ConfigCheckup
Free trial

NIST SP 800-171 in Microsoft 365, requirement by requirement

26 requirements can be evidenced from a Microsoft 365 tenant, by 155 checks. Each one is listed below with its checks, and so is what sits outside Microsoft 365.

Every framework mapped to Microsoft 365 · Mappings checked against the published standards in October 2026

What NIST SP 800-171 is

The 110 security requirements for protecting controlled unclassified information (CUI) in non-federal systems. Mapped to revision 2, which CMMC Level 2 assesses against; revision 3 was published in 2024.

Who asks for it: US defence and federal supply chain handling controlled unclassified information.

What Microsoft 365 can show

26 requirements evidenced by 155 checks. A check maps to a requirement only where its result is genuine evidence for it, so a requirement is listed only when a tenant setting can show it.

Outside Microsoft 365

Physical protection, personnel screening, media protection and maintenance families are outside Microsoft 365. CUI in Microsoft 365 generally needs GCC High.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every requirement and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

NIST SP 800-171: each of the 26 requirements and the checks that evidence it
RequirementChecks that evidence it
3.1.1 Limit system access to authorised users, processes and devices
24 more checks for 3.1.1
3.1.2 Limit system access to the types of transactions and functions authorised users may execute
3.1.3 Control the flow of CUI in accordance with approved authorisations
8 more checks for 3.1.3
3.1.5 Employ the principle of least privilege
7 more checks for 3.1.5
3.1.6 Use non-privileged accounts for non-security functions
3.1.12 Monitor and control remote access sessions
3.1.20 Verify and control connections to external systems
9 more checks for 3.1.20
3.1.22 Control CUI posted or processed on publicly accessible systems
3.3.1 Create and retain system audit logs and records
3.3.2 Ensure the actions of individual users can be traced
3.4.1 Establish and maintain baseline configurations and inventories
3.4.2 Establish and enforce security configuration settings
3.4.6 Employ the principle of least functionality
2 more checks for 3.4.6
3.5.1 Identify system users, processes and devices
3.5.2 Authenticate users, processes and devices
4 more checks for 3.5.2
3.5.3 Use multi-factor authentication
12 more checks for 3.5.3
3.5.6 Disable identifiers after a defined period of inactivity
3.6.1 Establish an operational incident-handling capability
3.9.2 Protect systems during and after personnel actions such as terminations
3.12.1 Periodically assess the security controls
3.13.8 Use cryptography to protect CUI in transit
3.13.16 Protect the confidentiality of CUI at rest
3.14.1 Identify, report and correct system flaws in a timely manner
3.14.2 Provide protection from malicious code
12 more checks for 3.14.2
3.14.6 Monitor systems to detect attacks
3.14.7 Identify unauthorised use of systems
  • CMMC Level 2: The NIST SP 800-171 practices, as US defence contractors are assessed on them.
  • SOC 2: The AICPA Trust Services Criteria, asked of SaaS and service providers.
  • CISA SCuBA Microsoft 365 baselines: CISA’s secure configuration baselines for Microsoft 365.
  • NIST CSF 2.0: The NIST Cybersecurity Framework: govern, identify, protect, detect, respond and recover.

Run the NIST SP 800-171 report on every tenant.

ConfigCheckup checks each tenant you connect against NIST SP 800-171: each requirement met, partly met or not met, and what Microsoft 365 cannot show.

Start free trialTake the 2-minute tour

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant