Cybersecurity · NIST 800-171
NIST 800-171 compliance
Gap assessment, SPRS scoring, SSP and the technical and physical controls DoD suppliers need, ahead of CMMC Phase 2.
The short answer
NIST SP 800-171 sets 110 security requirements for protecting Controlled Unclassified Information (CUI). Any DoD contractor or subcontractor that handles CUI must meet it under DFARS 252.204-7012 and post a self-assessment score in SPRS. CMMC Level 2 verifies the same 110 requirements, and third-party certification begins phasing into contracts in November 2026. WCC helps Southern California suppliers assess, document and implement the controls.
Framework
NIST 800-171 vs CMMC
| NIST SP 800-171 | CMMC Level 2 | |
|---|---|---|
| What it is | The control framework | DoD's verification of that framework |
| Requirements | 110 | The same 110 |
| How it's checked | Self-assessment, scored in SPRS | Self-assessment or third-party (C3PAO) assessment, depending on the contract |
| Required since | 2017 (DFARS 252.204-7012) | Phasing in since November 2025 |
See CMMC compliance.
What we do
What WCC provides
Gap assessment
All 110 requirements reviewed and a realistic SPRS score calculated.
SSP
A System Security Plan that defines your CUI boundary and how each control is met.
POA&M
A plan of action for open items, with owners and dates.
Technical controls
MFA, encryption, logging, segmentation, vulnerability management and secure configuration.
Physical protection
Access control, cameras and visitor logging for the PE family, installed by our own technicians.
Ongoing upkeep
Annual SPRS refresh, evidence collection and support through assessments.
SPRS
How the SPRS score works
The score starts at 110. Each requirement that isn't fully met subtracts 1, 3 or 5 points depending on its weight, so scores can go negative. DoD contracting officers can see the score before award, and primes increasingly ask for it. Most small and mid-size suppliers start well below 110 and improve over 6 to 18 months as gaps close.
Control families
The 14 control families
| Family | Requirements |
|---|---|
| Access Control | 22 |
| System and Communications Protection | 16 |
| Identification and Authentication | 11 |
| Audit and Accountability | 9 |
| Configuration Management | 9 |
| Media Protection | 9 |
| System and Information Integrity | 7 |
| Maintenance | 6 |
| Physical Protection | 6 |
| Security Assessment | 4 |
| Awareness and Training | 3 |
| Incident Response | 3 |
| Risk Assessment | 3 |
| Personnel Security | 2 |
Who needs it
Who in Southern California needs NIST 800-171
Aerospace and defense manufacturers, machine shops, electronics suppliers, engineering firms and IT vendors that receive CUI through DoD contracts or flow-downs from primes. Revision 3 of NIST 800-171 was published in May 2024, but DoD contracts still reference Revision 2 for now. We plan with both in mind.
FAQ
NIST 800-171 questions
What is NIST 800-171?
A NIST publication with 110 security requirements for protecting Controlled Unclassified Information in nonfederal systems.
Who must comply?
DoD contractors and subcontractors at any tier that process, store or transmit CUI, under DFARS 252.204-7012.
How is it different from CMMC?
NIST 800-171 is the framework. CMMC Level 2 verifies the same 110 requirements, by self-assessment or third-party assessment depending on the contract.
When does CMMC third-party certification start?
Phase 2, which brings Level 2 third-party assessments into contracts, begins in November 2026.
What is an SPRS score?
A self-assessment score starting at 110, with 1, 3 or 5 points subtracted for each requirement not fully met. It's posted in DoD's Supplier Performance Risk System.
Does WCC handle physical controls too?
Yes. We install the access control, cameras and visitor management that the Physical Protection family requires.
Related
Related guides and services
Get a recommendation
Start with a gap assessment
Tell us your contracts and current SPRS score, and we'll scope the assessment.