---
title: "NIST 800-171 Requirements: All 110 by Family"
description: "All 110 NIST SP 800-171 Rev. 2 requirements in 14 families, each with its exact text, assessment objectives, SPRS points, CMMC POA&M rule and evidence."
url: https://policycortex.com/nist-800-171
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171
records: 6
digest: sha3:1e537d79a681936c91e384768a751f2ee6ed7bd4ef9b4aba60ae49187eb99d9b
---

# NIST 800-171 requirements: all 110, by family

Resources / NIST 800-171

NIST SP 800-171 Rev. 2 sets 110 security requirements, in 14 families, for nonfederal systems that handle CUI, and CMMC Level 2 assesses the same 110. Each page here quotes one requirement and the objectives an assessor checks, gives its SPRS point value and CMMC POA&M rule, and names the evidence that shows it is met.

110 requirements · 14 families · 320 assessment objectives

## The 14 families

| Family | Code | Requirements | SPRS points at most | Can go on a CMMC POA&M |
|---|---|---|---|---|
| [3.1 Access Control](https://policycortex.com/nist-800-171/access-control) | AC | 22 | 54 | 11 |
| [3.2 Awareness and Training](https://policycortex.com/nist-800-171/awareness-and-training) | AT | 3 | 11 | 1 |
| [3.3 Audit and Accountability](https://policycortex.com/nist-800-171/audit-and-accountability) | AU | 9 | 19 | 6 |
| [3.4 Configuration Management](https://policycortex.com/nist-800-171/configuration-management) | CM | 9 | 33 | 3 |
| [3.5 Identification and Authentication](https://policycortex.com/nist-800-171/identification-and-authentication) | IA | 11 | 27 | 7 |
| [3.6 Incident Response](https://policycortex.com/nist-800-171/incident-response) | IR | 3 | 11 | 1 |
| [3.7 Maintenance](https://policycortex.com/nist-800-171/maintenance) | MA | 6 | 18 | 2 |
| [3.8 Media Protection](https://policycortex.com/nist-800-171/media-protection) | MP | 9 | 23 | 4 |
| [3.9 Personnel Security](https://policycortex.com/nist-800-171/personnel-security) | PS | 2 | 8 | 0 |
| [3.10 Physical Protection](https://policycortex.com/nist-800-171/physical-protection) | PE | 6 | 14 | 1 |
| [3.11 Risk Assessment](https://policycortex.com/nist-800-171/risk-assessment) | RA | 3 | 9 | 1 |
| [3.12 Security Assessment](https://policycortex.com/nist-800-171/security-assessment) | CA | 4 | 13 | 0 |
| [3.13 System and Communications Protection](https://policycortex.com/nist-800-171/system-and-communications-protection) | SC | 16 | 42 | 10 |
| [3.14 System and Information Integrity](https://policycortex.com/nist-800-171/system-and-information-integrity) | SI | 7 | 31 | 0 |

## All 110 requirements

| Requirement | CMMC practice | SPRS points | CMMC POA&M |
|---|---|---|---|
| [3.1.1 Authorized Access](https://policycortex.com/nist-800-171/access-control/3.1.1) | AC.L2-3.1.1 | 5 points | Not allowed |
| [3.1.2 Transaction Control](https://policycortex.com/nist-800-171/access-control/3.1.2) | AC.L2-3.1.2 | 5 points | Not allowed |
| [3.1.3 CUI Flow Control](https://policycortex.com/nist-800-171/access-control/3.1.3) | AC.L2-3.1.3 | 1 point | Allowed |
| [3.1.4 Separation of Duties](https://policycortex.com/nist-800-171/access-control/3.1.4) | AC.L2-3.1.4 | 1 point | Allowed |
| [3.1.5 Least Privilege](https://policycortex.com/nist-800-171/access-control/3.1.5) | AC.L2-3.1.5 | 3 points | Not allowed |
| [3.1.6 Non-Privileged Accounts](https://policycortex.com/nist-800-171/access-control/3.1.6) | AC.L2-3.1.6 | 1 point | Allowed |
| [3.1.7 Privileged Functions](https://policycortex.com/nist-800-171/access-control/3.1.7) | AC.L2-3.1.7 | 1 point | Allowed |
| [3.1.8 Unsuccessful Logons](https://policycortex.com/nist-800-171/access-control/3.1.8) | AC.L2-3.1.8 | 1 point | Allowed |
| [3.1.9 System Use Notices](https://policycortex.com/nist-800-171/access-control/3.1.9) | AC.L2-3.1.9 | 1 point | Allowed |
| [3.1.10 Session Lock](https://policycortex.com/nist-800-171/access-control/3.1.10) | AC.L2-3.1.10 | 1 point | Allowed |
| [3.1.11 Session Termination](https://policycortex.com/nist-800-171/access-control/3.1.11) | AC.L2-3.1.11 | 1 point | Allowed |
| [3.1.12 Remote Access Control](https://policycortex.com/nist-800-171/access-control/3.1.12) | AC.L2-3.1.12 | 5 points | Not allowed |
| [3.1.13 Remote Access Encryption](https://policycortex.com/nist-800-171/access-control/3.1.13) | AC.L2-3.1.13 | 5 points | Not allowed |
| [3.1.14 Remote Access Routing](https://policycortex.com/nist-800-171/access-control/3.1.14) | AC.L2-3.1.14 | 1 point | Allowed |
| [3.1.15 Privileged Remote Access](https://policycortex.com/nist-800-171/access-control/3.1.15) | AC.L2-3.1.15 | 1 point | Allowed |
| [3.1.16 Wireless Authorization](https://policycortex.com/nist-800-171/access-control/3.1.16) | AC.L2-3.1.16 | 5 points | Not allowed |
| [3.1.17 Wireless Protection](https://policycortex.com/nist-800-171/access-control/3.1.17) | AC.L2-3.1.17 | 5 points | Not allowed |
| [3.1.18 Mobile Device Connection](https://policycortex.com/nist-800-171/access-control/3.1.18) | AC.L2-3.1.18 | 5 points | Not allowed |
| [3.1.19 Encrypt CUI on Mobile](https://policycortex.com/nist-800-171/access-control/3.1.19) | AC.L2-3.1.19 | 3 points | Not allowed |
| [3.1.20 External Connections](https://policycortex.com/nist-800-171/access-control/3.1.20) | AC.L2-3.1.20 | 1 point | Never |
| [3.1.21 Portable Storage Use](https://policycortex.com/nist-800-171/access-control/3.1.21) | AC.L2-3.1.21 | 1 point | Allowed |
| [3.1.22 Public Information](https://policycortex.com/nist-800-171/access-control/3.1.22) | AC.L2-3.1.22 | 1 point | Never |
| [3.2.1 Security Awareness](https://policycortex.com/nist-800-171/awareness-and-training/3.2.1) | AT.L2-3.2.1 | 5 points | Not allowed |
| [3.2.2 Role-Based Training](https://policycortex.com/nist-800-171/awareness-and-training/3.2.2) | AT.L2-3.2.2 | 5 points | Not allowed |
| [3.2.3 Insider Threat](https://policycortex.com/nist-800-171/awareness-and-training/3.2.3) | AT.L2-3.2.3 | 1 point | Allowed |
| [3.3.1 System Audit Logs](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.1) | AU.L2-3.3.1 | 5 points | Not allowed |
| [3.3.2 User Accountability](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.2) | AU.L2-3.3.2 | 3 points | Not allowed |
| [3.3.3 Review Logged Events](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.3) | AU.L2-3.3.3 | 1 point | Allowed |
| [3.3.4 Audit Failure Alerts](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.4) | AU.L2-3.3.4 | 1 point | Allowed |
| [3.3.5 Audit Correlation](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.5) | AU.L2-3.3.5 | 5 points | Not allowed |
| [3.3.6 Audit Reduction](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.6) | AU.L2-3.3.6 | 1 point | Allowed |
| [3.3.7 Authoritative Time](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.7) | AU.L2-3.3.7 | 1 point | Allowed |
| [3.3.8 Audit Protection](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.8) | AU.L2-3.3.8 | 1 point | Allowed |
| [3.3.9 Audit Management](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.9) | AU.L2-3.3.9 | 1 point | Allowed |
| [3.4.1 Baseline and Inventory](https://policycortex.com/nist-800-171/configuration-management/3.4.1) | CM.L2-3.4.1 | 5 points | Not allowed |
| [3.4.2 Security Settings](https://policycortex.com/nist-800-171/configuration-management/3.4.2) | CM.L2-3.4.2 | 5 points | Not allowed |
| [3.4.3 Change Control](https://policycortex.com/nist-800-171/configuration-management/3.4.3) | CM.L2-3.4.3 | 1 point | Allowed |
| [3.4.4 Security Impact Analysis](https://policycortex.com/nist-800-171/configuration-management/3.4.4) | CM.L2-3.4.4 | 1 point | Allowed |
| [3.4.5 Change Access Limits](https://policycortex.com/nist-800-171/configuration-management/3.4.5) | CM.L2-3.4.5 | 5 points | Not allowed |
| [3.4.6 Least Functionality](https://policycortex.com/nist-800-171/configuration-management/3.4.6) | CM.L2-3.4.6 | 5 points | Not allowed |
| [3.4.7 Nonessential Services](https://policycortex.com/nist-800-171/configuration-management/3.4.7) | CM.L2-3.4.7 | 5 points | Not allowed |
| [3.4.8 Application Execution](https://policycortex.com/nist-800-171/configuration-management/3.4.8) | CM.L2-3.4.8 | 5 points | Not allowed |
| [3.4.9 User-Installed Software](https://policycortex.com/nist-800-171/configuration-management/3.4.9) | CM.L2-3.4.9 | 1 point | Allowed |
| [3.5.1 Identification](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.1) | IA.L2-3.5.1 | 5 points | Not allowed |
| [3.5.2 Authentication](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.2) | IA.L2-3.5.2 | 5 points | Not allowed |
| [3.5.3 Multifactor Authentication](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.3) | IA.L2-3.5.3 | 3 or 5 points | Not allowed |
| [3.5.4 Replay Resistance](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.4) | IA.L2-3.5.4 | 1 point | Allowed |
| [3.5.5 Identifier Reuse](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.5) | IA.L2-3.5.5 | 1 point | Allowed |
| [3.5.6 Inactive Accounts](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.6) | IA.L2-3.5.6 | 1 point | Allowed |
| [3.5.7 Password Complexity](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.7) | IA.L2-3.5.7 | 1 point | Allowed |
| [3.5.8 Password Reuse](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.8) | IA.L2-3.5.8 | 1 point | Allowed |
| [3.5.9 Temporary Passwords](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.9) | IA.L2-3.5.9 | 1 point | Allowed |
| [3.5.10 Protected Passwords](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.10) | IA.L2-3.5.10 | 5 points | Not allowed |
| [3.5.11 Obscured Feedback](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.11) | IA.L2-3.5.11 | 1 point | Allowed |
| [3.6.1 Incident Handling](https://policycortex.com/nist-800-171/incident-response/3.6.1) | IR.L2-3.6.1 | 5 points | Not allowed |
| [3.6.2 Incident Reporting](https://policycortex.com/nist-800-171/incident-response/3.6.2) | IR.L2-3.6.2 | 5 points | Not allowed |
| [3.6.3 Incident Response Testing](https://policycortex.com/nist-800-171/incident-response/3.6.3) | IR.L2-3.6.3 | 1 point | Allowed |
| [3.7.1 System Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.1) | MA.L2-3.7.1 | 3 points | Not allowed |
| [3.7.2 Maintenance Tools](https://policycortex.com/nist-800-171/maintenance/3.7.2) | MA.L2-3.7.2 | 5 points | Not allowed |
| [3.7.3 Off-Site Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.3) | MA.L2-3.7.3 | 1 point | Allowed |
| [3.7.4 Diagnostic Media Checks](https://policycortex.com/nist-800-171/maintenance/3.7.4) | MA.L2-3.7.4 | 3 points | Not allowed |
| [3.7.5 Nonlocal Maintenance](https://policycortex.com/nist-800-171/maintenance/3.7.5) | MA.L2-3.7.5 | 5 points | Not allowed |
| [3.7.6 Maintenance Personnel](https://policycortex.com/nist-800-171/maintenance/3.7.6) | MA.L2-3.7.6 | 1 point | Allowed |
| [3.8.1 Media Protection](https://policycortex.com/nist-800-171/media-protection/3.8.1) | MP.L2-3.8.1 | 3 points | Not allowed |
| [3.8.2 Media Access](https://policycortex.com/nist-800-171/media-protection/3.8.2) | MP.L2-3.8.2 | 3 points | Not allowed |
| [3.8.3 Media Sanitization](https://policycortex.com/nist-800-171/media-protection/3.8.3) | MP.L2-3.8.3 | 5 points | Not allowed |
| [3.8.4 Media Marking](https://policycortex.com/nist-800-171/media-protection/3.8.4) | MP.L2-3.8.4 | 1 point | Allowed |
| [3.8.5 Media Transport](https://policycortex.com/nist-800-171/media-protection/3.8.5) | MP.L2-3.8.5 | 1 point | Allowed |
| [3.8.6 Encrypt Media in Transit](https://policycortex.com/nist-800-171/media-protection/3.8.6) | MP.L2-3.8.6 | 1 point | Allowed |
| [3.8.7 Removable Media](https://policycortex.com/nist-800-171/media-protection/3.8.7) | MP.L2-3.8.7 | 5 points | Not allowed |
| [3.8.8 Ownerless Storage](https://policycortex.com/nist-800-171/media-protection/3.8.8) | MP.L2-3.8.8 | 3 points | Not allowed |
| [3.8.9 Backup Confidentiality](https://policycortex.com/nist-800-171/media-protection/3.8.9) | MP.L2-3.8.9 | 1 point | Allowed |
| [3.9.1 Personnel Screening](https://policycortex.com/nist-800-171/personnel-security/3.9.1) | PS.L2-3.9.1 | 3 points | Not allowed |
| [3.9.2 Personnel Actions](https://policycortex.com/nist-800-171/personnel-security/3.9.2) | PS.L2-3.9.2 | 5 points | Not allowed |
| [3.10.1 Physical Access](https://policycortex.com/nist-800-171/physical-protection/3.10.1) | PE.L2-3.10.1 | 5 points | Not allowed |
| [3.10.2 Facility Monitoring](https://policycortex.com/nist-800-171/physical-protection/3.10.2) | PE.L2-3.10.2 | 5 points | Not allowed |
| [3.10.3 Visitor Escort](https://policycortex.com/nist-800-171/physical-protection/3.10.3) | PE.L2-3.10.3 | 1 point | Never |
| [3.10.4 Physical Access Logs](https://policycortex.com/nist-800-171/physical-protection/3.10.4) | PE.L2-3.10.4 | 1 point | Never |
| [3.10.5 Physical Access Devices](https://policycortex.com/nist-800-171/physical-protection/3.10.5) | PE.L2-3.10.5 | 1 point | Never |
| [3.10.6 Alternate Work Sites](https://policycortex.com/nist-800-171/physical-protection/3.10.6) | PE.L2-3.10.6 | 1 point | Allowed |
| [3.11.1 Risk Assessment](https://policycortex.com/nist-800-171/risk-assessment/3.11.1) | RA.L2-3.11.1 | 3 points | Not allowed |
| [3.11.2 Vulnerability Scanning](https://policycortex.com/nist-800-171/risk-assessment/3.11.2) | RA.L2-3.11.2 | 5 points | Not allowed |
| [3.11.3 Fixing Vulnerabilities](https://policycortex.com/nist-800-171/risk-assessment/3.11.3) | RA.L2-3.11.3 | 1 point | Allowed |
| [3.12.1 Control Assessment](https://policycortex.com/nist-800-171/security-assessment/3.12.1) | CA.L2-3.12.1 | 5 points | Not allowed |
| [3.12.2 Plans of Action](https://policycortex.com/nist-800-171/security-assessment/3.12.2) | CA.L2-3.12.2 | 3 points | Not allowed |
| [3.12.3 Ongoing Monitoring](https://policycortex.com/nist-800-171/security-assessment/3.12.3) | CA.L2-3.12.3 | 5 points | Not allowed |
| [3.12.4 System Security Plan](https://policycortex.com/nist-800-171/security-assessment/3.12.4) | CA.L2-3.12.4 | No point value | Never |
| [3.13.1 Boundary Protection](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.1) | SC.L2-3.13.1 | 5 points | Not allowed |
| [3.13.2 Security Engineering](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.2) | SC.L2-3.13.2 | 5 points | Not allowed |
| [3.13.3 Management Separation](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.3) | SC.L2-3.13.3 | 1 point | Allowed |
| [3.13.4 Shared Resources](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.4) | SC.L2-3.13.4 | 1 point | Allowed |
| [3.13.5 Public-Facing Subnets](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.5) | SC.L2-3.13.5 | 5 points | Not allowed |
| [3.13.6 Deny by Default](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.6) | SC.L2-3.13.6 | 5 points | Not allowed |
| [3.13.7 Split Tunneling](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.7) | SC.L2-3.13.7 | 1 point | Allowed |
| [3.13.8 Encryption in Transit](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.8) | SC.L2-3.13.8 | 3 points | Not allowed |
| [3.13.9 Connection Termination](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.9) | SC.L2-3.13.9 | 1 point | Allowed |
| [3.13.10 Key Management](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.10) | SC.L2-3.13.10 | 1 point | Allowed |
| [3.13.11 FIPS Cryptography](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.11) | SC.L2-3.13.11 | 3 or 5 points | Only if not FIPS validated |
| [3.13.12 Collaborative Devices](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.12) | SC.L2-3.13.12 | 1 point | Allowed |
| [3.13.13 Mobile Code](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.13) | SC.L2-3.13.13 | 1 point | Allowed |
| [3.13.14 Voice over IP](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.14) | SC.L2-3.13.14 | 1 point | Allowed |
| [3.13.15 Session Authenticity](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.15) | SC.L2-3.13.15 | 5 points | Not allowed |
| [3.13.16 CUI at Rest](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.16) | SC.L2-3.13.16 | 1 point | Allowed |
| [3.14.1 Flaw Remediation](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.1) | SI.L2-3.14.1 | 5 points | Not allowed |
| [3.14.2 Malware Protection](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.2) | SI.L2-3.14.2 | 5 points | Not allowed |
| [3.14.3 Security Advisories](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.3) | SI.L2-3.14.3 | 5 points | Not allowed |
| [3.14.4 Malware Updates](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.4) | SI.L2-3.14.4 | 5 points | Not allowed |
| [3.14.5 Malware Scanning](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.5) | SI.L2-3.14.5 | 3 points | Not allowed |
| [3.14.6 Attack Monitoring](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.6) | SI.L2-3.14.6 | 5 points | Not allowed |
| [3.14.7 Unauthorized Use](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.7) | SI.L2-3.14.7 | 3 points | Not allowed |

## How SPRS points and the CMMC POA&M work

- **Score**: An SPRS score starts at 110 and loses each unmet requirement's value: 5, 3 or 1 point. The lowest possible score is -203.
- **Partial credit**: Only 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography) can lose 3 points instead of 5.
- **CMMC POA&M**: Under 32 CFR 170.21 a POA&M can hold only requirements worth 1 point, plus 3.13.11 when encryption is used but not FIPS validated, never 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 or 3.12.4, and only with a score of at least 88. That leaves 47 of the 110.
- **Practice numbers**: 32 CFR 170.14(c) numbers each CMMC requirement DD.L#-REQ, and CMMC Level 2's requirements are identical to NIST SP 800-171 Rev. 2, so requirement 3.1.1 is practice AC.L2-3.1.1.

## Sources

- **Requirements**: [NIST SP 800-171 Rev. 2 (February 2020, updated January 28, 2021)](https://doi.org/10.6028/NIST.SP.800-171r2)
- **Assessment objectives**: [NIST SP 800-171A (June 2018)](https://doi.org/10.6028/NIST.SP.800-171A)
- **Point values**: [NIST SP 800-171 DoD Assessment Methodology, version 1.2.1, Annex A](https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf)
- **POA&M rules**: [32 CFR 170.21, Plan of Action and Milestones requirements](https://www.ecfr.gov/current/title-32/section-170.21)
- **Practice numbers**: [32 CFR 170.14(c), CMMC level requirements](https://www.ecfr.gov/current/title-32/section-170.14)

## Questions about the NIST 800-171 requirements

**Q: How many requirements are in NIST SP 800-171?**
A: Rev. 2 has 110 security requirements in 14 families, from Access Control (22) to Personnel Security (2). An SPRS score counts all 110, and CMMC Level 2 assesses the same 110.

**Q: Is a CMMC Level 2 practice the same as a NIST 800-171 requirement?**
A: Yes. Under 32 CFR 170.14(c), CMMC Level 2's security requirements are identical to NIST SP 800-171 Rev. 2 and are numbered DD.L2-REQ, so AC.L2-3.1.1 is requirement 3.1.1 in the Access Control domain.

**Q: Which NIST 800-171 requirements can go on a CMMC POA&M?**
A: 47 of the 110: those worth 1 point, plus 3.13.11 when encryption is used but not FIPS validated, minus the 6 that 32 CFR 170.21(a)(2)(iii) never allows. The score must also be at least 88, and each item must be closed within 180 days.

**Q: Where do the assessment objectives come from?**
A: From NIST SP 800-171A (June 2018), which gives 320 determination statements for the 110 requirements. An assessor finds each statement satisfied or other than satisfied.

**Q: Are these the Rev. 3 requirements?**
A: No. These are the 110 requirements of NIST SP 800-171 Rev. 2, the version CMMC Level 2 assesses. NIST published Rev. 3 in May 2024 with a different structure; Rev. 3 requirements are not in PolicyCortex yet.

### Related pages

- **Calculator**: [SPRS score calculator: all 110 requirements, one score, in your browser.](https://policycortex.com/sprs-score-calculator)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **NIST 800-171**: [NIST 800-171 compliance evidence, ready for review.](https://policycortex.com/solutions/nist-800-171)
- **SPRS score**: [SPRS score evidence: the records behind the score you affirm.](https://policycortex.com/solutions/sprs-score)

One record for all 110 requirements, ready for the assessor. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HUB | daaae1b191e5 | 649829cbc5bf |
| REC 0001 | FAMILIES | 70c15837f2ca | daaae1b191e5 |
| REC 0002 | REQUIREMENTS | 11a94ee3199f | 70c15837f2ca |
| REC 0003 | SCORING | 11c443004409 | 11a94ee3199f |
| REC 0004 | SOURCES | a6886f850c5d | 11c443004409 |
| REC 0005 | FAQ | 1e537d79a681 | a6886f850c5d |

Head sha3:1e537d79a681936c91e384768a751f2ee6ed7bd4ef9b4aba60ae49187eb99d9b. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.