NIST SP 800-171 Rev. 2 / Rev. 3 crosswalk / NIST SP 800-172
NIST 800-171 compliance evidence, ready for review.
NIST SP 800-171 Rev. 2 is the interim CMMC baseline: 110 requirements across 14 families. PolicyCortex keeps one evidence base for all 110, hash chained inside your tenant, with the Rev. 3 crosswalk held as an explicit mapping, so current obligations and transition planning stay distinct and every row can be recomputed by the assessor.
What the 110 requirements ask you to prove
The July 2026 CMMC suspension release names NIST SP 800-171 Rev. 2 as the interim enforcement baseline: 110 requirements across 14 families, enforced through self-assessments and selected government-led assessments. NIST published Rev. 3 in May 2024 and reorganized the requirement structure; it is not the 110-requirement CMMC baseline.
For each requirement the obligation is the same: show the technical state that satisfies it as of the assessment date, show what changed it and under what authority, and show that the SSP narrative and the POA&M describe the environment that actually exists, not the one someone remembers.
- 171.baseline
- Rev. 2, 110 requirements, 14 families: AC, AT, AU, CA, CM, IA, IR, MA, MP, PS, PE, RA, SC, SI.
- 171.rev3
- Kept as an explicit crosswalk. Evidence is not relabeled; Rev. 3 transition planning is a separate mapping over the same rows.
- 171.scope
- Controls are evidenced where CUI lives. The declared boundary is a field on every record.
- 171.172
- NIST SP 800-172 enhanced requirements are mapped as an overlay on the 110 baseline controls for Level 3 programs.
- 171.source
- Department of War release, July 13, 2026 (official release); the site's explainer: what changed and what to do.
The evidence produced for all 110 requirements
One evidence base for the 110 requirements, handed to the assessor as generated evidence with the raw payload attached. Where each proof files:
- AC · IA · SC · SI
- Proof of state: the configuration that satisfies each technical requirement, captured from the provider APIs, content hashed, and regenerable to any date inside retention.
- CM · AU · MA
- Proof of change: every alteration to a CUI-scope resource with actor, authority, before and after hashes, and a rollback identifier, on an append-only chain.
- Machine actions
- Proof of agency: what an autonomous action was permitted to do before it ran, what it did, and what would have stopped it.
- SSP · POA&M
- Narratives and open items generated from the same implementation record, so the document and the environment cannot drift apart unnoticed.
- CMMC Level 2 · SPRS
- The same rows serve the self-assessment score you affirm and the C3PAO assessment, as OSCAL 1.1.2 and an assessor handoff package.
How the record is verified against Rev. 2
Because the Rev. 3 crosswalk is a separate mapping over the same rows, the recomputation proves the Rev. 2 evidence was never relabeled: the digests belong to the requirement text in force when they were written.
Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 in an append-only chain with declared gaps for any unobserved interval, so any second party can recompute the log independently without our API.
Access and scope for the 14 families
During agreed read-only onboarding, captures file against the 14 families with the CUI boundary declared on each record. The Rev. 2 evidence base and its Rev. 3 crosswalk can both be recomputed from those records.
- eval.mode
- SHADOW. Watch only; nothing executes.
- eval.onboarding
- Access is reviewed. Scope and onboarding are agreed with your team.
- eval.location
- Your tenant. Azure, AWS, and GCP are observed clouds, including AWS GovCloud, Azure Government, and GCC High.
- eval.egress
- None. No telemetry pipeline to PolicyCortex servers; no evidence leaves the tenant.
- eval.after
- You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional.
Delivery, if you want the record stood up for you
If you want the record stood up for you, the delivery engagement is 30 days at a fixed fee agreed with the scope, one primary cloud environment. A cleared delivery team collects the evidence, writes the policies and assessment documents, coordinates approved technical remediation, prepares control owners, and stays through assessor review for in-scope follow-up at no additional cost. The independent assessor makes the certification decision. No certification is guaranteed.
- engagement.price
- Fixed fee, agreed with the scope before work begins. No hourly, no overages.
- engagement.scope
- 30 days. One primary cloud environment. NIST SP 800-171 Rev. 2, 110 requirements.
- engagement.package
- SSP, POA&M, OSCAL 1.1.2 bundle, and the evidence behind them, organized by control objective.
- engagement.review
- In-scope assessor follow-up is included. The C3PAO remains independent and makes the decision.
Questions assessors and buyers ask
What evidence supports a NIST 800-171 assessment?
Start with the CUI system boundary, an accurate System Security Plan, and evidence tied to each applicable requirement. Technical configuration records, policies, interviews, and assessment results support different parts of the review. Track unmet requirements in a POA&M where permitted. Software organizes the record; the organization remains responsible for implementation and accurate reporting.
Rev. 2 or Rev. 3?
NIST published Rev. 3 in May 2024 and reorganized the requirement structure. The Department's July 2026 CMMC suspension release names Rev. 2 as the interim enforcement baseline. PolicyCortex tracks both without presenting Rev. 3 as the 110-requirement CMMC baseline.
How does this connect to CMMC?
During the reform review, the Department says it will enforce NIST SP 800-171 Rev. 2 through self-assessments and selected government-led assessments. The same evidence base is cross-walked for Rev. 3 transition planning.
Self-assessment or C3PAO?
Both rest on the same evidence. A self-assessment uses the rows behind the SPRS score you affirm; a C3PAO assessment uses the OSCAL bundle and the assessor handoff package.
Does PolicyCortex make us compliant?
No. It produces the records compliance decisions rest on. The authorizing official, the C3PAO, or the accountable official makes the determination; PolicyCortex hands them evidence they can recompute instead of a narrative they have to believe.
What about NIST SP 800-172?
Enhanced security requirements for high-value assets. Mapped as a Level 3 overlay on top of the 110 baseline controls.
What happens when a collector is down?
The chain carries a declared gap: the stream, the interval, the reason, and when it was declared. Evidence never silently has fewer rows.
Run the baseline as a record, not a spreadsheet.