Access & identity
Access Control, Identification & Authentication. The largest family by count, and where most scoping decisions ultimately land.
NIST SP 800-171
NIST SP 800-171 — 110 requirements, scoped to the environment you actually run.
NIST SP 800-171 is the control set behind DFARS 252.204-7012 and CMMC Level 2. It is not a product you buy or a box you tick: it is 110 security requirements across 14 families, and most of the work is deciding which systems they apply to before implementing anything. Cyberneza scopes that boundary, implements the requirements, and builds the evidence an assessor expects.
Reply within one business day.
When 800-171 applies to you
- Your contract carries DFARS 252.204-7012, or a prime has flowed it down to you.
- You store, process, or transmit Controlled Unclassified Information (CUI).
- You need a current SPRS score on file to remain eligible for DoD awards.
- You are working toward CMMC Level 2, which assesses these same 110 requirements.
What people get wrong first
- Treating it as an IT project. Roughly a third of the requirements are policy, process, and training.
- Scoping the whole company when only a handful of systems touch CUI.
- Writing an SSP that describes an intended environment rather than the running one.
- Buying tooling before the boundary is drawn, then paying to license systems that were never in scope.
The standard
14 requirement families
The 110 requirements are grouped into fourteen families. They are published and public — the difficulty is never finding them, it is evidencing them consistently across a real environment.
People & awareness
Awareness & Training, Personnel Security. Requirements that no tool satisfies on your behalf.
Operations
Audit & Accountability, Configuration Management, Maintenance, Media Protection.
Response & recovery
Incident Response, including the reporting obligations DFARS attaches to it.
Assurance
Risk Assessment, Security Assessment, System & Information Integrity.
Environment
Physical Protection, System & Communications Protection — including the boundary itself.
What we do
800-171 compliance support
Milestone-based and scoped to where you stand today. The right first move depends heavily on whether a boundary already exists.
CUI boundary scoping
Establish where CUI actually lives and define a defensible assessment boundary — the decision that determines the cost of everything downstream.
Gap assessment against the 110
Assess current implementation requirement by requirement and produce a written report with findings, severity, and a sequenced remediation path. See a sample report →
Control implementation
Close the gaps that matter, aligned to how your environment actually runs rather than to a generic reference architecture.
Documentation & evidence
System Security Plan, POA&M, and the operating records that show a requirement is met in practice. SSP, POA&M & SPRS support →
SPRS self-assessment support
Help you score your implementation accurately and defensibly. Your organization performs and submits the self-assessment; we help you get it right.
Scope reduction
Where CUI handling can be confined to an encrypted enclave, the boundary — and the bill — shrinks. GCC High & enclave planning →
The assessment
The NIST 800-171 assessment: Basic, Medium and High
Most searches for “NIST 800-171 assessment” are really asking three questions: who assesses it, how the score works, and what has to exist before you can post one. The DoD Assessment Methodology (v1.2.1) defines three confidence levels for the same 110 requirements.
Basic — self-assessment
Performed by the contractor against its own System Security Plan and posted in SPRS. Required under DFARS 252.204-7019 to be eligible for award, and valid for three years. Low confidence by definition — it is your word — which is why DoD reserves the right to check it. How SPRS works →
Medium — DoD document review
Performed by DCMA’s DIBCAC under 252.204-7020: a review of the SSP and supporting documentation, with discussion, to confirm the Basic score is supportable. An SSP that describes an intended environment rather than the running one is where Medium assessments go wrong.
High — on-site verification
DIBCAC verifies the implementation itself: examining systems, testing controls and interviewing staff. The methodology, the weights and the 110 requirements are identical to the Basic level; the difference is that nothing is taken on trust.
How the score works
- Start at 110. Subtract for each requirement not fully implemented.
- 42 requirements carry a 5-point deduction, 14 carry 3 points, the remaining 54 carry 1 point.
- Partial credit exists for exactly two: MFA (3.5.3) and FIPS-validated cryptography (3.13.11).
- The floor is −203. A score is a count of what is missing, weighted by how much it matters.
- Open items go on a dated POA&M in the SSP; the score posted reflects them as open.
What must exist before you can post a score
- A defined assessment boundary — which systems are covered and which are not. CUI boundary definition →
- A System Security Plan that describes that boundary and how each of the 110 is implemented in it.
- A POA&M for every requirement scored as not implemented, with an owner and a date.
- An SPRS account through PIEE, and someone with the role to post the score.
- Evidence for the implemented requirements — not for the Basic submission itself, but for the day the score is checked.
Gap assessment
What a NIST 800-171 gap assessment delivers
A gap assessment is the work that makes the score you post defensible: a requirement-by-requirement review of what is actually implemented, with evidence, before anyone outside the organization asks. It is a fixed-fee engagement, and the report has a fixed shape.
Boundary confirmation
The covered system, its components, the CUI flows through it, and what sits outside — written down so every finding has a scope.
Requirement-by-requirement status
Each of the 110 scored as implemented, partially implemented, not implemented or not applicable, with the DoD methodology weight beside it.
Evidence inventory
What evidence exists for each implemented requirement, where it lives, and which requirements are met in practice but undocumented — the cheapest findings to close.
Projected SPRS score
The score the current environment supports, and the score each remediation phase reaches, so leadership can see the distance to 110 in points rather than adjectives.
Sequenced remediation roadmap
Findings ordered by weight, dependency and effort — 5-point items first, quick documentation wins alongside — with POA&M entries drafted for what stays open.
SSP inputs
The control narratives, boundary description and inventory the System Security Plan needs, written from what the assessment found rather than from a template.
800-171 and CMMC are not the same thing
NIST SP 800-171 is the standard — the 110 requirements themselves. CMMC is the verification program the Department of Defense uses to check that they are met. Level 2 assesses the same 110 requirements; what CMMC adds is who verifies them and how often. You can be compliant with 800-171 and not yet certified under CMMC.
A note on revisions
NIST published Revision 3 of SP 800-171 in May 2024, restructuring the requirements and introducing organization-defined parameters. DoD contract clauses continue to reference the revision named in the clause, so read your contract before assuming which revision applies to you — the answer is a contractual question, not a technical one, and getting it wrong changes what you are assessed against.
Who does the work
Experience-backed, not checklist-delivered
You work directly with a Cyber AB Registered Practitioner (CPN 76768) who has implemented NIST 800-53 control families and run RMF lifecycle activities in production federal environments, backed by a network of specialist partners for specialized needs. Much of the small-contractor 800-171 market is sold by large integrators and delivered by junior staff working from a template.
FAQ
NIST 800-171 assessment: common questions
How is the NIST 800-171 SPRS score calculated?
Start at 110 and subtract for every requirement not fully implemented, using the DoD Assessment Methodology weights: 42 requirements carry 5 points, 14 carry 3 points and the rest carry 1. Two requirements — multifactor authentication (3.5.3) and FIPS-validated cryptography (3.13.11) — allow partial credit. The lowest possible score is −203. The score is a measure of what is not done, which is why a POA&M full of 5-point items reads very differently from one full of 1-point items.
Is a self-assessment enough, or do we need a third party?
It depends on the clause in the contract. DFARS 252.204-7019 requires a current Basic (self) assessment posted in SPRS to be eligible for award. DFARS 252.204-7020 lets DoD perform a Medium or High assessment of that score at its discretion. CMMC Level 2 adds a defined cycle: a self-assessment every three years with an annual affirmation for some contracts, and a C3PAO certification assessment for others, decided by the solicitation. The 110 requirements are the same in every case; what changes is who checks and how often.
What is the difference between a gap assessment and the Basic assessment?
The Basic assessment is the score you post in SPRS: your own statement, under the DoD methodology, of which requirements are met. A gap assessment is the work that makes that statement defensible — a requirement-by-requirement review of what is actually implemented, with evidence, so the score you post is one you can support when DCMA or a C3PAO looks. Cyberneza performs the gap assessment; your organization performs and submits the Basic assessment.
Which revision of NIST 800-171 applies to us, Revision 2 or Revision 3?
Whichever one your contract clause names. Revision 3, published in May 2024, reorganizes the standard into 97 requirements across 17 families and introduces organization-defined parameters. DoD contract clauses and the CMMC rule continue to reference the revision they incorporate, so the answer is contractual rather than technical. Assessing against the wrong revision produces a score nobody can use.
How long does a NIST 800-171 gap assessment take?
For a single-entity environment with a defined boundary, a control-by-control assessment is typically a matter of weeks, with the interviews and evidence requests concentrated in the first part. Two things stretch it: an undefined boundary, which has to be settled before the 110 can be assessed meaningfully, and evidence that exists only in people's heads. The CUI boundary definition engagement exists precisely to take the first of those off the critical path.
Can every open requirement just go on the POA&M?
Not under CMMC. A Level 2 conditional certification requires a score of at least 88 out of 110 and limits which requirements may remain open — the highest-weight items cannot sit on a POA&M — and the open items must be closed within 180 days or the conditional status lapses. Under 7012 and 7019 alone the POA&M is more forgiving, but the score still has to be accurate, and DoD can assess it. Treat the POA&M as a dated closure plan, not a parking lot.
Do we need a System Security Plan before the assessment?
Yes, in substance. The Basic assessment is an assessment of the SSP — the methodology scores the requirements as the SSP describes them — and 7012 requires one. A gap assessment can start without a finished SSP and produce the inputs for it, but a score cannot be posted in SPRS without a plan that describes the covered system, its boundary and how each requirement is implemented.
Start with the boundary
Tell us about your contract, where CUI lands today, and your timeline. We will tell you honestly where you stand and what the realistic sequence looks like.
- Cyber AB Registered Practitioner · CPN 76768
- SBA-Certified Veteran-Owned Small Business (VOSB)
- UEI: T97XZHE7C5D5 · CAGE: 1AVJ5
- Related: DFARS 252.204-7012 →
- Documentation: SSP, POA&M & SPRS →
- Assessment: C3PAO preparation →