• 8 chapters

    38 short lessons

  • 14 videos

    Narrated, 3–5 minutes each

  • About 2 hours

    Self-paced, on your schedule

  • 1 workbook

    Built as you go

  • Certificate

    Pass the final check at 80%, Earn 2 CPEs

Revision 3 asks you to make decisions, not just check boxes

Revision 3 reorganized the security requirements, added organization-defined parameters, and rebuilt the assessment procedures in SP 800-171A. Teams that jump straight into implementation often end up debating what a requirement means, who sets the values, and what an assessor will want to see.

Foundations settles those questions first. You learn how to read a requirement, separate NIST's authoritative language from explanation, record the parameter decisions your organization has to own, and pick evidence that maps to specific assessment objectives. Every chapter uses one worked example, 03.01.01 Account Management, so the method stays concrete.

By the end, you'll be able to

  • Identify the applicability questions that decide whether and where 800-171 applies to you

  • Connect 800-171A assessment objectives to the evidence that supports them

  • Identify organization-defined parameter decisions and who has the authority to set each value

  • Navigate Revision 3 requirements and tell authoritative requirement language from explanation

  • Start a family-by-family learning and implementation plan for Control Mastery

Leave with a record you can use, not just notes

You'll download the Foundations Readiness Workbook in the first chapter and add to it as you go, with short activities that walk you through each entry. By the end, it holds your preliminary applicability and boundary questions, the impact of Revision 3 changes on your documents, systems, and people, one annotated requirement, and your first organization-defined parameter (ODP) record with its source, owner, and approval status. It also holds a sample map from an assessment objective to its evidence, and three prioritized program actions with owners. The workbook is a learning record. It starts the work, but it isn't proof of compliance.

Course curriculum

8 chapters · 38 lessons · about 2 hours

    1. LESSON 1.1 - Welcome to Foundations

      FREE PREVIEW

    2. LESSON 1.2 - How to Use the Course and Download Your Workbook

    3. ACTIVITY 1.3 - Your Starting Point

    4. SUMMARY 1.4 - Chapter 1 summary

    5. Reference Material

    1. LESSON 2.1 - Recognizing CUI and Its Business Context

    2. LESSON 2.2 - Connecting Obligations, Information Flows, and System Boundaries

    3. KNOWLEDGE CHECK 2.3 - Applicability Check

    4. ACTIVITY 2.4 - Record What You Know and What Needs Validation

    5. SUMMARY 2.5 - Chapter 2 Summary

    1. LESSON 3.1 - Understanding the Revised Structure

    2. LESSON 3.2 - What the Changes Mean for Implementation

    3. KNOWLEDGE CHECK 3.3 - Revision 3 Change Check

    4. ACTIVITY 3.4 - Record Your Initial Change Impacts

    5. SUMMARY 2.5 - Chapter 3 summary

    1. LESSON 4.1 - Requirement Anatomy: Identifier, Elements, Discussion, and References

    2. LESSON 4.2 - Turning Requirement Language into Implementation Questions

    3. KNOWLEDGE CHECK 4.3 - Requirement Interpretation Check

    4. ACTIVITY 4.4 - Annotate a Worked Requirement

    5. SUMMARY 4.5 - Chapter 4 Summary

    1. LESSON 5.1 - Understanding Assignment and Selection

    2. LESSON 5.2 - Establishing, Approving, and Maintaining ODP Values

    3. KNOWLEDGE CHECK 5.3 - ODP Decision Check

    4. ACTIVITY 5.4 - Create Your First ODP Record

    5. SUMMARY 5.5 - Chapter 5 Summary

    1. LESSON 6.1 -Connecting Requirements to Assessment Objectives

    2. LESSON 6.2 - Examine, Interview, and Test

    3. KNOWLEDGE CHECK 6.3 - Assessment Method and Evidence Check

    4. ACTIVITY 6.4 - Map One Objective to Evidence

    5. SUMMARY 6.5 - Chapter 6 Summary
  • $199.00

Who it's for

People responsible for implementing NIST SP 800-171 at federal contractors, including the Defense Industrial Base. No prior Revision 3 experience required.

  • Compliance leads

    Who own the SSP, the POA&M, and the assessment conversation.

  • IT and security staff

    Who configure the systems and produce the evidence.

  • Consultants and MSPs

    Who need one consistent method across many clients.

  • Managers

    Who assign owners, approve parameter values, and fund the work.

Your Instructor

Brian Hubbard

Lead CCA

Brian Hubbard is President of Evolved Cyber and has more than 40 years of cybersecurity experience supporting federal contractors, the defense community, and the intelligence community. A Lead Certified CMMC Assessor and CMMC instructor, he has led certification assessments and helped organizations prepare to demonstrate how their security programs work in practice. Brian also contributed to the original NIST Cybersecurity Framework. In this course, he brings that experience to NIST SP 800-171 Revision 3, helping leaders understand its implications for governance, systems, documentation, suppliers, and assessment readiness.

Start with the method. Then take on the families.

Two hours now saves your team from re-arguing what each requirement means later.

Enroll Now