What it covers. NIST security requirements for protecting controlled unclassified information held by organisations outside the US federal government, such as contractors. It is closely linked to US defence contracting requirements, including the CMMC programme, and is relevant to European suppliers working with US government customers.
In practice. Applying it well means defining the boundary of systems that handle the protected information, implementing the requirements across families such as access control, configuration management, incident response and supply chain risk, and documenting this in a system security plan. Gaps are tracked in a plan of action. Assessors expect the security plan, evidence of each requirement and records of periodic assessment.
Common gaps. Typical gaps are an unclear scope that pulls in the whole network, requirements claimed as met without evidence, and weak control of the information at subcontractors.