Defense subcontractors
You’ve received a flow-down of DFARS 252.204-7012 and a request for your SPRS score. You need a score you can stand behind and a plan for the requirements you haven’t met yet.
Government & defense
NIST SP 800-171 readiness assessment
Your contract includes DFARS 252.204-7012, your prime wants a current SPRS score, and someone has to sign off on a number a government assessor could check. Readiness gives you an honest score, a System Security Plan that matches your environment and a plan of action for what’s still open, so the score you post is one you can defend and the foundation you build carries straight into CMMC.
Formal outcome from
No certificate exists for NIST SP 800-171 itself — your Basic Assessment is your own; DCMA’s DIBCAC performs Medium and High Assessments, and CMMC Level 2 certification comes from a C3PAO
Who asks for it
DoD contracting officers · Prime contractors flowing down DFARS 252.204-7012
Our role
Readiness — we help you build it and prove it
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why NIST SP 800-171 lands on your desk.
NIST Special Publication 800-171 sets the requirements for protecting the confidentiality of Controlled Unclassified Information when it lives in nonfederal systems — your laptops, file servers, ERP, engineering tools and cloud tenants. For defense contractors it isn’t optional. DFARS 252.204-7012 makes it the definition of adequate security for covered defense information, adds rapid reporting of cyber incidents to the DoD, requires preserving images of affected systems, and obliges you to flow the clause down to subcontractors that handle CUI. Under the NARA CUI program in 32 CFR Part 2002, civilian agencies point to the same publication for nonfederal systems.
DFARS 252.204-7019 and 252.204-7020 add accountability. Before award, you need a current assessment score in SPRS. A Basic Assessment is your own self-assessment using the DoD Assessment Methodology, which starts at 110 points and subtracts a weighted value for every requirement not fully implemented — so a score can fall below zero. The DoD can follow up with a Medium or High Assessment by DCMA’s DIBCAC, which reviews your documentation and then examines your implementation.
NIST published Rev 3 in 2024, restructuring the requirements and introducing organization-defined parameters, but the DoD has kept its contracts on Rev 2 for now through a class deviation, and CMMC Level 2 assesses against Rev 2. Teams come to readiness because the same 110 requirements now drive a posted score, a contract clause and, for most CUI work, a CMMC certification assessment — and the SSP and POA&M are the documents every one of those reviews asks for first.
Who asks for it
DoD contracting officersPrime contractors flowing down DFARS 252.204-7012DCMA’s DIBCACCivilian agencies sharing CUIUniversity research sponsors
Manufacturers and engineering firms
Drawings, specifications and CAD files marked as controlled technical information move between your engineers, your shop floor and your suppliers. You need to know where that data goes and how to protect it without halting production.
Universities and research organizations
Sponsored research brings CUI into a decentralized environment built for openness. You need a defined system boundary for the projects that carry CUI and controls your researchers will actually follow.
Companies laying the foundation for CMMC
NIST SP 800-171 is the content of CMMC Level 2. Getting it right now means your eventual certification assessment checks work you’ve already done instead of exposing work you skipped.
Who certifies
No certificate exists. The proof is yours to build.
Formal outcome from
No certificate exists for NIST SP 800-171 itself — your Basic Assessment is your own; DCMA’s DIBCAC performs Medium and High Assessments, and CMMC Level 2 certification comes from a C3PAO
What they produce
A current NIST SP 800-171 DoD Assessment score in SPRS, and for most CUI contracts a CMMC Level 2 status
Where readiness fits
Readiness gives you the evidence behind the score you post and the documents DIBCAC or a C3PAO will ask for first. The score is yours to submit, and the assessment is theirs to perform.
NIST SP 800-171 Rev 2 NIST SP 800-171A NIST SP 800-171 Rev 3 and NIST SP 800-171A Rev 3 DFARS 252.204-7012 DFARS 252.204-7019 DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Methodology 32 CFR Part 2002 (CUI Program) NARA CUI Registry FAR 52.204-21
What it covers
What NIST SP 800-171 readiness covers.
- CUI identification and marking against the CUI Registry, including controlled technical information and export-controlled data
- Data flow mapping for CUI across email, file shares, engineering tools, ERP, endpoints and suppliers
- Definition of the system boundary that processes, stores or transmits CUI
- Gap assessment against all 110 Rev 2 requirements across the 14 families, tested at the NIST SP 800-171A assessment-objective level
- Basic Assessment scoring under the DoD Assessment Methodology, including the few requirements where the methodology allows partial credit
- The System Security Plan that requirement 3.12.4 calls for
- Plans of action under requirement 3.12.2, with owners and milestones
- DFARS 252.204-7012 duties: rapid incident reporting, image preservation, malicious software submission and the DoD-approved medium assurance certificate needed to report
- Cloud services that hold CUI and the FedRAMP Moderate equivalency requirement
- Flow-down of DFARS clauses to subcontractors and verification of their scores
- Identification and authentication, including multifactor authentication and FIPS-validated cryptography
- Audit logging, configuration baselines and vulnerability management evidence
- Rev 3 change analysis, so the work you do now carries forward
What you receive
What you have in hand when readiness is done.
CUI data flow map
A diagram of where CUI enters, moves, rests and leaves your organization, including the suppliers and cloud services it touches.
Requirement-by-requirement gap assessment
Each of the 110 requirements and its assessment objectives marked met, partially met or not met, with the evidence behind each conclusion.
SPRS score worksheet
Your score calculated with the DoD Assessment Methodology, showing the weight of each open requirement so you can see exactly what moves the number.
System Security Plan
An SSP that describes your system boundary, environment, interconnections and how each requirement is implemented — the document every reviewer starts with.
Plan of Action and Milestones
Every open requirement with a remediation approach, an owner and milestones, prioritized by score weight and real risk to CUI.
Policies and procedures
Written policies and procedures for the families that require them, matched to the way your teams actually operate.
Incident reporting procedure
A procedure for meeting the DFARS 252.204-7012 reporting and preservation duties, including what to report, who reports it and what to keep.
Subcontractor flow-down package
Clause language, a supplier questionnaire and a tracking approach so you know which subcontractors receive CUI and whether they hold a current score.
Common gaps
What a NIST SP 800-171 readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
No System Security Plan at all — and without one, the DoD Assessment Methodology treats the assessment as one that can’t be completed
A posted score that predates your current systems and was never revisited
CUI leaving the boundary through ordinary email to suppliers or unmanaged file-sharing links
Cloud email or storage holding CUI without FedRAMP Moderate authorization or documented equivalency
No way to report a cyber incident to the DoD, because nobody obtained the medium assurance certificate the reporting portal requires
Requirements scored as met when they’re only partly implemented, such as multifactor authentication on remote access but not on privileged local access
Subcontractors receiving CUI with no flow-down of DFARS 252.204-7012 and no visibility into their scores
Plans of action with no owners, no milestones and no evidence of progress
Where testing fits
The tests NIST SP 800-171 calls for, from the same team.
Vulnerability assessment
Requirement 3.11.2 calls for scanning for vulnerabilities periodically and when new ones are identified, and 3.11.3 for remediating them according to risk.
What the test coversInternal network pentest
Requirement 3.12.1 asks you to periodically assess whether your controls are effective. An internal test answers that directly for access control and least privilege around CUI.
What the test coversNetwork segmentation test
Requirements 3.13.1 and 3.13.5 cover boundary protection and separating publicly accessible components; a segmentation test proves the CUI boundary you drew actually holds.
What the test coversExternal network pentest
Your internet-facing systems are where attackers start. Testing them gives you boundary protection evidence and findings to close before they become incidents you have to report.
What the test coversCloud configuration review
When CUI lives in a cloud tenant, the provider’s authorization covers its side only. A configuration review checks the settings you control against the requirements you claim.
What the test covers Questions
What buyers ask about NIST SP 800-171.
Is there a NIST SP 800-171 certification?
No. NIST publishes the requirements; it doesn’t certify anyone. What exists is your own Basic Assessment score posted in SPRS, the possibility of a Medium or High Assessment by DIBCAC and, for most CUI contracts, a CMMC Level 2 certification assessment by a C3PAO. Anyone offering a “NIST SP 800-171 certificate” is selling something the program doesn’t recognize.
How is NIST SP 800-171 different from CMMC?
NIST SP 800-171 is the set of requirements. DFARS 252.204-7012 obliges you to implement them, and 7019 and 7020 oblige you to score yourself. CMMC is the verification program layered on top: at Level 2 it checks the same 110 requirements and adds independent assessment and affirmation by a senior official. Do the NIST SP 800-171 work well and CMMC becomes a matter of proving it.
Should we implement Rev 2 or Rev 3?
For DoD contracts, Rev 2 — that’s what the DFARS class deviation and CMMC Level 2 reference today. Rev 3 reorganizes the requirements and adds organization-defined parameters, so a readiness review notes where Rev 3 differs. That way the decisions you make now don’t have to be unmade when the DoD moves.
What happens if our score is low, or even negative?
A low score is a fact to manage, not a reason to inflate the number. Contracting officers and primes see your posted score, and CMMC Level 2 conditional status requires a minimum score you’ll eventually need to reach. An inaccurate score is the bigger risk: the DoD and the Justice Department treat misrepresented cybersecurity compliance as potential False Claims Act fraud. Readiness gives you the honest number and the fastest credible path to raise it.
Do our subcontractors need to meet it too?
Yes, if they receive or create covered defense information. DFARS 252.204-7012 must be flowed down to them, and DFARS 252.204-7020 says you shouldn’t award a subcontract that carries it unless the subcontractor has a current assessment on record. Readiness includes the flow-down language and a way to track supplier status.
Our CUI lives in a commercial cloud suite. Doesn’t the provider cover us?
Only partly. The provider has to be FedRAMP Moderate authorized or equivalent, but you still own accounts, multifactor authentication, logging, device management, sharing settings and the endpoints that sync the data. Readiness separates what you inherit from what you have to do yourself, and documents both in the SSP.
Is NIST SP 800-171 on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.