NIST 800-171 R3 03.04.11 Information Location at a Glance
- Family: 03.04 Configuration Management (CM)
- Requirement ID: 03.04.11 Information Location
- Assessment Objectives (AOs): Five (5) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Control: CM-12
- NIST 800-171 R3 Kill Chain Phase: Phase 3c, Establish The Compliance Scope for parts a; Phase 8, Segmented Network Architecture for parts b
Information Location is a net-new requirement in R3, and it answers a deceptively simple question: where is your Controlled Unclassified Information (CUI)? It requires you to identify and document the location of CUI and the system components on which it is processed and stored, and to document changes to those locations over time. Information Location (03.04.11) is the requirement that turns scoping from an assumption into documented fact. Per the NIST discussion, understanding the specific system components where CUI is processed and stored, and the users who have access, is what lets you apply the right protection mechanisms, including information flow controls, access controls, and information management.
A common difficulty with this requirement is not having a clear answer to where their CUI actually lives. Many organizations assume CUI is confined to a few systems, then discover it in email, file shares, endpoints, backups, and cloud services. This requirement is new for R3, so there is no R2 process to carry forward, and most organizations are building the CUI data map from scratch. It ties directly to scoping, which is why the Unified Scoping Guide is a useful companion for deciding what is in scope in the first place.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.04.11 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.04.11 Information Location. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:
- a. Identify and document the location of CUI and the system components on which the information is processed and stored.
- b. Document changes to the system or system component location where CUI is processed and stored.
The source control is CM-12 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, information location addresses the need to understand the specific system components where CUI is processed and stored and the users who have access, so that appropriate protection mechanisms can be provided. You can read the requirement directly at NIST 800-171 R3, 03.04.11 (p. 32).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.04.11?
None (0). Requirement 03.04.11 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.04.11 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.04.11?
NIST 800-171A R3 breaks 03.04.11 into five (5) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.04.11.a[01]: the location of CUI is identified and documented.
- A.03.04.11.a[02]: the system components on which CUI is processed are identified and documented.
- A.03.04.11.a[03]: the system components on which CUI is stored are identified and documented.
- A.03.04.11.b[01]: changes to the system or system component location where CUI is processed are documented.
- A.03.04.11.b[02]: changes to the system or system component location where CUI is stored are documented.
Part a splits into the location of CUI, the components where it is processed, and the components where it is stored, and part b splits into documenting changes to processing locations and to storage locations. Processing and storage are treated separately throughout, so a data map that captures where CUI is stored but not where it is processed leaves objectives open. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.04.11 (p. 40).
Assessment Methods and Objects for NIST 800-171 R3 03.04.11
Examine: configuration management policy and procedures; configuration management plan; procedures for identification and documentation of information location; system audit records; architecture documentation; system design documentation; list of users with system and system component access; change control records; system component inventory; system security plan.
Interview: personnel with responsibilities for managing information location and user access; personnel with responsibilities for operating, using, or maintaining the system; personnel with information security responsibilities; system developers; system administrators.
Test: processes governing information location; mechanisms for enforcing policies and methods for governing information location.
How Does NIST 800-171 R3 03.04.11 Map From NIST 800-171 R2?
03.04.11 is net new for R3 and has no corresponding requirement in NIST 800-171 R2. All five (5) assessment objectives are net new, so there is no transition path and no prior evidence to reuse.
The underlying source control, CM-12, was not among the requirements R2 drew from, so Information Location is genuinely new work rather than a reinterpretation. That said, the information you need often already exists in fragments: data flow diagrams, system security plan boundaries, and asset inventories all touch on where CUI lives. The new obligation is to consolidate that into a documented, maintained CUI location map and to keep it current as locations change.
How Does NIST 800-171 R3 03.04.11 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.04.11 through the following SCF controls:
- AST-02 Asset Governance
- AST-04 Asset Inventories
- AST-16 Asset Scope Classification
- AST-17 Network Diagrams & Data Flow Diagrams (DFDs)
- AST-17.1 Control Applicability Boundary Graphical Representation
- AST-17.2 Data Action Mapping
- CHG-06 Security Impact Analysis for Changes
- CHG-07 Test, Validate & Document Changes
- CHG-08 Stakeholder Notification of Changes
- CPL-02 Statutory, Regulatory & Contractual Compliance
- CPL-03 Compliance Scope
- DCH-04 Data & Asset Classification
- DCH-05 Sensitive Data Inventories
- DCH-29 Logical Data Location
- DCH-30 Geographic Data Location
- IAO-09 Applied Security, Compliance and Resilience Controls Documentation
- IAO-12 Capabilities Deficiency Tracking
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.04.11
The pitfalls for this net-new requirement are about building and maintaining the CUI location map, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Processing and storage are separate. A.03.04.11.a[02] covers where CUI is processed and a[03] covers where it is stored. These are different questions, and both must be documented.
- CUI spreads further than expected. Email, file shares, endpoints, backups, and cloud services often hold CUI that was never accounted for. An incomplete location map understates your scope and your risk.
- Changes must be documented. A.03.04.11.b[01] and b[02] require documenting changes to processing and storage locations. A one-time map that is never updated fails these objectives as the environment changes.
- This drives scoping. Where CUI lives determines what is in scope for the entire framework, so treat 03.04.11 as foundational and align it with your scoping decisions and the Unified Scoping Guide.
What Is Reasonable Evidence For NIST 800-171 R3 03.04.11?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.04.11 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.04.11 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-01 IT Asset Management (ITAM). An it asset management (itam) program that addresses the due diligence and due care activities associated with maintaining both secure, compliance and resilient technology assets, applications and/or services (taas).
- E-AST-02 Asset Scoping Guidance. An asset scoping guidance. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on defining in-scope technology assets, applications, services and/or data (taasd) (including third-parties).
- E-AST-04 Asset Inventories - Hardware. An inventory of the organization's technology hardware assets.
- E-AST-05 Asset Inventories - Software. An inventory of the organization's software assets.
- E-AST-07 Cyber-Physical Systems (CPS). An inventory of the organization's physical assets that process functions based on software and networks.
- E-AST-08 Asset Inventories - Sensitive / Regulated Data. An inventory of the organization's sensitive/regulated data (including systems where sensitive/regulated data is stored, processed and/or transmitted) that contains sufficient information to determine the potential impact in the event of a data loss incident.
- E-AST-23 Geolocation Inventory. Designated internal and third-party facilities where organizational data is stored, transmitted and/or processed.
- E-AST-28 Software Licenses. Software license inventories.
- E-CHG-04 Evidence of Cybersecurity / Data Privacy Reviews. Change control board (ccb) meeting-related security, compliance and/or resilience reviews for proposed change(s).
- E-CHG-05 Change Control Records. Change control records (including test results, when applicable).
- E-CHG-06 Stakeholder Notification of Changes. Stakeholder notification communications for proposed changes.
- E-CPL-01 Statutory, Regulatory & Contractual Obligations. Applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls.
- E-CPL-02 Defined Compliance Scope (DCS). A formal scoping document that identifies applicable statutory, regulatory and/or contractual obligations for the organization. defines the affected lines of business (lob), internal / external stakeholders and facilities for the specific scope of compliance obligations.
- E-DCH-01 Data Classification Scheme. An organization-specific data classification scheme.
- E-DCH-02 Data Handling Practices. An organization-specific data handling practices (e.g., guidance specific the data classification scheme).
- E-DCH-03 Network Diagram - Global System View (GSV). A high-level network diagram that provides a conceptual, logical depiction of the network(s) to describe the interconnections of the systems/applications/services, including internal and external interfaces.
- E-DCH-04 Network Diagram - Low Level. A low-level network diagram that provides a detailed, logical depiction of assets on the network(s).
- E-DCH-05 Data Flow Diagram (DFD). A data flow diagram (dfd) that accurately identifies where sensitive/regulated data is stored, transmitted and/or processed.
- E-RSK-03 Plan of Actions & Milestones (POA&M) / Risk Register. A poa&m, or risk register, that tracks control deficiencies from identification through remediation.
- E-TDA-14 System Security Plan (SSP). At least one (1) system security plan (ssp) that covers the sensitive/regulated data environment. there may be multiple ssps, based on applicable contracts.
- E-TDA-18 System Security Plan (SSP) Reviews. Reviews and/or updates to system security plan (ssp) documentation.
Alongside these, keep the System Security Plan (SSP) narrative for 03.04.11.
Timeline Considerations for NIST 800-171 R3 03.04.11
With all five (5) AOs net new, plan for real discovery work rather than a documentation refresh. A realistic sequence:
- Identify and document the location of CUI across the environment (A.03.04.11.a[01]), including email, file shares, endpoints, backups, and cloud services.
- Document the system components on which CUI is processed (A.03.04.11.a[02]) and, separately, those on which it is stored (A.03.04.11.a[03]).
- Establish a process to document changes to processing and storage locations (A.03.04.11.b[01] and b[02]).
- Align the CUI location map with your scoping decisions and with Information Flow Enforcement (03.01.03) and access controls.
- Collect evidence for all five (5) AOs, including the CUI location map and its change history.
Frequently Asked Questions About NIST 800-171 R3 03.04.11
How many assessment objectives does NIST 800-171 R3 03.04.11 have? NIST 800-171A R3 breaks 03.04.11 into five (5) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.04.11 come from? CM-12.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.04.11 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.04.11 sit in the NIST 800-171 R3 Kill Chain? Phase 3c, Establish The Compliance Scope for parts a; Phase 8, Segmented Network Architecture for parts b. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.04.11
03.04.11 Information Location identifies and documents where CUI is processed and stored and keeps that documentation current as locations change. It is net new for R3 with no R2 predecessor, so all five (5) assessment objectives are new work. The recurring problem is not knowing where CUI actually lives. Build a complete CUI location map that separates processing from storage, maintain it as things change, and use it to drive your scoping.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
