NIST 800-171, the 110 controls.
NIST 800-171 is the underlying control set for DFARS, CMMC, and many state programs. Required if you handle CUI. We implement, document, and assess against the full control set — including the new Rev 3 update.
- Controls
- 110 (Rev 3)
- Engagement
- Implement + assess
- Output
- SPRS-ready
- Maps to
- CMMC L2
What's included
CUI flow mapping
Where CUI enters, lives, and leaves your environment. Most engagements start with the discovery that scope is broader than expected.
Control-by-control gap
All 110 controls assessed against your current implementation. Mapped to specific evidence requirements.
Implementation roadmap
Prioritized by exploitability, audit risk, and effort. Quick wins first; structural work scheduled.
Documentation authoring
Policies, procedures, and the System Security Plan — written to withstand DFARS assessment.
SPRS score support
Help with score calculation and submission. Most companies underreport — we help you report accurately.
Annual reassessment
Annual delta assessment to catch drift and add new requirements as Rev 3 evolves.
Engagement lifecycle
- 01Weeks 1–3
Scope + gap
CUI flow mapping, full control gap, evidence-requirement mapping.
- 02Months 1–6
Remediation
Technical and procedural controls implemented. Pace depends on starting posture.
- 03Months 6–8
Documentation + SPRS
SSP, POAM, and SPRS score assembled. Submission support if required.
- 04Annual
Reassessment
Delta assessment + score refresh + Rev 3 updates.
What you walk away with
- All 110 controls implemented or formally exception-documented
- Audit-ready SSP and POAM
- Accurate SPRS score submitted
- Defensible posture under DFARS assessment
- Foundation for CMMC Level 2
- Annual continuous-improvement cadence