The 110 controls of NIST SP 800-171 only have to be met inside your Controlled Unclassified Information boundary, which makes CUI scoping and boundary the single decision that determines how much work you have. This pack treats it as the first deliverable. 33 editable Word documents, downloadable the moment you check out. On this page:
- What is in the CUI scoping and boundary pack
- Rev 2 or Rev 3, and why getting this wrong wastes a year
- Who needs CUI scoping and boundary
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the CUI scoping and boundary pack
Documents are numbered in implementation order, starting with the scoping work before any control policy:
- 00 Toolkit overview and document map
- 01 CUI definition and identification guide – what actually counts as CUI, which is where most organisations start wrong
- 02 CUI scoping and boundary guide – drawing the boundary and justifying it
- 03 CUI flow and data inventory guidance – tracing where CUI enters, is processed, stored and leaves
- 04 System Security Plan template – the document a DoD customer or assessor asks for by name
- 05 Plan of Action and Milestones template – how open items are tracked and closed
- 06 to 19 – a policy for each of the fourteen control families, numbered to the 800-171 sections: 3.1 Access Control, 3.2 Awareness and Training, 3.3 Audit and Accountability, 3.4 Configuration Management, 3.5 Identification and Authentication, 3.6 Incident Response, 3.7 Maintenance, 3.8 Media Protection, 3.9 Personnel Security, 3.10 Physical Protection, 3.11 Risk Assessment, 3.12 Security Assessment, 3.13 System and Communications Protection, 3.14 System and Information Integrity
- Supporting material – SPRS scoring guidance, the assessment methodology position and the evidence index
Rev 2 or Rev 3, and why getting this wrong wastes a year
NIST published Revision 3 of SP 800-171 in May 2024. It restructured the control set and changed the count. It is the current NIST publication.
It is also not what your contract requires. DFARS 252.204-7012 and the CMMC programme still reference Revision 2 and its 110 controls. The rule that would move the Department of Defense to Rev 3 remains pending. An organisation that builds to Rev 3 today documents a control set its customer is not assessing against, and will have to reconcile the two.
This pack is therefore written to Rev 2, with the differences noted so you can see where Rev 3 would take you when the transition happens. The CUI scoping and boundary work is unaffected by the revision question, which is another reason to start there.
Who needs CUI scoping and boundary
Defense contractors and subcontractors handling CUI under a DFARS clause. Suppliers being flowed requirements by a prime. Organisations with an SPRS score that was estimated rather than assessed. And any company that has been told it needs 800-171 and needs first to establish whether it handles CUI at all – because a surprising number do not.
How the CUI scoping and boundary maps to the framework
The SSP is the deliverable, but it is only as good as the boundary it describes. An over-broad boundary pulls your whole corporate network into scope and makes all 110 controls apply everywhere. A well-drawn enclave can reduce that dramatically – and an under-documented one collapses the first time an assessor asks how CUI reaches it. The three scoping documents exist to make that argument properly.
Frequently asked questions
Should we build to Rev 2 or Rev 3?
Rev 2, with 110 controls, unless your contract says otherwise. DFARS and CMMC still reference Rev 2 and the transition rule is pending.
What is an SPRS score?
A self-assessed score against the 110 controls, submitted to the Supplier Performance Risk System. It starts at 110 and points are deducted for unimplemented controls, with weightings. Scoring guidance is included.
How does this differ from the CMMC toolkit?
This is the control set and the scoping work. CMMC adds the assessment regime and its own documentation. Many organisations need both – see the CMMC Toolkit.
Do we definitely handle CUI?
Not necessarily. CUI is specifically marked or identified information, not simply sensitive business data. Document 01 covers identification, and establishing that you do not handle it is a legitimate and valuable outcome.
How many documents are included?
33 editable Word documents, plus guidance and a licence file.
Related toolkits
Defense supply chain obligations overlap. See the CMMC Toolkit for the assessment regime, the NIST SP 800-53 Toolkit for the federal control catalogue 800-171 derives from, the FedRAMP Toolkit for cloud services sold to government and the ISO 27001 Toolkit for commercial customers. The NIST CSF toolkit provides the framework view above the CUI controls.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your CUI scoping and boundary downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the CUI scoping and boundary are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.