NIST 800-171 & DFARS Compliance Consulting

What Is NIST SP 800-171?

NIST SP 800-171 is a set of 110 security requirements, organized into 14 families, for protecting Controlled Unclassified Information in non-federal systems — such as the networks of defense contractors and subcontractors. It covers areas including access control, identification and authentication, audit logging, configuration management, incident response, media protection, and system and communications protection.

For defense contractors, NIST SP 800-171 is not optional guidance. It’s required by contract through DFARS 252.204-7012, and it is the basis of CMMC Level 2.

The Three DFARS Clauses You Need to Know

Bottom line: if you have 7012 in your contract and handle CUI, you’re responsible for NIST SP 800-171 today — and primes increasingly ask for your SPRS score before awarding subcontracts.

Your SPRS Score, Explained

Your SPRS score is the result of your NIST SP 800-171 self-assessment, calculated with the DoD Assessment Methodology and posted in the Supplier Performance Risk System.

• You start at 110 — one point for every requirement.
• Each requirement not fully implemented subtracts 1, 3, or 5 points, depending on its security impact.
• Scores range from −203 to 110. Many small contractors who score themselves carefully for the first time land well below zero.
• A score is only as good as the evidence behind it. An inflated score that doesn’t hold up under a DoD (DIBCAC) assessment creates contract and legal risk — including False Claims Act exposure.

We calculate your score from evidence, explain every deduction, and show you which fixes raise it fastest.

Our NIST 800-171 Gap Assessment

Included in our CMMC Readiness Review — from $7,500.

What Small Contractors Most Often Get Wrong

1. No System Security Plan. An SSP is itself a NIST SP 800-171 requirement — without one, you can’t complete a valid assessment. SSP & POA&M Support →
2. Scoping the whole company. Defining a smaller CUI environment (an “enclave”) can dramatically reduce cost and effort. Scoping is the highest-leverage decision in the whole project.
3. Treating “partially implemented” as implemented. DoD scoring gives no partial credit for most requirements.
4. Missing multi-factor authentication and FIPS-validated encryption. Both are high-value, frequently missed requirements.
5. Assuming the cloud provider covers it. Cloud services that store CUI must meet FedRAMP Moderate or equivalent requirements — and you still own your configuration.
6. Posting a score and never updating it. Anything you record in SPRS must reflect reality and stay current as your environment changes.

NIST 800-171 Rev. 2 vs. Rev. 3

NIST published Revision 3 of SP 800-171 in May 2024, reorganizing the requirements into 97 requirements across 17 families. However, DoD has directed that Revision 2 remains the version required for DFARS 252.204-7012 and CMMC Level 2 until further notice. We assess against Rev. 2 for compliance purposes and note where Rev. 3 changes are worth planning for.

How We Work

1. Scoping call (30 minutes, free). Your contracts, DFARS clauses, CUI, systems, and IT support model. Written scope and price follow.
2. Define the CUI boundary. Where CUI is received, stored, processed, and transmitted — and what can be kept out of scope.
3. Assess. All 110 requirements, evidence-based.
4. Score and prioritize. Your SPRS score with a roadmap ranked by points recovered, risk reduced, and cost.
5. Support remediation. SSP and POA&M development, policy work, MSP coordination, and ongoing advisory as a project or vCISO engagement.

Important: USCIBER provides NIST SP 800-171 and CMMC readiness consulting. We are not a C3PAO, do not perform official CMMC certification assessments, and do not submit SPRS scores on your behalf — your organization remains responsible for the accuracy of its affirmations.

Frequently Asked Questions

Who needs to comply with NIST SP 800-171?

Any contractor or subcontractor whose defense contract includes DFARS 252.204-7012 and who processes, stores, or transmits Controlled Unclassified Information. Contractors that handle only Federal Contract Information generally fall under the 15 basic requirements of FAR 52.204-21 (CMMC Level 1) instead.

What is a good SPRS score?

110 means every requirement is fully implemented. There is no official “passing” score for posting in SPRS, but CMMC Level 2 conditional status requires at least 88, with remaining gaps closed within 180 days. The most important thing is that your score is accurate and supported by evidence.

How is NIST 800-171 different from CMMC?

NIST SP 800-171 defines the security requirements. CMMC is the DoD program that verifies contractors have implemented them. CMMC Level 2 uses the same 110 requirements of NIST SP 800-171 Rev. 2.

How much does NIST 800-171 compliance cost?

Our gap assessment, delivered as part of the CMMC Readiness Review, starts at $7,500 for smaller organizations. SSP and POA&M documentation is scoped after a call. Remediation costs — such as MFA, logging, or encryption tools — depend on your gaps and environment and are separate.

Can we do the self-assessment ourselves?

Yes, and many contractors do. The risk is an inaccurate score: optimistic self-scoring is common, and an unsupported score can create contractual and False Claims Act exposure. An independent gap assessment gives you a defensible baseline.

Does NIST 800-171 Rev. 3 apply to us?

Not yet for DFARS 7012 or CMMC purposes. DoD currently requires Rev. 2. We’ll flag Rev. 3 changes worth preparing for.

What happens if we have a cyber incident?

DFARS 252.204-7012 requires reporting to DoD within 72 hours, preserving system images for 90 days, and cooperating with DoD’s damage assessment. Your incident response plan should cover this before an incident happens.

Know Your Real Score

Book a 30-minute scoping call. We’ll review your contract obligations, outline the gap assessment, and send a written scope and price — usually within one business day.