Course Overview
Learn what NIST SP 800-171 Revision 3 requires and how SP 800-171Ar3 assesses it. This course covers all 97 security requirements across the 17 families, the 422 determination statements assessors use, and the 80 Organization Defined Parameters (ODPs) you must set. It also gives you a practical plan for building your SSP and POA&M and preparing for the move from Rev. 2 to Rev. 3.
Modules
Module 1: Understanding CUI
Module 2: 171r3 Fundamentals
Module 3: 171Ar3 Assessment Methodology
Module 4: The 17 Requirement Families
Module 5: Implementing 171r3
Module 6: 171r3 Readiness
Module 7: Resources
Learning Objectives
A practical approach to implementing, documenting, and assessing the NIST SP 800-171r3 security requirements for protecting CUI.
- Define CUI, explain the roles of NARA, NIST, federal agencies, and contractors, and scope the systems that process, store, transmit, or protect CUI.
- Explain how SP 800-171r3 is structured, including tailoring, requirement families, ODPs, and the key changes from Rev. 2.
- Apply the SP 800-171Ar3 methodology, including assessment procedures, determination statements, methods, objects, and the four-phase assessment process.
- Interpret all 97 requirements across the 17 families, including the new Planning, System and Services Acquisition, and Supply Chain Risk Management families.
- Build a System Security Plan and POA&M, and follow a step-by-step readiness playbook to prepare for Rev. 3 while meeting current Rev. 2 obligations.
Intended Audience
- Defense contractors and subcontractors handling CUI
- Organizations preparing for CMMC Level 2 and the transition to Rev. 3
- Security, compliance, and risk management professionals
- IT, MSP, and system administrators supporting CUI environments
- Internal assessors and teams conducting NIST SP 800-171 self-assessments
- CMMC candidates (CCP/CCA) and RPO consultants
Final Exam
Upon successful completion of the Final Exam, you will receive a Certificate of Completion for the course.
*This purchase is non-refundable.