NIST SP 800-171 is a set of security guidelines issued by the National Institute of Standards and Technology (NIST) that outline the requirements that contractors must follow in order to handle and protect Controlled Unclassified Information (CUI). CUI is information that is sensitive but not classified, and it includes data related to defense, law enforcement, finance, and other areas. NIST SP 800-171 provides a framework for protecting CUI in non-federal information systems and organizations that handle CUI on behalf of the federal government. The guidelines cover areas such as access control, incident response, system maintenance, and personnel security.