Eliot, D.
and Pillitteri, V.
(2026),
Assessing Security Requirements for CUI: NIST SP 800-171Ar3 Small Business Primer, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.1352, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=962678 (Accessed September 17, 2026)
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Assessing Security Requirements for CUI: NIST SP 800-171Ar3 Small Business Primer
Published
Author(s)
,
Abstract
Small businesses juggle many competing priorities with their limited resources (time, budget, IT staff, etc.). A CUI security assessment can be unfamiliar and intimidating to those new and experienced with CUI security requirements. This guide provides small business owners and operators with a high-level overview of NIST Special Publication (SP) 800-171Ar3 (Revision 3), Assessing Security Requirements for Controlled Unclassified Information. The goal of the primer is to help the small business community understand foundational SP 800-171 assessment concepts and basic strategies for planning for an assessment.Citation
Special Publication (NIST SP) - 1352
Report Number
1352
NIST Pub Series
Pub Type
NIST Pubs
Download Paper
Keywords
CUI, small business, smb, cybersecurity, assessment, security, risk management, confidentiality
Citation
Issues
If you have any questions about this publication or are having problems accessing it, please contact [email protected].
Created September 16, 2026