NIST SP 800-171 compliance
NIST SP 800-171 compliance for defense contractors
NIST SP 800-171 is the 110-control framework that CMMC Level 2 sits on top of. If your organization handles CUI under a DoD contract, compliance is not optional — it is a contract requirement under DFARS 252.204-7012. The question is not whether to comply. The question is whether your current program holds up when an assessor reviews it.
What NIST SP 800-171 compliance actually requires
The 110 controls span 17 families — Access Control, Configuration Management, Incident Response, and 14 others. Full implementation requires documented processes, evidence of implementation, owner assignment, and a System Security Plan that ties it all together. This is an operational commitment, not a documentation project.
Multi-framework GRC platforms optimize for breadth — SOC 2, ISO 27001, HIPAA, and CMMC in one interface. None of those frameworks get the depth they need, and CMMC gets it least. A contractor we worked with spent a year on an enterprise GRC platform where the CMMC module was a checkbox tree with no concept of evidence-to-control mapping at 800-171 depth. They were paying enterprise prices and still doing the actual CMMC work in a spreadsheet next to the tool. Purpose-built tooling for NIST SP 800-171 is not a preference — it is a practical requirement for programs that actually need to pass an assessment.
Working through the 110 controls without losing the program
Three columns per control: the control ID, your current status (met, partial, or not met), and whatever evidence exists right now. Work domain by domain. The two most common stall points are scope that keeps expanding — add a system, add 22 more Access Control controls — and "partial" that never moves to "met."
The rule of thumb for partial: if you cannot name the specific gap and the specific person closing it, the control is not partial — it is not met. Partial means work is genuinely in progress with an owner and a close date. Everything else is not met with an optimistic label.
The CMMC gap assessment service provides the structured approach for this process — control-by-control status review, SPRS impact scoring, and POA&M sequencing so the remediation work actually moves.
SPRS scoring: what your number means and how to move it
Every open NIST SP 800-171 control has a point value — 1, 3, or 5 points depending on severity. Subtract the total point value of your open controls from 110. That is your SPRS score. DFARS 252.204-7019 requires you to report it accurately. A deeply negative score is not disqualifying — primes cannot drop you solely for a negative SPRS score — but it is visible. Contracting officers and primes can see it.
The practical path to improving it: close the high-point-value gaps first. A few well-closed 5-point controls move the number more than fifteen 1-point fixes. The NIST SP 800-171 Rev 2 scoring values are in Appendix E.
Where most 800-171 programs stall
Ownership ambiguity. Controls with two owners fail at the same rate as controls with no owners — because each owner assumed the other was driving it. Name a single owner per control, in writing, with a date they agreed to. Put it in the SSP. Put it in the POA&M.
When stalled programs call, nine out of ten trace back to this. The controls are implementable. The technology is not the problem. Nobody was responsible for actually implementing them, and when nobody is responsible, nothing moves.
Straight answers
What is the difference between NIST SP 800-171 and CMMC?
NIST SP 800-171 is the control framework — 110 requirements for protecting CUI. CMMC is the certification program that uses those 110 controls as its Level 2 baseline. Complying with NIST SP 800-171 is the substance of CMMC Level 2. The CMMC process adds the formal assessment and certification layer on top.
Do I need to self-attest or get a C3PAO assessment for CMMC Level 2?
Most defense contractors with CUI handling obligations will need a C3PAO third-party assessment under CMMC Phase 2 requirements. Self-attestation at Level 2 applies to a narrower set of contracts. Read your DFARS clauses — 252.204-7019, 7020, and 7021 — and confirm with your prime or contracting officer which path applies to you. Do not rely on a consultant's interpretation of your clauses. Read them yourself.
How long does NIST SP 800-171 compliance take?
A realistic first implementation for a 25–200 person DIB company takes 9–18 months from gap assessment to C3PAO-ready. Programs at the low end of that range started early, had clear ownership, and treated it as an operating activity rather than a project. Programs at the high end discovered scope problems or ownership gaps mid-program.
What is an SPRS score and what should it be?
SPRS (Supplier Performance Risk System) is where you report your NIST SP 800-171 self-assessment score. A perfect score is 110. Most first assessments are significantly lower. There is no minimum score required to hold a DoD contract, but your score is visible to primes and contracting officers. A credible negative score with a real POA&M is better than an optimistic positive score that does not reflect your actual state.
Purpose-built for NIST SP 800-171.
Join early access to Sentinel — built for NIST SP 800-171 and CMMC Level 2 depth, not another multi-framework checkbox tool.
Join early access →