NIST SP 800-171 and CMMC 2.0 Guide

Defence contractors are judged on how well they implement NIST SP 800-171, but the rules that decide which revision applies, who assesses it and what score is acceptable sit in three different places: NIST publications, DFARS clauses and the CMMC programme rule in 32 CFR Part 170. Misreading one of them produces an indefensible SPRS score, an unaffordable or undefendable scope, or an ineligible POA&M. This guide explains how SP 800-171 Rev. 2 and Rev. 3, the DFARS clauses and the CMMC levels fit together, how scoring, POA&Ms and scoping work, and what must continue after an assessment. It reflects the DoD CIO position on 16 October 2026 and is written for compliance leads, IT and security teams and managed service providers in the Defense Industrial Base. What CUI is, and how to mark and handle it, is covered in the CUI Guide.

Key takeaways

• DoD still assesses against Rev. 2. NIST withdrew Rev. 2 in May 2024, but CMMC Level 2 is identical to its 110 requirements and class deviation 2024-O0013 keeps DFARS 7012 on it. Build to Rev. 2, map to Rev. 3.
• CMMC is paused in Phase 1. The DoD CIO suspended Phase II on 13 July 2026; Level 1 and Level 2 self-assessments remain in force while the rule's C3PAO and DIBCAC provisions wait on the review.
• The score has hard floors. A Level 2 POA&M is only allowed with a score of at least 88 out of 110, only for 1-point requirements (plus non-FIPS encryption), and must be closed within 180 days.
• Scoping is the main cost lever. Under 32 CFR 170.19, identity providers, SIEM and managed service providers are in scope even if they never store CUI.
• Compliance is continuous. Annual affirmations, operational plans of action, current SPRS entries and subcontractor flow-down are ongoing contract obligations.

How SP 800-171, DFARS and CMMC fit together

NIST writes the requirements, DFARS clauses make them contractual, and 32 CFR Part 170 defines how DoD verifies them. Each has its own date and version.

"CMMC 2.0" is the three-level model DoD announced in 2021 to replace the original five levels; 32 CFR 170 codifies it and simply says "CMMC".

SP 800-171 Rev. 2 and Rev. 3: what changed

DFARS 252.204-7012 requires the version "in effect at the time the solicitation is issued or as authorized by the Contracting Officer". Class deviation 2024-O0013 of 2 May 2024 means contractors "must comply with NIST SP 800-171, Revision 2" until DoD decides otherwise, and CMMC Level 2 is "identical to the requirements in NIST SP 800-171 R2".

Decision: if your CUI comes from DoD, the assessment, the SSP and the SPRS score must be written against Rev. 2. Civilian agency contracts may cite Rev. 3. Keep one control set documented to Rev. 2 numbering, with a crosswalk column to Rev. 3 built from NIST's Rev. 2 to Rev. 3 change analysis, so a future switch is a documentation task, not a rebuild.

CMMC levels and assessment types

Level 3 parameters in 32 CFR 170.14 are concrete: a SOC running "24/7, with allowance for remote/on-call staff" (IR.L3-3.6.1e), an incident response team deployable "within 24 hours" (IR.L3-3.6.2e) and penetration testing "at least annually or when significant security changes are made" (CA.L3-3.12.1e).

Status in October 2026

On 16 October 2026 the DoD CIO "About CMMC" page stated that Phase II, due on 10 November 2026, was suspended on 13 July 2026 and a reform task force established. It says "The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels", that DoD will enforce SP 800-171 Rev. 2 "through self-assessments and select government-led assessments", and that the suspension "does not eliminate the requirement" to protect information under DFARS 252.204-7012. The page describes only Level 1 (Self) and Level 2 (Self), although 32 CFR 170.17 and 170.18 still contain the C3PAO and DIBCAC provisions. Expect the design to change when the review ends, and check the page before relying on this.

Government-led assessment already exists in DFARS 252.204-7020: a Medium assessment is a government review of the Basic self-assessment and documents ("Medium" confidence), and a High assessment is "conducted by Government personnel using NIST SP 800-171A" ("High" confidence). Under 32 CFR 170.17, DIBCAC findings "take precedence over any pre-existing CMMC Status".

SPRS scores, scoring rules and plans of action and milestones (POA&Ms)

The Supplier Performance Risk System (SPRS) holds the summary score that contracting officers check. DFARS 252.204-7019 requires a current score, "not more than 3 years old unless a lesser time is specified in the solicitation", and a Basic posting must include the system security plan it covers, CAGE codes, assessment date, the score (for example "95 out of 110") and the date by which a score of 110 is expected.

Scoring under 32 CFR 170.24 and the DoD Assessment Methodology starts at 110 and subtracts the value of each NOT MET requirement: 5, 3 or 1 points. With every requirement unmet the score reaches -203. Two requirements allow partial credit:

• IA.L2-3.5.3 multifactor authentication: 3 points are lost "if MFA is implemented only for remote and privileged users"; 5 if MFA is not implemented for any users.
• SC.L2-3.13.11 CUI encryption: 3 points are lost if encryption is used but not FIPS-validated; 5 if CUI is not encrypted.

An enduring exception (for example a lab instrument that cannot run endpoint protection) is assessed as MET when described with its mitigations in the SSP. A temporary deficiency (a control that failed and is being fixed) is MET when "appropriately addressed in operational plans of action". But "A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement": it is a short bridge, not a risk register.

Scoping the assessment

The assessment scope is "the set of all assets in the OSA's environment that will be assessed against CMMC security requirements", and it must be fixed before the assessment starts. At Level 1 only systems handling FCI are in scope. At Level 2 every asset falls into one of five categories, documented in the asset inventory, SSP and network diagram.

• External service providers: a cloud provider handling CUI must meet FedRAMP Moderate equivalence under DFARS 252.204-7012. A non-cloud ESP handling CUI is assessed within your scope; one providing security functions without CUI is assessed as a Security Protection Asset. Record each in the SSP with a customer responsibility matrix.
• Level 3: the scope must equal or be a subset of the Level 2 scope, Contractor Risk Managed Assets become CUI Assets, and Specialized Assets are assessed against Level 3 requirements, with intermediary devices allowed.

Choosing a boundary and an assessment path

• Enclave: a separate tenant, VDI or segmented network for the people who handle CUI. Best when CUI is a small part of the business; the services that protect the enclave remain Security Protection Assets. See the Network Segmentation Guide.
• Enterprise-wide: right when CUI flows through engineering, email and collaboration daily. Simpler for users, larger to assess.
• Small organisations: a government-community cloud offering with documented FedRAMP Moderate equivalence usually gets a 20-person firm further than building controls on premises. Read its customer responsibility matrix: most requirements stay shared.
• Large organisations: one SSP per assessment scope, aligned to the business units holding the contracts, drawing on a single control library mapped to both revisions.
• Self versus C3PAO: while the programme is paused, contracts require self-assessments, but government-led assessments still happen. Self-assess with third-party rigour: final evidence, every objective, and a scorer who does not own the control.

How to implement

1. Read the contracts: list each contract's DFARS clauses, required CMMC level and whether it involves FCI or CUI; ask the contracting officer where unclear.
2. Map data flows and fix the scope: trace CUI in, at rest and out; categorise every asset and ESP under 32 CFR 170.19.
3. Write the SSP first: CA.L2-3.12.4 cannot go on a POA&M, so there is no valid assessment without one. Describe how each requirement is implemented, not that a policy exists.
4. Close the 5-point requirements: access control, MFA (IA.L2-3.5.3), FIPS-validated encryption (SC.L2-3.13.11), audit logging and incident response first; only non-FIPS encryption among them may sit on a POA&M.
5. Pilot changes in rings: roll out MFA, device control and logging to IT and one programme team first, with conditional access and DLP rules in report-only or audit mode; then enforce. Keep previous policy versions to revert if a production or test system breaks.
6. Self-assess with SP 800-171A objectives: score each objective, compute the SPRS score and record every gap.
7. Post, affirm and operate: enter the score in SPRS with the planned full-implementation date, have the affirming official sign, then close POA&M items inside 180 days and re-score after significant change.

Keeping compliance current after an assessment

• Affirm and reassess: affirm at each assessment and annually at every level (a Level 2 assessment lapses without it), and reassess Level 2 and 3 every three years.
• Change management: a new site, cloud tenant, acquisition or ESP can change the scope; assess it against the SSP before go-live, and report changed CMMC UIDs to the contracting officer under DFARS 252.204-7021.
• Flow-down: before award, verify each subcontractor's SPRS score (7020) and required CMMC status and affirmation (7021).
• Incident readiness: keep a valid DoD medium assurance certificate for reporting at dibnet.dod.mil within 72 hours, and a procedure to preserve images and monitoring data for 90 days.

Where identity fits

Many Access Control and Identification and Authentication findings involve accounts that nobody treats as users.

• MFA: 3.5.3 requires MFA for local and network access to privileged accounts and network access to non-privileged accounts. Prefer phishing-resistant PIV or FIDO2 for administrators. See the MFA Guide and the Smart Card and PIV/CAC Authentication Guide.
• Service accounts and integrations: backup agents, sync connectors, scanners and CI/CD pipelines that read CUI repositories are in scope and need an owner, least privilege, rotation, logging and an SSP entry. See the Service Account Security Guide.
• Privileged access: 3.1.5, 3.1.6 and 3.1.7 (least privilege, non-privileged accounts for routine work, logging privileged functions) are easiest to evidence with a vaulted, recorded admin path. See the Privileged Access Management Guide.
• MSP and vendor accounts: an ESP's administrators are in your scope. Require named accounts, MFA and logging, removed when the contract ends. See the Third-Party Access Guide.

Detection and measurement

The Audit and Accountability family (3.3.1 to 3.3.9) expects user-traceable, reviewed and correlated audit records with alerts on logging failures. Collect identity provider and domain controller authentication and privilege events, CUI repository access, EDR alerts, firewall and VPN logs and cloud admin activity.

• SPRS accuracy: difference between the posted score and the score from your latest internal re-test (target 0).
• POA&M ageing: number of open POA&M items and days remaining against the 180-day window.
• MFA coverage: percentage of in-scope human and administrative access paths protected by MFA (target 100%).
• Non-human identity hygiene: share of in-scope service accounts with a named owner and a credential rotated within policy.
• Scope drift: CUI found outside the boundary by DLP or discovery scans per quarter.
• Flow-down: percentage of active subcontractors with a verified, current SPRS score and CMMC status.

Common failure patterns

• A score nobody can defend: posting 110 on the strength of unimplemented policies. Government Medium and High assessments re-score from evidence, and an official has affirmed the posted score.
• No SSP, or an SSP that describes intent: CA.L2-3.12.4 cannot be deferred, and an SSP that says "we will" rather than "we do" fails the objectives.
• Forgotten Security Protection Assets: the identity provider, SIEM, backup platform or MSP remote management tool left out of scope.
• Treating the POA&M as a backlog: 5-point items listed as planned, or items still open on day 181, which ends Conditional status.
• Building to Rev. 3 too early: scoring DoD work against Rev. 3 numbering and ODPs when the contract and CMMC still require Rev. 2.
• Contractor credentials outside the boundary: the CISA Private-CISA GitHub leak shows a contractor's public repository exposing AWS GovCloud administrator keys. Scan for and rotate keys to in-scope environments.

Framework mapping

Practitioner checklist

• Inventory contracts with DFARS 7012, 7019, 7020 or 7021, with the CMMC level and information type each requires.
• Fix the assessment scope using the five 32 CFR 170.19 asset categories, including every ESP with a customer responsibility matrix.
• Write or refresh the SSP against the 110 Rev. 2 requirements, with a Rev. 3 crosswalk column.
• Close all 5-point and 3-point gaps first, especially MFA for all users and FIPS-validated encryption for CUI.
• Confirm the score is at least 88 and every POA&M item is eligible, then plan closure within 180 days.
• Post the score in SPRS with the planned full-implementation date and record who signs the annual affirmation.
• Bring service accounts, MSP admin accounts and pipeline credentials into the SSP with owners and rotation.
• Hold a valid medium assurance certificate and test the 72-hour reporting and 90-day preservation process.
• Verify subcontractors before award, and re-check the DoD CIO CMMC page quarterly during the review.

Standards and references

• NIST: SP 800-171 Rev. 3 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• NIST: SP 800-171A Rev. 3 Assessing Security Requirements for Controlled Unclassified Information
• NIST: SP 800-172 Rev. 3 Enhanced Security Requirements for Protecting Controlled Unclassified Information
• eCFR: 32 CFR Part 170 Cybersecurity Maturity Model Certification (CMMC) Program
• DoD CIO: About CMMC
• Acquisition.gov: DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
• Acquisition.gov: DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements
• Acquisition.gov: DFARS 252.204-7021 Contractor Compliance with the CMMC Level Requirements

Related NHI Mgmt Group resources: CUI Guide · Public Sector Identity Security Guide · Third-Party Access Guide · Identity Security Regulatory Map. This guide summarises NIST SP 800-171, DFARS 252.204-7012, -7019, -7020 and -7021 and the CMMC programme rule in 32 CFR Part 170 as of October 2026 and is not legal advice.