NIST SP 800-171 defines requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations.
It affects contractor documentation through security plans, policies, procedures, evidence of implementation, assessments, and CUI handling instructions.
Additional Resources: