NIST 800-171 Rev 2's 14 Control Families Explained (with examples)

The 14 Rev 2 Families (CMMC L2 / SPRS Today)

Related: Rev 3 (Not This Page's Catalog)

Rev 3 keeps these 14 themes (CA renamed Security Assessment and Monitoring) and adds Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR) — 17 families / 97 requirements. Full comparison: 800-171 Rev 3 changes.

Example: Audit and Accountability (3.3)

Rev 2 requirements 3.3.1–3.3.9 cover create/retain logs, unique user traceability, review events, alert on logging failure, correlate, reduce/report, time sync, protect audit information, and limit audit-admin privileges. Deep dive: 800-171 audit logging.

How CyberSilo Helps

• Compliance Standards Automation — map Rev 2 family requirements to SSP/SPRS/CMMC Level 2 evidence
• ThreatHawk SIEM — monitoring artefacts for 3.3, 3.6, and 3.14-style outcomes

Frequently Asked Questions

Is this Rev 3?

No. This page covers Revision 2's 14 families and 110 requirements. Rev 3 has 17 families and 97 requirements — see our Rev 3 changes guide.

Which revision for CMMC Level 2?

Revision 2 until regulation updates. CMMC Level 2 still assesses against Rev 2.

Are these the same as 800-53 families?

Related lineage, different numbering and scope. 800-171 targets CUI on nonfederal systems.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM