[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-171":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-171","SP 800-171","SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations",29,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST security requirements for protecting controlled unclassified information held by organisations outside the US federal government, such as contractors. It is closely linked to US defence contracting requirements, including the CMMC programme, and is relevant to European suppliers working with US government customers.\n\n**In practice.** Applying it well means defining the boundary of systems that handle the protected information, implementing the requirements across families such as access control, configuration management, incident response and supply chain risk, and documenting this in a system security plan. Gaps are tracked in a plan of action. Assessors expect the security plan, evidence of each requirement and records of periodic assessment.\n\n**Common gaps.** Typical gaps are an unclear scope that pulls in the whole network, requirements claimed as met without evidence, and weak control of the information at subcontractors.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F171\u002Fr3\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},26,[19,23,27,31,35,38,42,46,50,54,58,62],{"slug":20,"title":21,"published_at":22},"new-cui-regulations-tighten-cybersecurity-rules-for-federal-contractors","New CUI Regulations Tighten Cybersecurity Rules for Federal Contractors","2026-10-07T20:20:19.528+00:00",{"slug":24,"title":25,"published_at":26},"mss-front-company-funds-100-uk-academics-in-covert-research-operation","MSS Front Company Funds 100+ UK Academics in Covert Research Operation","2026-10-03T16:20:22.583+00:00",{"slug":28,"title":29,"published_at":30},"vodafone-espaa-fined-750k-for-inadequate-third-party-data-processor-controls","Vodafone España Fined €750K for Inadequate Third-Party Data Processor Controls","2026-09-22T16:22:35.502+00:00",{"slug":32,"title":33,"published_at":34},"social-engineering-via-third-party-contractor-exposes-41m-healthcare-records-1789042843480","Social Engineering via Third-Party Contractor Exposes 4.1M Healthcare Records","2026-09-10T12:20:43.327+00:00",{"slug":36,"title":33,"published_at":37},"social-engineering-via-third-party-contractor-exposes-41m-healthcare-records","2026-09-09T22:20:39.893+00:00",{"slug":39,"title":40,"published_at":41},"chinese-firms-drain-us-ai-models-via-industrial-scale-api-abuse","Chinese Firms Drain US AI Models via Industrial-Scale API Abuse","2026-09-09T18:20:46.296+00:00",{"slug":43,"title":44,"published_at":45},"95-million-patients-exposed-in-aesto-health-software-breach","9.5 Million Patients Exposed in Aesto Health Software Breach","2026-09-01T20:20:24.194+00:00",{"slug":47,"title":48,"published_at":49},"berlin-refuses-rhysida-ransom-after-5tb-data-theft","Berlin Refuses Rhysida Ransom After 5TB Data Theft","2026-08-31T10:20:51.604+00:00",{"slug":51,"title":52,"published_at":53},"quicagent-backdoor-exploits-living-off-the-land-techniques-in-myanmar-espionage-campaign","QUICAgent Backdoor Exploits Living-off-the-Land Techniques in Myanmar Espionage Campaign","2026-08-24T14:21:51.882+00:00",{"slug":55,"title":56,"published_at":57},"defense-contractors-overestimate-cmmc-readiness-as-evidence-gaps-widen","Defense Contractors Overestimate CMMC Readiness as Evidence Gaps Widen","2026-08-21T10:21:29.511+00:00",{"slug":59,"title":60,"published_at":61},"state-sponsored-iranian-hackers-stole-315tb-from-100000-academic-accounts","State-Sponsored Iranian Hackers Stole 31.5TB from 100,000+ Academic Accounts","2026-08-18T22:20:51.905+00:00",{"slug":63,"title":64,"published_at":65},"clop-ransomware-exploits-unpatched-ptc-software-to-steal-data-from-ge-and-philips","Clop Ransomware Exploits Unpatched PTC Software to Steal Data from GE and Philips","2026-08-17T12:20:42.839+00:00",[67,72,77,81,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",7,{"slug":73,"name":74,"problem":75,"stories":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":78,"name":79,"problem":80,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":82,"name":83,"problem":84,"stories":85},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",5,{"slug":87,"name":88,"problem":89,"stories":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":92,"name":93,"problem":94,"stories":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[96,102,107,112,117,122,126,131],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","13","Control 13","Network Monitoring and Defense",15,{"family":103,"item":104,"code":105,"title":105,"together":106},"itil","overview","ITIL",10,{"family":97,"item":108,"code":109,"title":110,"together":111},"15","Control 15","Service Provider Management",9,{"family":113,"item":114,"code":115,"title":116,"together":111},"gdpr","32","Article 32","Security of processing",{"family":113,"item":118,"code":119,"title":120,"together":121},"33","Article 33","Notification of a personal data breach to the supervisory authority",8,{"family":97,"item":123,"code":124,"title":125,"together":121},"3","Control 3","Data Protection",{"family":127,"item":128,"code":129,"title":130,"together":71},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",{"family":97,"item":132,"code":133,"title":134,"together":76},"12","Control 12","Network Infrastructure Management"]