Skip to content

NIST SP 800-171 Rev 2

The National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 2 provides guidelines for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations. Published by the U.S. Department of Commerce, this framework is mandatory for contractors and subcontractors handling CUI on behalf of the federal government. It is widely used across defense industrial base companies and federal contractors throughout the United States.

Terraform Registry Subdomain: nist800171

module "..." {
  source  = "nist800171.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://nist800171.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with NIST SP 800-171 Rev 2 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://nist800171.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_stage_cache_encryption_at_rest_enabled"
}