Organizations handling Controlled Unclassified Information (CUI) need to comply with NIST SP 800-171 Revision 3, a set of cybersecurity requirements developed by the National Institute of Standards and Technology (NIST). These guidelines apply to non-federal organizations, including private companies, defense contractors, and businesses in regulated industries, that process, store, or transmit CUI.