BaselineWatch
2 versions
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-171 Rev 3 (CUI; CMMC Level 2)

The 97 security requirements for protecting Controlled Unclassified Information, with their assessment objectives and organization-defined parameters; requirements withdrawn from Revision 2 are kept as withdrawn. Versions are NIST's OSCAL conversions of Revision 3 (the publication dates from May 2024); tracking starts at OSCAL 1.1.0 because 1.0.0 left 29 statements empty, so a diff against it would show a conversion fix as a change to the publication. Source · US Government work, public domain.

Where this comes fromControl catalogue · Private business, US defense

Published by NIST. The requirements for protecting controlled unclassified information in systems that are not federal — tailored out of the moderate baseline, with the federal-only parts removed.

Derives from
NIST SP 800-53B, DFARS 252.204-7012
Feeds into
CMMC, macOS Security Compliance Project
At the publisher
The same step, another body
NIST SP 800-53, NIST SP 800-53A — the other answers to the same job, on Learn

Catalog 2 versions

VersionPublishedRequirementsAgainst the previous versionLoaded
OSCAL 1.1.0 2026-10-22 130 no control-level changes Fri 23 Oct
OSCAL 1.1.0 2026-05-12 130 first version loaded 15 Oct