Who needs to comply?

All contractors are obligated to comply with the NIST Cybersecurity Framework (CSF). For government agencies such as the DoD (Department of Defense), GSA (General Services Administration), and NASA (National Aeronautics and Space Administration), new NIST rules took effect in 2017 that require anyone who works with CUI from those agencies to implement specific security measures for the handling of data.