CMMC and NIST 800-171, while very similar, are different frameworks. The current DFARS clause requires compliance with NIST 800-171, not CMMC. They’re different frameworks that require different documentation. When you enter your information into the SPRS it is asking for a score of your NIST assessment as well as whether or not you have a NIST System Security Plan. Also, it’s good practice to get compliant with NIST first as it is the current requirement but also because as you work your way through NIST, you are also working towards CMMC L2 certification (being that you can map the 110 controls in NIST to CMMC L2).

NIST 800-171 is the current requirement in contracts containing the DFARS clause 252.204-7012. CMMC is positioned to start replacing NIST 800-171 in contracts as soon as an official rule is made.

CMMC contains 3 levels of certification ranging from “basic cyber hygiene” to “advanced”. NIST 800-171 is comparable to CMMC Level 2, as far as the requirements go. All 110 controls for NIST 800-171 can be found in CMMC Level 2. Essentially, if you are 100 percent implemented on NIST 800-171 then you are a good bit of the way done with CMMC Level 2.

You’ll need to conduct a basic assessment of NIST 800-171. This will require you to answer implemented, not implemented, or partially implemented to each of the 110 requirements. You’ll then need to score those answers against the DoD scoring algorithm. Each requirement is weighted separately. The lowest score you can have is -203 with the highest being 110.

There is no failing score and there is no passing score. The only requirement that hints at failing is the requirement to produce a System Security Plan. If you do not have a System Security Plan created, then you will have to enter a score of Not Available (not technically failing but certainly not complying). So, in order to comply with NIST 800-171 you’ll need your SPRS score, a System Security Plan and a Plan of Action and Milestones.

First, you’ll need to identify what CUI or FCI you are receiving from the DoD or prime. This will help you to “scope” your environment out. This, often, is easier said than done. You may need to consult with your contracting officer or prime contractor to properly identify this sensitive information.

Debatably, scoping is the next step in the NIST process. Identify the IT systems that need to be assessed. It is possible your network is split up into different sections. Maybe your office computers are on an entirely different network than your production or manufacturing servers (where the CUI is processed). If so, you may be able to focus your assessment on the production servers exclusively.

Once you’ve “scoped” out the environment(s) (or system) that needs assessed, you’ll need to complete a gap assessment of that environment(s). Start by working your way through each of the requirements, one by one. The requirements are identified in Section 3 of NIST 800-171. They’re broken down into 14 families. Read the requirement, consider your environment, and work out a response. If the requirement is implemented, you’ll need to document how you’ve implemented it. If it is “Not Implemented” you’ll need to create plans on how you intend to remediate the deficiency.

Then, when you have conducted your gap assessment, you’ll need to score that assessment using the DoD scoring algorithm. This will give you a score of between -203 and 110. This score, along with some information on your System Security Plan and POAMs, will need to be entered into the SPRS system.

Yes.

The DFARS clause 252.204-7012, which contains the requirement for compliance with NIST, flows down from the prime to the subcontractors. In fact, even if you’re a sub and you have other subs underneath you, you’ll need to require NIST compliance of your subs as well.

A System Security Plan is a document that shows how you’ve responded to each of the 110 controls/requirements in NIST 800-171. It should outline system boundaries, system interconnections and responses to the controls. This, essentially, means that you’ll need to respond to each requirement as either Implemented, Not Implemented, Not Applicable or Partially Implemented. Once you have given the control a status, you’ll need to describe why you selected that status. If the control is implemented, then describe how your organization meets the requirement. If the control is not implemented, then you’ll need to create a POAM for that requirement.

A POAM is a Plan of Action and Milestones. When you find a deficiency, or a requirement that your organization does not currently meet, then you’ll need to create a plan to get that deficiency remediated. That plan is your POAM. It shows that you have acknowledged the deficiency and have a good plan for getting the requirement implemented. POAMs will consist of the reason for the deficiency, plans to correct the deficiency and a realistic timeline of when those plans will be completed.

You’ll need both your System Security Plan and Plan of Actions and Milestones to claim compliance to NIST 800-171.

Controlled Unclassified Information (CUI) is the data the government wants you to protect. You may have access to it for manufacturing items used by DoD or for executing a services contract. They believe its sensitive enough to warrant specific cyber defenses to keep it safe.

NIST 800-171 is a list of 110 requirements regarding cybersecurity. To claim NIST 800-171 compliance you need to assess your organization against each of the requirements, formally document how you meet each requirement, and plan to make changes to your IT systems and processes as necessary to resolve any deficiencies you discovered during the assessment.

You’ll need to be able to present 3 items to claim compliance to NIST 800-171:

• A System Security Plan
• Plan of Action and Milestones
• Your SPRS score