A prime contractor asked for your SPRS score
Primes are flowing down DFARS 252.204-7012 and CMMC requirements, and they want to see your NIST SP 800-171 assessment score before awarding or renewing a subcontract.
- Home
- Frameworks
- CMMC / NIST 800-171
CMMC and NIST SP 800-171 readiness for defense contractors.
Whatever the timeline for third-party certification, contracts that involve controlled unclassified information already require NIST SP 800-171. I get you to a score you can defend.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — When it comes up
Why companies call me about CMMC and NIST SP 800-171
CMMC verifies security requirements that most defense contracts have carried for years. It shows up in three common ways.
A solicitation includes a CMMC level
Level 1 covers federal contract information under the 15 basic safeguarding requirements in FAR 52.204-21. Level 2 covers controlled unclassified information under the 110 requirements of NIST SP 800-171 Rev. 2. Level 3 adds requirements from NIST SP 800-172 for the most sensitive programs.
Your score was posted years ago and nobody has looked since
A self-assessment score has to reflect your environment as it is today, and CMMC self-assessments come with an annual affirmation of continued compliance.
02 — How the work runs
How I build it
Scope first. Shrinking the environment that touches CUI is usually the biggest single cost saving.
Status, October 2026. The Department of War suspended CMMC Phase 2, which would have made third-party Level 2 certification a condition of award starting November 10, 2026, and later phases are on hold while the program is reviewed. CMMC was not cancelled: Phase 1 self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171, and SPRS reporting still apply.
01
Scope FCI and CUI
Find where federal contract information and CUI enter, live, and leave, and decide whether an enclave or segmented environment makes sense.
02
Gap assessment and score
Assess against NIST SP 800-171 using the DoD Assessment Methodology, so you know your real score and which requirements carry the most weight.
03
System Security Plan and POA&M
A System Security Plan that describes how each requirement is met, and a plan of action for anything still open. CMMC limits which items can stay open and for how long.
04
Remediation and evidence
Close the gaps in priority order and collect evidence the way an assessor will ask for it.
05
SPRS submission and assessment readiness
Post an accurate score, complete the affirmation, and be ready for a third-party or government assessment when your contracts require one.
03 — Fixed fees
What it costs
Fixed fees, agreed in writing before work starts.
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Gap assessment against NIST SP 800-171, scored with the DoD Assessment Methodology
- CUI scoping recommendations
- 90-day remediation roadmap
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentVirtual CISO retainer
From $2,000 / month
Someone accountable for running the program after it is built.
- Maintains the SSP and POA&M
- Keeps the SPRS score and affirmation current
- Answers prime contractor questionnaires
Implementation: once the assessment defines the scope, remediation and documentation are quoted as a fixed fee, never hourly. Formal CMMC certification assessments are performed by authorized C3PAOs or the government; my role is readiness.
04 — Questions
Common questions
Straight answers to what clients usually ask first. Anything else, bring it to the call.
Is CMMC cancelled?
No. Phase 2 was suspended in July 2026 and the program is under review, but the CMMC rule remains in effect, Phase 1 self-assessment requirements still appear in contracts, and DFARS 252.204-7012 still requires NIST SP 800-171.
Can we have open items and still qualify?
Only in a limited way. Under the CMMC rule, conditional Level 2 status requires a minimum score of 88 out of 110, only certain requirements can remain on a plan of action, and open items must be closed within 180 days.
Are you a C3PAO?
No. Certification assessments are performed by authorized third-party assessment organizations or by the government. I prepare you for them, and keeping those roles separate avoids conflicts of interest.
What is the difference between NIST SP 800-171 and NIST CSF?
NIST SP 800-171 is a specific set of 110 requirements for protecting CUI. The NIST Cybersecurity Framework is a broader, outcome-based framework for running a security program. Many contractors use both.
Next step
Book a discovery call
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com