The Department of Education is suggesting NIST SP 800-171
In June 2015, the National Institute of Standards and Technology (NIST) released NIST Special Publication 800-171. This document, titled Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, details required controls nonfederal entities, such as defense contractors, should have in place for protecting the confidentiality of Controlled Unclassified Information (CUI). There are 14 security control families in NIST SP80-171, including Access Control, Awareness and Training, Personnel and Physical Security, to name a few. While our IT audit and security division, OCD Tech, has worked with defense contractors to ensure they have the controls and system security plans in place to comply with this new publication, Higher Education was not on the radar for these technical controls.