Flexibility in Finalized NIST SP 800-171 Revision 3 Security Policy May Add Compliance Burden to Federal Contractors

The National Institute of Standards and Technology (NIST) issued “organization-defined parameters” in its finalized revision 3 of its Special Publication 800–171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. These parameters offers agencies and contractors some flexibility in their protection of Controlled Unclassified Information. Alex Major, Co-Chair of McCarter’s Government Contracts & Global Trade Practice, spoke with Law360 noting, for contractors, ODPs may be both a “gift and curse,” and introduce ambiguity and confusion if different agencies introduce their own specific, and possibly disparate, requirements.