls has to be implemented, or the gap has to be documented and scheduled for remediation. There is no partial-credit path that lets you skip a family.
The Standard You Are Being Measured Against
CMMC Level 2 applies to any contractor that processes, stores, or transmits CUI, and its security requirements are identical to those in NIST SP 800-171 Rev 2.1eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program NIST released Revision 3 in 2024 with 17 families and new controls covering supply chain risk, planning, and system acquisition,2National Institute of Standards and Technology. NIST Special Publication 800-171 Rev 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations but CMMC Level 2 assessments still reference Rev 2, and the CMMC Assessment Guide uses NIST SP 800-171A (June 2018) as its methodology.3DoD Chief Information Officer. CMMC Assessment Guide Level 2 Rev 2 is what you configure to today.
Whether you self-assess or hire a CMMC Third-Party Assessment Organization depends on what the solicitation says. The DoD sets that based on the sensitivity of information the system will handle.4DoD Chief Information Officer. About CMMC The 110 technical controls do not change either way.
The 14 Requirement Families
NIST SP 800-171 Rev 2 groups its 110 requirements into 14 families, each covering a different layer of the system.5Computer Security Resource Center. NIST SP 800-171 Rev 2 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical and Environmental Protection
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity
None of these is optional. A gap in any family reduces your assessment score and, more importantly, leaves a real vulnerability in the system.
Encryption
CUI must be encrypted using FIPS-validated cryptographic modules whenever it is transmitted outside your protected network boundary or stored outside the secured environment of your information system.6DIB SCC CyberAssist. SC.L2-3.13.11 CUI Encryption Encryption used purely within the internal protected environment does not need to be FIPS-validated, though many organizations apply it uniformly to simplify management. The current standard is FIPS 140-2.7National Institute of Standards and Technology. FIPS 140-2 – Security Requirements for Cryptographic Modules
A transition is in progress. NIST will move all FIPS 140-2 certificates to the historical list on September 21, 2026, after which FIPS 140-3 becomes the active standard. Modules on the historical list can still be purchased and used in existing systems, but new deployments should target FIPS 140-3 validated products to avoid replacing hardware or software within a few years.8Computer Security Resource Center. FIPS 140-3 Transition Effort
Authentication and Session Locks
Multifactor authentication is required, but the scope is specific. You need MFA for all local and network access to privileged accounts, and for network access to non-privileged accounts. Local access to non-privileged accounts does not require MFA under Rev 2. Getting that wrong in either direction either wastes resources on unnecessary friction or leaves a real gap on network access to standard users.
Workstations and terminals must lock after a defined period of inactivity. NIST 800-171 does not prescribe a specific number of minutes; your organization sets the timeout based on its own risk assessment, though most CUI environments land somewhere between five and fifteen minutes. The lock must use a pattern-hiding display so that whatever was on screen is not visible to passersby.
Boundary Protection and Segmentation
Firewalls, gateways, and other boundary devices must be configured to deny all network traffic by default and allow only specifically approved connections. This deny-all, permit-by-exception approach applies to both inbound and outbound traffic at the system boundary and at identified interior points. In practice, you maintain an explicit allowlist of approved flows rather than a blocklist that tries to catch known threats.
CUI cannot be allowed to leak into public-facing or lower-security segments. That requires deliberate network segmentation, with boundary devices controlling traffic between zones. DNS filtering, intrusion detection, and monitoring at those boundaries catch misconfigurations and active attacks. Remote access must pass through encrypted tunnels with authentication verified at a controlled access point before any traffic reaches the internal environment.
Administrators should also disable unnecessary ports, protocols, and services across the infrastructure. Every open port is a potential entry point, and the ones nobody remembers leaving open are usually the ones that get exploited. Regular scanning and documentation keep the attack surface small.
Physical and Environmental Safeguards
Network configuration means little if someone can walk into the server room. Access to any area where CUI is processed, stored, or transmitted has to be controlled through access cards or equivalent mechanisms, visitor logs, and escort procedures for anyone not authorized for unaccompanied access.
Servers, switches, and other network hardware belong in locked racks or restricted rooms accessible only to authorized personnel. Environmental controls such as fire suppression and temperature monitoring protect against hardware failures. Printers and monitors need to be positioned so unauthorized people cannot see screens or grab printed output.
Media disposal catches organizations out more often than it should. Hard drives, USB drives, and paper records containing CUI must be destroyed by shredding, degaussing, or another method that renders the data unrecoverable. Deleting files or reformatting a drive does not meet the standard.
System Security Plan and POA&M
Every organization handling CUI must maintain a System Security Plan describing the system boundary, the operating environment, how each of the 110 requirements is implemented, and connections to other systems.9Department of Defense. NIST SP 800-171 DoD Assessment Methodology There is no mandated format, but the plan has to be detailed enough that an assessor can verify your configurations against your documentation.
A useful SSP starts with a complete hardware inventory: serial numbers, MAC addresses, and physical location of every device inside the CUI boundary. Software inventories should include version numbers and patch status so nothing is running unsupported. Network diagrams need to show where CUI flows, where boundary protections sit, and how security zones connect.
For any requirement that is not fully implemented, a Plan of Action and Milestones must document the gap, describe remediation steps, assign responsibility, and set a target completion date. NIST and the Manufacturing Extension Partnership publish templates for both the SSP and POA&M. These two documents are the primary evidence assessors review, so treat them as living records rather than one-time paperwork.
SPRS Score Submission
After completing a self-assessment, you calculate a summary score using the NIST SP 800-171 DoD Assessment Methodology. A perfect score is 110. Each unmet requirement subtracts a weighted amount. The summary score, along with the date you expect to reach 110, must be posted to the Supplier Performance Risk System before you can be considered for contract award.10eCFR. 48 CFR 252.204-7019 – Notice of NIST SP 800-171 DoD Assessment Requirements
The assessment has to be current, meaning not more than three years old unless the solicitation calls for a shorter period. If nothing is posted, you can conduct and submit a basic self-assessment. A missing SPRS entry or a low score can knock you out of source selection before the technical evaluation begins.
72-Hour Incident Reporting
When a cyber incident affects a system containing CUI or compromises the ability to perform contract requirements designated as operationally critical, you must report it to the DoD within 72 hours of discovery. Reports go through the Defense Industrial Base Network portal at dibnet.dod.mil, and access requires a DoD-approved medium assurance certificate.11eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information
Reporting is not the end of it. You also have to review your systems for evidence of compromised CUI, identify affected computers, servers, data, and user accounts, and preserve images of all affected systems and relevant monitoring data for at least 90 days after submitting the report. Any malicious software connected to the incident goes to the DoD Cyber Crime Center, not the contracting officer.11eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information Get the medium assurance certificate before you need it. Scrambling to obtain one during a live incident eats into the 72-hour window.
What Happens If the Configuration Falls Short
Failing to meet CUI configuration requirements can mean contract termination and debarment from federal work. The Department of Justice has also used the False Claims Act, through its Civil Cyber-Fraud Initiative, to pursue contractors who misrepresent their cybersecurity compliance. Penalties include treble damages plus per-claim civil penalties currently ranging from $14,308 to $28,619.
A low but accurate SPRS score, backed by an honest POA&M and steady remediation, is safer than an inflated score paired with an SSP that does not match the network. Assessors and auditors compare the documentation to the configuration. If they do not line up, the exposure is no longer just a lost contract.