Strike Graph now supports NIST 800-171!

Land that government contract. Become NIST 800-171 compliant today.

Strike Graph makes it simple and fast to achieve NIST 800-171 compliance so nothing stands in the way of your business ambitions. And, our flexible platform lets you easily build toward CMMC, SOC 2, ISO 27001, and other frameworks.

Don’t lose a lucrative government contact because you’re not NIST 800-171 compliant.

The thing about IT security compliance is that when you need it, you need it now. That’s why it’s essential to reach compliance before a big deal depends on it.


Traditional compliance

Traditional, one-size-doesn’t-fit-all compliance approaches are slow and expensive. And, when you’re ready to expand to CMMC or other non-government security frameworks, they leave you back at square one.


Strike Graph

Strike Graph tailors the compliance process to your company’s unique needs and sets you up for easy expansion into other security frameworks you need to drive continued revenue growth — quickly and affordably.


Strike Graph’s platform takes the headache out of NIST 800-171 compliance.

Take control of your compliance process.

Most IT security compliance companies take a checklist approach that’s the same for every company. Strike Graph’s tailored, risk-based process ensures you’re only investing energy into the areas that matter most for your organization.

Group 33 (1) 1

Employ strategic automation.

Automating time consuming, repetitive tasks makes the compliance process faster and easier. And, for jobs that require a human touch, Strike Graph distributes responsibility across your organization, lessening the load for everyone.


Future proof your security posture.

Strike Graph’s flexible platform gets you to NIST 800-171 compliance fast and sets you up to easily build toward CMMC and any other security frameworks you need in the future.


Packed with useful features

In-house penetration testing
image 19
Cross-framework support
image 16
55+ policy templates
image 18
Easy integrations

Here’s how it works.

Achieve NIST 800-171 compliance in three easy steps.

Step 1

Identify risks.

Our risk assessment tool identifies your organization’s unique IT security needs, drastically reducing the time and resources needed to reach compliance.
Step 2

Assign controls and collect evidence.

Our extensive NIST 800-171-specific control library and automated evidence collection make it a snap to mitigate your company’s risks and prove the effectiveness of your security program.
Step 3

Achieve and maintain compliance.

Strike Graph’s dashboard shows you when you’ve attained compliance and allows you to easily maintain your security program moving forward.
  • Star 2
  • Star 2
  • Star 2
  • Star 2
  • Star 2

Our customers love that Strike Graph sets them up for success today and in the future.

users-love-us-4fca521cb6d80c30d02e3df6bd0013f5395fb3ae22e81b3e3608e258d8feba63 (1)

Get your security audits going and completed in half the time

There are file repositories for security audits, automated security questionnaires. evidence repository, and great support from the customer success team. Whether you need evidence of HIPAA, SOC2, or ISO, you're in the right place.

Strike Graph Customer in IT

A worthwhile investment, saving countless hours and money.

I love that their team is personable and dedicated to my situation directly. I can always count on them day or night to be available quickly.

Patrick H., Security and IT Manager

Strike Graph helps with navigating the space of compliance with various frameworks.

Having a nice and tidy dashboard where we have all the necessary evidence items is a great benefit, the service saves a lot of time overall.

Jan, CTO
Join the hundreds of companies that rely on Strike Graph for IT security compliance.
image 6
whylabs-logo-for-light-background (1)
image 8 (1)
image 10 (1)
image 11
Voxology-Logo (1) (1)
image 14

Dig into the details

Looking to become a NIST 800-171 expert? We have the answers you’re looking for.

What are NIST 800-171 controls?

NIST 800-171 has 110 controls organized across 14 control families. These control families include:

  • Access control: Determines who has access to data and whether or not they’re authorized
  • Audit and accountability: Ensures your staff is adequately trained on the handling of CUI
  • Awareness and training: Ensures you know who’s accessing CUI and who’s responsible for what
  • Configuration management: Ensures you follow guidelines to maintain secure configurations
  • Identification and authentication: Allows you to manage and audit all instances of CUI access
  • Incident response: Ensures you prepare a response plan for breaches of CUI data
  • Maintenance: Ensures ongoing security and change management in order to safeguard CUI
  • Media protection: Secures the handling of external drives, backups, and other backup equipment
  • Personnel security: Ensures you train your staff to identify and prevent insider threats
  • Physical and environmental protection: Ensures only authorized personnel are in physical spaces where CUI lives
  • Risk assessment: Helps you develop a risk profile for CUI breaches as well as evaluate your current level of risk
  • Security assessment: Audits and verifies the effectiveness of your security procedures
  • System and communications protection: Secures your comms systems and channels
  • System and information integrity: Addresses new vulnerabilities and system downtime

Who does NIST 800-171 apply to?

NIST SP 800-171 provides recommended requirements for protecting the confidentiality of controlled unclassified information, or CUI, for government contractors and subcontractors. Therefore, if an organization is a part of the Department of Defense (DoD), General Services Administration (GSA), National Aeronautics and Space Administration (NASA), or other federal or state agencies’ supply chain, it must implement the security requirements included in NIST SP 800-171.

What is a good NIST 800-171 score?

NIST 800-171 compliance is scored via the 110 security requirements within the framework, with each requirement implemented representing a single point score. Therefore, the highest possible score is a 110, and the lowest possible score is a -203 (the assessment is conducted on a weighted basis because some requirements have a higher impact on the security of CUI than others). A good NIST 800-171 score should be as close to 110 as possible, but this will depend on the specifics of your contract with the DoD.

How do I improve my NIST 800-171 score?

We recommend you first conduct a self-assessment — known as an internal gap assessment — before the actual NIST 800-171 assessment. This way, you can internally evaluate your implementation of the weighted NIST 800-171 requirements and strategically identify any vulnerabilities in your security infrastructure and implementation. A partner like Strike Graph can help you with this.

Is there a NIST 800-171 certification?

Yes, but this is for people who want to obtain a Certified NIST CSF LI certification, which is for those who want to be trained and certified as an expert in their “ability to implement the formal structure, governance, and policy of a robust cybersecurity framework following internationally recognized and respected NIST best practices and standards.”

Companies need to achieve NIST 800-171 compliance, which proves contractors’ ability to demonstrate their provision of adequate security to protect the covered defense information included in their defense contracts, as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. As of November 30, 2020, all DoD contractors must conduct a NIST 800-171 Basic Assessment and submit their score to the Supplier Performance Risk System (SPRS).

Is there a NIST 800-171 certification?

The cost of NIST 800-171 compliance — not certification — depends on the size and complexity of your business, as well as if your security systems are up to date. Therefore, if you’ve been proactive and kept your business security up to date over the years, you may not need to do much more — or spend much more money — to become NIST 800-171 compliant.

Additionally, other factors to consider that can affect cost include:

  • The number of aspects of your business that are affected by CUI
  • The available people-power to carry out the procedures
  • The maturity of the computing environment

This is why it’s difficult to put a specific dollar amount on how much NIST 800-171 compliance will cost, and why you’ll see quotes from anywhere from a few thousand dollars to several hundred.

Do NIST certificates expire?

Remember, NIST doesn’t provide certification for Information Technology (IT) systems, products, or modules. However, NIST does operate a number of IT Security Validation Programs that allow vendors to use third-party, independent, private-sector, accredited testing laboratories to have their products tested.

Can’t find the answer you’re looking for? Contact our team!

Additonal resources

Read more about NIST 800-171 from the Strike Graph experts.

Homepage Hero Image

Still have questions?
We’d love to give you a test drive.

We’d love to give you a peek at how we help our clients achieve NIST 800-171 compliance. Request a demo below and one of our IT security experts will be in touch!