NIST Compliance
NIST 800-171 and 800-53, implemented and scored.
DFARS self-assessment, SPRS submission, SSP and POA&M, and control implementation for federal contractors and organizations using NIST as their baseline.
What it is
NIST SP 800-171 defines 110 requirements for protecting Controlled Unclassified Information in non-federal systems and is the control set behind DFARS 252.204-7012 and CMMC Level 2. NIST SP 800-53 is the broader catalog used by federal agencies and FedRAMP. Contractors must self-assess against 800-171, submit a score to SPRS and maintain a plan of action for open items.
Who needs it
- Federal and defense contractors with DFARS 7012, 7019 or 7020 clauses
- Subcontractors receiving flow-down requirements from a prime
- Organizations adopting NIST CSF or 800-53 as their security framework
- Companies preparing ahead of a CMMC assessment
What we do
- Gap assessment against all 110 requirements, scored per the DoD methodology
- System Security Plan and Plan of Action & Milestones
- SPRS score submission and improvement roadmap
- Technical implementation of access, audit, identification, configuration and incident controls
- 800-53 baseline tailoring for agency or FedRAMP-adjacent work
- Annual reassessment and score updates
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
What is the difference between NIST 800-171 and CMMC?
NIST 800-171 is the set of 110 security requirements. CMMC is the DoD program that verifies contractors have implemented them, either by self-assessment or third-party assessment. Level 2 CMMC is NIST 800-171 in full.
What does DFARS 252.204-7012 require?
Implementation of NIST 800-171, a System Security Plan, a Plan of Action for open items, cyber incident reporting to DoD within 72 hours, and flow-down to subcontractors that handle CUI.
What is a good SPRS score?
The maximum is 110. Scores below 110 are allowed with a POA&M, but the DoD's assessment methodology deducts up to five points per unmet requirement, so a few high-weight gaps can produce a negative score.
Do we need NIST 800-53 instead?
800-53 is the larger catalog used by federal agencies and FedRAMP. Contractors handling CUI need 800-171; contractors operating systems on behalf of an agency may be held to 800-53 baselines.
Do you serve contractors outside California?
Yes. NIST 800-171 engagements are delivered nationwide.
Find out where you stand on NIST SP 800-171.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.