Skip to content
WolfSpotter logo: wolf head mark beside the WolfSpotter wordmark
All guides

NIST SP 800-171 and CMMC

Contracts that involve controlled unclassified information (CUI) may require you to implement the security controls in NIST SP 800-171 and report a score in SPRS. CMMC requirements are set by the Department of War and vary by contract.

What it is

NIST SP 800-171 is a set of security requirements for protecting CUI on a contractor's systems. Contracts that include it typically ask you to assess your implementation and post a score in the Supplier Performance Risk System (SPRS).

The Cybersecurity Maturity Model Certification (CMMC) program verifies that contractors protect federal contract information and CUI. The level a contract requires, and whether it calls for a self-assessment or a third-party assessment, depends on the contract.

CMMC requirements are changing. Confirm what applies against the current solicitation and contract clauses.

Who needs it

Shops whose contracts or purchase orders involve CUI, which can include drawings and specifications from a defense customer. Primes often pass these requirements down to their subcontractors.

First steps

  1. Read the clauses in your contracts and purchase orders, and ask your customer which requirements apply.
  2. Identify where CUI would enter, live in, and leave your shop.
  3. Assess your systems against NIST SP 800-171 and write a system security plan.
  4. Post your assessment score in SPRS if your contract requires it.
  5. Check the CMMC level named in each solicitation before you bid.

Common mistakes

  • Assuming the requirements stay the same from one contract to the next.
  • Storing customer drawings on unprotected shared drives or personal email.
  • Posting an SPRS score without a written assessment behind it.
  • Relying on outdated summaries instead of the current solicitation.

Where to confirm the official requirement

This is general information, not legal or compliance advice. Confirm current requirements with the agency, the prime, or your own adviser.

Want help with this?

Tell us where your shop stands and we will follow up by email or phone.

Talk to us about your shop