How does DoD Instruction 5200.48 relate to contractor systems and NIST SP 800-171?

• A. It requires safeguarding CUI in contractor systems and aligns with NIST SP 800-171 as the baseline for protecting CDI where applicable.
• B. It rejects NIST SP 800-171 and uses its own standard.
• C. It only covers physical storage, not electronic.
• D. It applies only to internal DoD networks.

Answer: (A)

DoD Instruction 5200.48 sets the requirements for safeguarding controlled information in DoD information systems, including those used by contractors. It makes clear that contractor systems that process, store, or transmit CDI/CUI must implement safeguards that align with the protective standards in NIST SP 800-171. In practice, this means SP 800-171 provides the baseline controls, while DoDI 5200.48 adds DoD-specific requirements, governance, and flow-down obligations to ensure contractors and their subcontracts meet those protections. It isn’t about rejecting NIST SP 800-171; it uses it as the standard to meet. The instruction covers more than just physical storage, extending to electronic systems and other media, and it applies to any information system handling CDI on behalf of the DoD, not only internal DoD networks.