A defense contractor must safeguard Controlled Unclassified Information in a non-federal system. Which named publication in the course material is specifically associated with that requirement?

### Why this is right The course material identifies National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171) as establishing requirements to protect Controlled Unclassified Information in non-federal systems. It also links the defense sector to Cybersecurity Maturity Model Certification (CMMC). ### The concept Defense contractors may handle sensitive government-related information that is not classified but still requires protection. The cited publication provides security requirements for such information in non-federal systems. CMMC adds a certification model with levels related to data sensitivity and security requirements. ### The other options - **B. Payment Card Industry Data Security Standard (PCI DSS)**: this concerns payment-card security. - **C. System and Organization Controls 2 (SOC 2)**: this is an assurance examination framework associated with customer-data services. - **D. North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP)**: this addresses electric-system cybersecurity. ### Terms - **National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171)**: Security requirements for Controlled Unclassified Information in non-federal systems. - **Controlled Unclassified Information**: Government-related information that is not classified but requires safeguarding. - **Cybersecurity Maturity Model Certification (CMMC)**: A certification model for defense contractor cybersecurity practices. ### Remember For defense-related Controlled Unclassified Information in non-federal systems, know the role of NIST SP 800-171.