Key Takeaways NIST SP 800-171 vs. CMMC 2.0 NIST SP 800-171 lists the security controls contractors need to protect Controlled Unclassified Information, or CUI. CMMC 2.0 is the Department...