NIST SP 800-171 Compliance, Built In: How SENTRE Meets the 110
SENTRE implements the 110 requirements of NIST SP 800-171 Rev 2 inside a dedicated enclave you own, including the five areas where contractors most often fall short: FIPS cryptography, incident response, MFA, media protection and system integrity.
What does NIST SP 800-171 compliance require?
NIST SP 800-171 Rev 2 sets 110 security requirements for protecting Controlled Unclassified Information (CUI) in contractor systems. Compliance means each requirement is implemented, described in your System Security Plan (SSP) and kept in operation every day, on every system that handles CUI or protects those systems.
DFARS 252.204-7012 makes Rev 2 the baseline for every contractor that handles CUI for the Department of War (DoW, also DoD) DFARS 7012 guide →. Rev 3 exists at NIST, but DoW contracts still name Rev 2; Rev 3 would arrive through the FAR CUI rule, which is not yet final.
The 110 requirements sit in 14 families, from access control to system and information integrity. SENTRE implements them inside a dedicated, managed enclave built by ITG, so the requirements apply to one defined boundary rather than to every laptop and server in the company. The Shared Responsibility Matrix shows who is responsible for each requirement.
What does SENTRE provide, and what does your team do?
| Requirement | What SENTRE provides | What your team does |
|---|---|---|
| 3.13.11 FIPS-validated cryptography | FIPS-validated cryptography across servers, workstations and backups | Keeps CUI inside the enclave and on approved media |
| 3.6.1, 3.6.2 Incident response | Incident response plan, procedures, tracking and training | Trained on the plan and procedures |
| 3.5.3 Multi-factor authentication | MFA for privileged and network access | Enrolls users and administers accounts |
| 3.8.1 to 3.8.9 Media protection | Encryption, removable-media control, sanitization procedures, protected backups | Marks, stores and moves CUI media per the work instructions |
| 3.14.1 to 3.14.7 System and information integrity | Patching, malware protection, scanning, threat detection with administrator alerts | Follows the work instructions |
| The other 90 requirements | Implemented inside the enclave; access, logging, configuration baselines, documentation | Owns people and facility requirements, such as personnel screening |
How does SENTRE handle the five areas contractors find hardest?
Five areas cover 20 of the 110 requirements and many of the hardest gaps: FIPS-validated cryptography, incident response, multi-factor authentication, media protection, and system and information integrity. SENTRE builds the technical side of each into the enclave; ITG installs and supports it; your team runs the daily practice.
Cryptography (3.13.11) often fails because encryption is in place but the modules are not FIPS-validated, or removable media and backups are missed; SENTRE uses FIPS-validated cryptography across the stack. Multi-factor authentication (3.5.3) usually has gaps in administrator accounts and remote access; SENTRE enforces it for privileged and network access, and your team enrolls its users.
Media protection (3.8.1 to 3.8.9) fails most often in daily habits rather than technology, so SENTRE pairs encryption, removable-media control and protected backups with work instructions for marking and handling CUI media. System and information integrity (3.14.1 to 3.14.7) needs continuous attention: SENTRE includes patching, malware protection, scanning and a threat detection application that notifies your system administrator of attacks or unauthorized use.
How does SENTRE support incident response?
Requirements 3.6.1 and 3.6.2 call for an operational incident-handling capability and for incidents to be tracked, documented and reported. Under DFARS 7012 that includes reporting cyber incidents to DoW within 72 hours. SENTRE delivers the incident response plan, procedures, tracking and training that capability rests on.
The plan and procedures are written from an environment that passed a C3PAO assessment, adapted to your organization and validated in Phase 4 of implementation, before the enclave goes live. Incidents are tracked in CENTRE, so each one leaves a record an assessor can follow.
Centralized logging and the threat detection application supply the information a response needs, and preserving images and logs is simpler when the affected systems sit inside one enclave. The plan is kept current with the SSP as the enclave changes.
Why does a dedicated enclave make this easier?
One Boundary to Secure
CUI lives inside one defined boundary, so the 110 requirements apply to the enclave and the systems that protect it, not to every laptop and server in the company.
Requirements Already in Operation
You start from an environment where the requirements are implemented and working, built from the same design, documentation and operating model that passed ITG’s own C3PAO assessment at 110 of 110.
Evidence by Default
Logs, changes, incidents and training records are produced by daily operations in the enclave, so evidence exists before anyone asks for it. CMMC documentation →
Compliance is a joint effort, by design
No vendor can make a contractor compliant on its own. SENTRE implements the requirements inside the enclave, ITG manages the hardware and software, and your team follows the work instructions. The Shared Responsibility Matrix writes the split down requirement by requirement.
NIST SP 800-171 compliance FAQs
Is NIST SP 800-171 Rev 3 required?
Not yet for DoW contracts. DFARS 7012 still requires Rev 2. Rev 3 would arrive through the FAR CUI rule, which was re-proposed in June 2026 and is not yet final. An enclave that meets Rev 2 today is the starting point for any later move to Rev 3, once the rule is final.
Does ITG cover all 110 requirements?
No vendor can. SENTRE implements the 110 requirements inside the enclave, and the Shared Responsibility Matrix assigns some to your organization, such as how your people handle CUI and who may enter your facilities. Others are shared between ITG and your team.
Which requirements are the hardest?
In our experience: FIPS-validated cryptography, incident response, multi-factor authentication, media protection and system integrity. Together they cover 20 of the 110 requirements, and several carry the heaviest point weights in an SPRS score, so a gap in any of them costs more than most.
Is SENTRE the same as a consultant?
No. A consultant helps you get there with whatever solution you choose; SENTRE is the solution itself, delivered and managed by ITG. For advisory-only support, such as a gap assessment, see ITG’s consulting services, which work with any solution you choose.
How do we prove NIST SP 800-171 compliance?
Through your SSP, the evidence your operations produce and, depending on your contract, a self-assessment, a DCMA assessment or a voluntary C3PAO assessment. Every offer under DFARS 7012 also represents that you implement the requirements, so the evidence has to exist before anyone asks.
Does ITG see our CUI to support the enclave?
No. ITG personnel have no access to your CUI. ITG manages the hardware and software, while your data stays under accounts and permissions your team controls, on equipment you own. Managing the hardware and software does not require ITG to open, read or move your CUI.
See how SENTRE would implement NIST SP 800-171 in your organization, and where your enclave should sit. Discovery is a no-obligation review.