Start with the publication your contract or customer names. If nothing is named, use this rule: SP 800-171 for protecting CUI in your own systems, SP 800-53 when you build or host systems for agencies, SP 800-218 for secure development practices, and SP 800-161 for supply chain risk programs.
What each one is
SP 800-53 Rev. 5. A catalog of security and privacy controls with 20 families. NIST describes it as controls organizations can use to protect operations, assets, individuals and the nation. Baselines come from SP 800-53B.
SP 800-171 Rev. 3. Security requirements for protecting the confidentiality of CUI in nonfederal systems and organizations. NIST lists 17 families. Rev. 3 was published in May 2024. Agencies use it in contracts.
SP 800-218 (SSDF) version 1.1. A core set of high-level secure software development practices that can fit into any development life cycle. Published February 2022. Its goals include fewer vulnerabilities in released software and a shared vocabulary between buyers and suppliers.
SP 800-161 Rev. 1. Practices for managing cybersecurity supply chain risk across an organization, covering risks such as counterfeit products and vulnerabilities from poor development practices.
Decision guide
- Contract mentions CUI or CMMC Level 2. Read first: 800-171, and the CMMC rule text
- You host a system for a federal agency. Read first: 800-53 and 800-53B baselines
- A buyer asks about your development practices. Read first: 800-218
- You are asked about suppliers and open source. Read first: 800-161, then SR controls in 800-53
- You must write a system plan. Read first: 800-18 Rev. 2
- You must assess controls. Read first: 800-53A, or 800-171A for CUI requirements
How they connect
The family names in 800-171 overlap with those in 800-53, and SP 800-161 deals with the same supply chain topics as the SR family. Learning one makes the others easier to read.
Version traps
Check the revision. CMMC Level 2 text points to SP 800-171 Rev. 2, per 32 CFR 170.14, while NIST has published Rev. 3. Our post explains the difference: 800-171 Rev. 2 or Rev. 3. SP 800-18 Rev. 1 was withdrawn on 30 June 2026.
Do not read them front to back
All four are long. Read the abstract, then the sections for the controls or practices your contract asks about, then the assessment companion.
Try it yourself
Click through the mapping and notice how requirements from different frameworks overlap.
Click through it at your own pace, or open it full screen.
Quick check
Which one is for protecting CUI?
SP 800-171, which NIST describes as requirements for protecting CUI in nonfederal systems and organizations.
Is the SSDF a control catalog?
No. It is a core set of high-level secure development practices.
Safeguard's framework mapping and compliance and evidence automation help reuse one set of records across several of these. A free scan is at gold.safeguard.sh/scan.
Sources
- NIST SP 800-53 Rev. 5
- NIST SP 800-171 Rev. 3
- NIST SP 800-218
- NIST SP 800-161 Rev. 1
- NIST SP 800-18 Rev. 2
- 32 CFR 170.14, CMMC model
Last reviewed: 19 October 2026.
