Below is the structure of a NIST SP 800-171 gap assessment report, written for an illustrative defense contractor. It is not a client report and contains no client data — it exists so you can see the depth and tone of the deliverable before engaging, rather than after.
Where CUI enters, rests and leaves, drawn as an actual data flow rather than a network diagram. Every system is listed in-boundary or out, with the reasoning recorded — because an assessor reads the reasoning, not just the conclusion.
All 14 families scored across the 110 practices, showing met, partially met, and not met. Partial is reported as partial rather than rounded in either direction; a practice half implemented is the most expensive kind to discover late.
Each finding names the artifact that is missing or insufficient — the log, the ticket, the configuration export, the signed record — rather than restating the control text back at you. A finding you cannot act on is a sentence, not a finding.
Gaps separated into must-fix-before-assessment and POA&M-eligible, with the conditions and closeout clock stated for the latter. Not everything inconvenient is deferrable, and that is better learned here.
The calculated score with the arithmetic shown — which practices cost which points, and what closing each gap would move it to. A score you cannot reconstruct is a number you cannot defend.
Ordered by what unblocks the most, not by control number. Boundary decisions first because they change what must be implemented at all, then implementation, then documentation, with evidence accumulating throughout.
C3PAO assessment preparation → · Sample SOC 2 gap assessment →
Tell us where CUI lives and what you have documented. You will get back a written view of your scope, the gaps that matter first, and a fixed fee before any work begins.
