NIST SP 800-171

NIST 800-171 Compliance, Honestly
SCORED

All 110 controls across 14 families, implemented, documented, and reflected in an SPRS score you can defend when a prime asks to see it.

Talk to a Compliance Expert ↗ Get My Free Assessment ↗

WHERE CONTRACTS ARE LOST

The Gaps That Sink an 800-171 Score

Self assessment is honest work done by people who have never been assessed. These are the seven findings that turn a comfortable score into a problem, and they are the ones a prime's review finds first. The framework sits inside our wider IT compliance services, and the standard itself is public reading.

The gaps we find most often:

No written System Security Plan, so nothing can be verified
CUI sitting in email and shared drives nobody has mapped
Multifactor authentication missing on remote and privileged access
Audit logs that exist but that nobody reviews

An incident response plan with no record of it being tested
Subcontractors handling CUI with no flow down in place
An SPRS score filed years ago and never reassessed

Talk to a Compliance Expert Get My Free Assessment

Stay Eligible to Bid

A score you can defend keeps you on the list. It also keeps your primes from quietly routing work to a supplier whose paperwork is cleaner than yours.

Do the Work Once

CMMC Level 2 assesses the same 110 controls. Implementing them properly now is the CMMC preparation, not a separate project you pay for twice.

Answer in Hours, Not Weeks

A current System Security Plan and a monitored control set mean a prime's security questionnaire is a lookup rather than a fire drill across three departments.

Talk to a Compliance Expert

THE CONTROL SET

110 Controls, 14 Families, Six Pieces of Work

NIST SP 800-171 organizes its 110 requirements into 14 control families. Grouped the way they actually get worked, they become six workstreams, and all 14 families are accounted for below, once each.

NIST SP 800-171 is the control set.CMMC 2.0is how the Department of Defense verifies you meet it. If you hold a DoD contract you need both: the controls from 800-171 and the assessment route from CMMC. If your contract names a CMMC level, start on ourCMMC compliance pageinstead.

The 14 family names and the 110 count are published facts about a public standard, also published by ITS in "What is NIST 800-171?". The six groupings are editorial.

Find Out Where CUI Lives

Before anything else we map what you hold, where it sits and who can reach it. Most scoping surprises are found here.

Covers media protection and physical protection.

Control Who Gets In

Least privilege access, multifactor authentication, and identity rules that hold up when somebody leaves on a Friday.

Covers access control and identification and authentication.

Harden and Maintain Systems

Baseline configurations, change control, patching, and encrypted boundaries between your network and everything else.

Covers configuration management, maintenance, and system and communications protection.

Log It, Then Read the Logs

Audit records that capture the right events, plus somebody whose job is actually reviewing them and acting on what they show.

Covers audit and accountability, and system and information integrity.

Train and Vet Your People

Screening, role based awareness training, and the phishing practice that closes the gap no technical control covers.

Covers awareness and training, and personnel security.

Assess, Respond, Prove It

Risk and control assessments on a schedule, a tested incident response plan, and the evidence trail that shows both happened.

Covers risk assessment, security assessment and incident response.

HOW TO START

Three Steps to a Score You Can Defend

Scope, then an honest number, then the work. You can stop after any step.

Scope the CUI

We work out what Controlled Unclassified Information you actually hold and where it moves. Scope decides cost, so getting it wrong is the most expensive mistake available.

Talk to a Compliance Expert

CLIENT RESULTS

What Clients Say About Working With Us

Two ITS clients who had to answer to somebody else's security requirements. Neither is a defense supplier, and this section does not claim 800-171 or CMMC experience.

ITS led significant, transformational changes at Eastern Plumas Health Care to ensure we weren’t susceptible to attacks. Looking back, prior to that partnership, we had a lot of risks on campus. I’m glad nothing happened, but I’m even more proud that after implementing those systems, we’ve avoided data breaches and HIPAA violations throughout our five-year partnership.

Doug McCoy CEO of Eastern Plumas Health Care (EPHC)

FAQ

What Defense Suppliers Ask Us First

1. What is NIST 800-171, and who has to comply?

NIST SP 800-171 is a security standard published by the National Institute of Standards and Technology. It sets 110 requirements, organized into 14 control families, for protectingControlled Unclassified Informationon systems you own and run. If you handle CUI on behalf of a federal agency, it applies to you. That means defense contractors and their subcontractors, and also state and local government, universities holding federal research data, and financial institutions handling agency data. DFARS 252.204-7012 is the contract clause that makes it a requirement for Department of Defense work.

Source: ITS, "What is NIST 800-171?", published 2024-09-03, quoting Sean Harris.

2. Is NIST 800-171 the same thing as CMMC?

No, and the difference decides what you actually have to do. NIST SP 800-171 is the control set. CMMC 2.0 is how the Department of Defense verifies you meet it. If you hold a DoD contract you need both: the controls from 800-171 and the assessment route from CMMC. Get 800-171 right and a CMMC assessment becomes a review rather than a rebuild. The side by side is CMMC and NIST 800-171 compared, which is where that answer lives.

3. What is an SPRS score, and how is it calculated?

Your SPRS score is your 800-171 self assessment expressed as a number and submitted to the Department of Defense's Supplier Performance Risk System. You start at negative 203 and earn points back for each requirement you have met: five points for a fully implemented control, three for partial, one for minimal. A perfect score is 110. Because you grade yourself, the score is only as good as your reading of the requirements, which is why an outside gap assessment so often moves it. We have written uphow to report it.

Source: ITS, "How to Report Your SPRS Score", December 2024, quoting Sean Harris, and the Department of Defense NIST SP 800-171 Assessment Methodology.

4. Can we self-assess, or do we need someone else to do it?

For 800-171 on its own, you self assess. That is how the framework works, and it is also its weakness, because nobody checks your interpretation until a prime or the government does. Sean Harris of ITS put the risk plainly in our own SPRS guide: "We had a client that originally self-assessed with a score of 88, but after doing a thorough gap assessment, we found they were actually at negative 30." If your contract requires CMMC Level 2, an authorized third party assesses you instead.

Sean Harris of ITS, quoted in "How to Report Your SPRS Score", December 2024.

5. What does ITS actually do, and what does it not do?

Three things. We scope where your CUI lives, we assess all 110 controls against evidence and give you the honest score, and then we implement and operate the controls that close the gaps: access, multifactor authentication, logging, patching, backup, awareness training and incident response. We keep the System Security Plan and plan of action current as part of that work. What ITS is not: an assessor, an accredited certification body, or a Certified Third Party Assessment Organization. Those have to be independent of the people running your controls. If cost is the question, how our pricing works is public.

6. We are a small supplier three tiers down. Does this really apply to us?

Usually yes, and the clause is why. DFARS 252.204-7012 requires the prime contractor to flow the same safeguarding requirements down to any subcontractor that will handle Controlled Unclassified Information. So the obligation tends to arrive in a purchase order rather than a letter from the government, and being small does not remove it. If you are not certain whether what you receive counts as CUI, that is the first thing a scoping conversation settles, and it is cheaper to settle before you sign.

NIST 800-171 Compliance, Honestly
SCORED

The Gaps That Sink an 800-171 Score

What Getting This Right Buys You