How is a NIST 800-171 assessment done, and who does it?
A NIST 800-171 assessment tests each requirement against SP 800-171A, using the examine, interview and test methods to decide whether the organization's systems meet the requirement as written. The organization owns the result and the controls behind it, while a Government team or an authorized assessor issues the finding. Who that assessor is depends on the contract. Under DoW Class Deviation 2026-O0025, Revision 3, contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly, and the deviation cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. Confirm with the contracting officer which revision and which assessment type the solicitation or contract actually names before you plan any work.
Three things change the answer for a given organization: the contract clause that applies, the system boundary that defines scope, and how mature the evidence is. The clause determines whether a self-assessment, a Government-conducted DoD Assessment, or a CMMC assessment is in play, and the deviation also lets requiring activities specify CMMC Level 1 (Self) or Level 2 (Self) assessments. The scope determines which systems and personnel an assessor will ask about. The evidence determines whether a requirement can be shown as met at all. Ask the contracting officer which assessment applies, which scope the Government expects, and whether the Government will exercise its access rights under the deviation's clause 252.240-7997, which allows Medium or High assessments with on-site access to facilities, systems and personnel.
Before the assessment, the organization should gather what a reviewer will test: a current system security plan, configuration baselines, scan results, access reviews and written procedures, each in final approved form. Drafts and unapproved policies do not count as evidence for a MET finding. Ask your implementation partner to map each requirement to the artifact that proves it, and ask your auditor or assessor to confirm in writing which artifacts they will accept. An implementation partner can prepare systems and evidence, but only the independent assessor or the Government team can issue the finding.
Self-assessment, DoD Assessment or CMMC assessment: which applies
The Basic Assessment is the self-assessment that DFARS 252.204-7012 contemplates for contractors handling CUI on their systems. The contractor scores its own implementation of the NIST SP 800-171 requirements, records the result, and keeps the supporting records ready for review. No assessor visits the environment, and the score is posted to the Supplier Performance Risk System (SPRS) rather than being certified by an outside party. The assessment follows the DoD Assessment Methodology, which anticipates reassessment of contractors on a three-year cycle unless program risk or a security-relevant change calls for another frequency.
- Who performs it: The contractor's own qualified staff or an outside consultant it hires. The consultant prepares evidence and analysis, but the contractor owns the score it submits.
- Where the result goes: The score is entered in SPRS, so accuracy and currency of the posted score are the contractor's responsibility.
- Frequency: Plan for reassessment about every three years, or sooner after a significant change to the CUI environment, unless the contract sets another interval.
- Records: Keep the artifacts that support each finding ready for Government review at any time.
- Scoring: Requirements are recorded as MET, NOT MET or N/A, and the score reflects the weighted results.
Confirm with the contracting officer whether the contract requires only this Basic Assessment or a higher-level Government assessment.
The Government may conduct Medium or High NIST SP 800-171 DoD Assessments, performed by DCMA DIBCAC using SP 800-171A and the 32 CFR 170.24 scoring methodology. Under clause 252.240-7997 in the current DFARS class deviation, contractors must give the assessors access to facilities, systems and personnel. A High assessment reviews evidence and demonstrations such as recent scanning results, system inventories, configuration baselines and multi-factor authentication records, and it does not require the assessors to have network access to the contractor's systems. The contractor's job is to make evidence available, complete and in final form.
- Who performs it: Government assessors, not the contractor or its consultant.
- Access: Facilities, systems and personnel must be available as the clause requires, so plan for escorts and documented walkthroughs.
- Evidence: Expect requests for scan output, asset inventories, baselines and authentication configurations that reflect the current environment.
- Scoring: Each requirement is recorded as MET, NOT MET or N/A, with N/A objectives treated as MET.
- Timing: Government assessments are scheduled by the Government, so keep documentation current rather than preparing only when notified.
Confirm with the contracting officer which assessment level the contract references and how the Government will coordinate scheduling.
Where a solicitation requires CMMC Level 2 status, 32 CFR 170.16(c)(1) requires the self-assessment to follow SP 800-171A and the scoping rules in 32 CFR 170.19. The organization records each of the 110 Rev. 2 requirements as MET, NOT MET or N/A, and 32 CFR 170.24 governs how those results are calculated and reported. Evidence must be in final form, so working papers, drafts and unofficial or unapproved policies cannot support a MET finding. The self-assessment is paired with the affirmation and status process in the CMMC rule, and the organization must keep the artifacts behind the assessment for six years from the CMMC status date.
- Scope: Apply the 32 CFR 170.19 scoping rules before assessing, so the assessed boundary matches the systems that handle CUI.
- Evidence form: Use approved, final policies and dated records, not drafts.
- Results: Record every objective as MET, NOT MET or N/A, and remember that N/A objectives count as MET.
- Conditional status: Conditional Level 2 status requires a score of at least 0.8 of the maximum, POA&M items worth 1 point each, and six named requirements kept off the POA&M, with closeout within 180 days.
- Retention: Keep the supporting artifacts for six years from the CMMC status date.
Current CMMC enforcement is affected by the July 2026 suspension, so confirm with the contracting officer which CMMC level the solicitation names.
What evidence assessors expect for a MET finding
Under 32 CFR 170.24, every requirement is recorded as MET, NOT MET or N/A, so the organization must show evidence for each objective it claims. The cards below cover the artifacts assessors ask for most often and the families each one supports, along with what to confirm before the assessment begins.
Final-form evidence only
Under 32 CFR 170.24(b)(1), working papers, drafts and unofficial or unapproved policies are not acceptable evidence for a MET finding. Assessors look for approved, dated and version-controlled documents that a current process actually follows. Before the event, confirm with your assessor which document version and approval record they will accept, and remove superseded drafts from the evidence folder so the wrong version is not presented by mistake.
Current vulnerability scanning results
Scan reports support the risk assessment and flaw remediation families, including the requirements on vulnerability monitoring, scanning and remediation (03.11) and flaw remediation (03.14). Assessors expect recent scans that cover the CUI boundary, with the scanner's scope, date and findings, plus tickets that show how each finding was fixed or accepted. Confirm the scan date window and whether the assessor wants authenticated scans of in-scope assets.
Current system inventory
A complete inventory of hardware, software, and the locations where CUI is stored, processed or transmitted supports the component inventory and CUI location requirements in the configuration management family (03.04). The inventory should match the system security plan boundary and the network diagram. Confirm with the assessor how they want out-of-scope and separated assets shown, since an inventory that omits systems inside the boundary will undermine the rest of the evidence.
Configuration baselines and hardening records
Documented baselines show that approved settings exist and that systems were checked against them, which supports configuration management (03.04) and the least functionality requirements. Assessors look for the baseline document, the approved change record that set it, and a recent comparison report that shows drift was detected or resolved. Confirm which hardening standard the organization has adopted and whether the assessor expects a configuration scan output or a manual review.
Multi-factor authentication proof
Evidence that multi-factor authentication is enforced supports the identification and authentication family (03.05), including the requirements for multifactor authentication and for protecting authenticator management. Useful artifacts include identity provider policy exports, enrollment reports showing coverage of in-scope accounts, and configuration screenshots dated near the assessment. Confirm whether the assessor will verify MFA through a live demonstration, which is one of the forms of evidence the DoD Assessment Methodology describes for High assessments.
The system security plan
The system security plan supports the planning family (03.15), and under requirement 03.15.02 it must describe the system boundary, the implementation of each requirement and the responsible roles. Assessors check that the plan matches the inventory, baselines and network diagrams and that it has been reviewed on a schedule. Confirm with the assessor the approval and revision history they expect, and whether the plan must reference the specific artifacts for each requirement.
The assessment phases from scoping to a posted result
The sequence turns a contract requirement into a documented, defensible assessment record: a fixed scope, evidence that holds up to review, a requirement-by-requirement result, and a retained file that can be produced later. Each phase has a named output that the next phase depends on.
Confirm the assessment scope and procedure
Start by fixing the boundary of the systems that store, process or transmit CUI, along with any assets that can affect their security. Confirm which assessment applies (a self-assessment or a Government-led assessment) and which procedure governs it, since the applicable version of SP 800-171A depends on the contract and the CMMC rules in effect. Ask the contracting officer to confirm the revision and method in writing. The output is a signed-off scope statement that maps every in-scope asset to the requirements it must meet.
Build the system security plan as the reference
Before testing, write or update the system security plan so it describes how each requirement is implemented, who owns it, and which system component carries it out. Assessors use the plan to find the controls and then test them. Organizations own this document and the decisions in it, and an implementation partner can help draft it from the actual configuration. The output is a current plan that matches the scoped environment, with any organization-defined parameter values stated explicitly.
Gather final-form evidence for each requirement
For each requirement, collect the artifacts that show the control operates, such as configuration exports, access reviews, scan reports, logs and approved policies. Under the CMMC scoring rules, working papers, drafts and unofficial or unapproved policies do not count as evidence for a MET finding, so confirm each artifact is in its approved, dated form. Check that the evidence covers the scoped systems and not only a sample that looks good. The output is an evidence index that links every requirement to specific artifacts an assessor can examine and interview against.
Record each requirement as met, not met or N/A
Test each requirement against the SP 800-171A determination statements and record the result as MET, NOT MET or N/A, following the 32 CFR 170.24 recording rules. Under those rules, an N/A objective is treated as MET, so every N/A needs a written justification that an assessor can accept. Run the test with the examine, interview and test methods where the procedure calls for them. The output is a complete findings record with one entry per requirement and a short rationale for each result.
Decide which gaps go on the POA&M
For each NOT MET result, decide whether to remediate before the assessment or record it on a plan of action and milestones. The 32 CFR 170.21 conditions for Conditional Level 2 status limit which items can sit on the POA&M, including a minimum score threshold and six requirements that cannot be deferred, so check eligibility against the current rule before filing. Confirm the closeout deadline with the contracting officer or the CMMC rule in force. The output is a POA&M listing each open item with an owner, a remediation approach and a closeout date.
Submit the result or host the Government assessment
For a self-assessment, the organization posts its result in the place the contract or program requires, with the score and status it can support with evidence. For a Government-led Medium or High assessment, the organization provides access to facilities, systems and personnel and answers the assessors' questions in the scope agreed earlier. Confirm the current clause and submission mechanism in the contract, since the September 2026 deviation changed which assessments the Government may conduct. The output is a submitted result or a completed on-site or remote assessment, each with a record of what was shown.
Retain artifacts for the required period
Keep the evidence, the findings record, the plan of action and the system security plan in their final versions for the retention period set by the rule that applies to your assessment. For Level 2 self-assessments under 32 CFR 170.16, that period is six years from the CMMC status date. Store records so they remain readable and tied to the version of the system they describe, and set a reminder to refresh them when the environment changes. The output is an archived assessment package that can be produced to an assessor or contracting officer on request.
How POA&M items and closeout work
A plan of action and milestones (POA&M) lets an organization carry unmet requirements for a limited time, but the CMMC rules in 32 CFR 170.21 set tight limits on how far that can go. Under the Conditional CMMC Level 2 status, an organization can hold that status only if its assessed score is at least 0.8 of the maximum, every POA&M item is worth 1 point, and six named requirements are kept off the POA&M entirely, so they must be met before the assessment. The rule also expects a closeout assessment that confirms every POA&M item within 180 days. Treat those numbers as the CMMC rule's terms, not as a general NIST SP 800-171 standard, and confirm with your contracting officer whether your contract applies these CMMC rules at all.
Before you rely on a POA&M, check three things. First, compute your score under the scoring methodology your contract uses, and confirm whether the items you plan to defer fall inside the six protected requirements. Second, record a dated milestone and an owner for each item, because a closeout assessment will test whether those commitments were carried out, not whether they were planned. Third, keep the evidence for each closed item in final form. Working papers, drafts and unapproved policies do not count as evidence for a MET finding, so a fix is only closed when its approved artifact exists. An illustrative case: an item for multifactor authentication on an administrative account is closed only when the configuration, the enforcement record and the approved access procedure are all final.
Costs in this stage are mostly internal labor and any outside help you buy to remediate or to prepare evidence. Remediation effort depends on how many items you defer and how deep the technical change is, so ask any implementation partner for a fixed scope that lists each POA&M item, its deliverable and the evidence it will produce. Ask an independent assessor, not your implementation partner, to confirm closeout, since only an independent party can issue that result. Confirm the closeout deadline, the assessment method and the artifact retention period in your contract or with the contracting officer before you commit to a schedule.
How long to keep assessment artifacts
A NIST SP 800-171 assessment is only as defensible as the records behind it. The cards below cover how long evidence must be kept, what belongs in the retained set, and what Government assessors can reach during a review. Read them together, because a retention plan that keeps the wrong records or loses track of versions fails the same way a missing artifact does.
Six-year retention period
Under 32 CFR 170.16(c)(4), an organization must keep the artifacts it used as evidence for a CMMC Level 2 self-assessment for six years from the CMMC status date. The clock starts at the status date, not at the day the evidence was collected, so an artifact gathered early in an assessment cycle may need to survive well beyond the next review. Ask your compliance lead to record the status date in the retention schedule and to set deletion dates from it, not from the file creation date.
Evidence in final form
Under 32 CFR 170.24(b)(1), working papers, drafts and unofficial or unapproved policies are not acceptable evidence for a MET finding. Retain the approved, dated and owner-signed version of each policy, procedure and configuration baseline, and keep the superseded versions separately so an assessor can see what was in force on a given date. A draft kept in the same folder as the final document can be mistaken for the operative record.
System security plan version history
The system security plan (SSP) is the document assessors read first, and each change to scope, boundary or implementation changes what it claims. Retain every approved SSP version with its revision date and change summary, so you can show what the plan stated when a score was posted or an assessment was performed. Confirm with your assessor how they expect version history to be presented, since the format is not fixed by the rule.
Vulnerability scan reports
Scan results show whether flaw remediation and vulnerability monitoring operated over time, not just on the day of an assessment. Retain the raw scan output, the scan configuration, the scope of each scan, and the tickets that show findings were triaged and closed. A single clean report with no history of earlier findings and remediation rarely demonstrates ongoing operation, so keep a continuous series rather than the latest report only.
Configuration baselines and inventories
Configuration baselines, change records and component inventories show what each system looked like when it was assessed. Keep dated exports of hardening settings, approved change tickets with impact analysis, and asset inventories that list CUI-bearing components. Without them, an assessor cannot match a configuration claim to a point in time. Confirm with your environment owners how often exports are taken and where they are stored under access controls.
Access for Government assessors
Under the DoD's clause 252.240-7997 as cited in Class Deviation 2026-O0025, Revision 3, the Government may still conduct Medium or High NIST SP 800-171 assessments, and contractors must provide access to facilities, systems and personnel. Retained artifacts must therefore be retrievable quickly and in a form that can be shown in a review. Ask who in your organization can produce records on short notice, and whether retained evidence sits in systems that assessors can reach without weakening your own controls.
Who owns the controls, who prepares evidence, who assesses
The organization that holds the contract or agreement owns its NIST SP 800-171 controls, decides the scope of the systems that store, process or transmit CUI, and makes the attestations that go with the assessment. NIST places application of SP 800-171 and resolution of compliance issues with the federal agency that holds the contract or agreement, so the contracting relationship is the place where obligations are defined. Responsibility for the controls does not move to any outside firm because the firm helped build them.
- Owns the controls: Policies, configurations, access decisions, training and incident handling operate under the organization's authority and records.
- Decides scope: The organization defines which systems, people and facilities fall inside the CUI boundary, and it must be able to defend that boundary to an assessor.
- Assigns organization-defined parameters: Where the federal agency has not specified ODP values under Rev. 3, the organization must assign them to complete the requirement.
- Attests and posts scores: The organization is accountable for the accuracy of its self-assessment results and any SPRS score it submits.
- Maintains the artifacts: The organization keeps the final-form evidence used for assessment for the retention period in the applicable rule.
Before any assessment, confirm which revision your contract names and who in your organization signs the attestation.
An implementation partner such as DeployOpen works inside the organization's own environment to prepare systems, configuration and evidence packages so that the organization can show each requirement is met. The partner's work is preparation: it builds or hardens the self-hosted platforms, documents how they meet the requirements, and organizes the artifacts an assessor will ask for. It does not examine the organization's controls for the purpose of certifying them, and it does not issue reports, scores or certificates.
- Prepares systems: Configuration baselines, logging, access control and encryption settings are set up in the client's infrastructure under a written scope.
- Builds evidence packages: Screenshots, configuration exports, scan outputs and inventories are organized against the requirement identifiers so the organization can present them.
- Drafts documentation: Procedures and the system security plan are drafted for the organization to review, approve and adopt.
- Identifies gaps: Pre-assessment readiness work can surface unmet requirements, which the organization decides how to address or record on a plan of action.
- Does not attest or certify: The partner cannot issue an assessment result, a SPRS posting or any certification.
Ask any partner to state in the written scope which deliverables are documents and configurations, and confirm that the organization keeps ownership of the final attestations.
The independent assessor or Government team examines the evidence, interviews personnel and tests controls against the assessment procedures in SP 800-171A, then records findings. Under the DoD Assessment Methodology, Medium and High assessments are performed by the Government, and CMMC third-party assessments are performed by independent assessment organizations. Only these parties issue findings, and the organization must give them access to facilities, systems and personnel when a Government assessment applies.
- Examines: Assessors review documents, configurations and records against the determination statements for each requirement.
- Interviews: Personnel are asked how controls operate in practice, which tests whether documented procedures match reality.
- Tests: Where the method applies, assessors check how controls behave on the live system.
- Records findings: Each requirement is recorded as MET, NOT MET or N/A under the scoring rules that apply to the assessment type.
- Requires access: Under the clause in the September 2026 DFARS deviation, contractors must provide access to facilities, systems and personnel for Government Medium or High assessments.
Confirm before the assessment whether it is a self-assessment, a Government assessment or a CMMC third-party assessment, because each has different rules for who assesses and who records the result.
How to choose a consultant or assessor
Choosing help for a NIST SP 800-171 assessment starts with one fact: the organization owns its controls, a consultant prepares systems and evidence, and only an authorized assessor can issue the finding. The cards below cover the checks to run on any firm before signing, and the questions that expose gaps in authorization, independence and scope.
Confirm the assessment type
Start by naming the assessment your contract or program requires. A self-assessment, a Government DoD Assessment at Medium or High, and a CMMC third-party assessment each have different rules about who may perform them. Ask the firm in writing which of these it is authorized to support, and whether that authorization comes from the program rather than from its own marketing. A firm that cannot answer this plainly should not be shortlisted.
Separate implementation from assessment
A firm that designed your enclave, wrote your system security plan and then grades that same work has a conflict of interest. Ask whether the assessing team had any role in implementation, and whether the firm will commit to keeping implementation and assessment staff separate for your engagement. Consultants who prepare evidence are valuable, but their findings are advisory until an independent assessor reviews them.
Check CUI enclave experience
Assessors test whether CUI is actually confined to the systems in scope, so experience with enclaves, VDI, cloud boundaries and segmentation matters more than general security credentials. Ask for a description of how the firm has verified scope boundaries, which assets it treated as out of scope, and how it tested that separation. Ask for references that you can verify through your contracting officer or program office, not only through the firm.
Require a written scope
Ask for a written scope that lists the systems, facilities, personnel and requirements covered, the deliverables, and the dates on which each deliverable will be finished. The scope should also state which NIST SP 800-171 revision and assessment procedure the work follows. A vague scope is the most common source of surprise cost, and a written scope lets you compare quotes on the same basis.
Clarify what a consultant cannot grant
No consultant can issue a compliance finding, score or certificate for your organization. Only the Government or an authorized assessor can produce those outcomes, and the score you post depends on their review. Confirm in the contract that the firm's work product is readiness support, and that the firm will not describe its pre-assessment as a finding. Treat any promise of a guaranteed result as a warning sign.
Ask about evidence and retention
Ask how the firm will organize evidence so that it meets final-form expectations, and who will retain the artifacts after the engagement ends. Evidence that exists only in the consultant's workspace or in draft documents will not support a MET finding. Confirm that your organization will hold the final artifacts and that the firm will hand them over in a format your own team can maintain.
NIST 800-171 assessment questions buyers ask
Who issues the NIST 800-171 score and who signs off on compliance?
The organization itself produces the score, and no one at DeployOpen or a consultant issues it. For DoD contracts, the score is calculated from the DoD Assessment Methodology and posted to the Supplier Performance Risk System (SPRS) by the contractor. Government assessors, such as DCMA DIBCAC, can run Medium or High assessments, and under the 2026 deviation contractors must give them access to facilities, systems and personnel. Only the assessing body issues findings or reports. A consultant such as DeployOpen prepares systems, documentation and evidence, but it does not issue a score, attestation or certification.
How long does a NIST 800-171 assessment take?
The duration depends on the size of the system boundary, the number of assets in scope, how current the system security plan and evidence already are, and who is assessing. No fixed duration is supplied for this page, so ask any provider or assessor for a written timeline tied to your defined scope. Government assessment timing is set by the requiring activity and the program risk, and the DoD Assessment Methodology anticipates assessing contractors with DFARS 252.204-7012 once every three years unless risk or a security-relevant change calls for another frequency. Confirm the current schedule with your contracting officer.
What does the work need from our internal staff?
Internal staff must own the decisions that only the organization can make. Expect to need named owners for policies, access management, configuration baselines, incident response and personnel screening, plus people who can show how systems actually run. Assessors interview staff under the examine, interview and test methods in SP 800-171A Rev. 3, so people who operate the systems must be available. Evidence must be in final form, because 32 CFR 170.24(b)(1) states that working papers, drafts and unofficial or unapproved policies are not acceptable for a MET finding. Plan for time from IT, security, HR and facilities, not only from the implementation partner.
Can we run a NIST 800-171 self-assessment ourselves?
Yes, a self-assessment is possible for the Basic Assessment and for CMMC Level 2 (Self) where the contract allows it. SP 800-171A is written so organizations can tailor its methodology, and 32 CFR 170.16(c)(1) requires CMMC Level 2 self-assessments to follow the June 2018 SP 800-171A and the 32 CFR 170.19 scoping rules. Each requirement is recorded as MET, NOT MET or N/A, and the artifacts behind each MET finding must be kept for six years from the CMMC status date under 32 CFR 170.16(c)(4). Self-assessment still needs accurate scoring, and a finding that cannot be supported by evidence will be questioned later. Confirm with your contracting officer which assessment level applies.
What drives the effort of a NIST 800-171 assessment?
The main drivers are scope, starting maturity and evidence quality. Scope sets how many systems, users, locations and external service providers must be examined, and narrowing CUI to a defined enclave reduces the surface assessed. Starting maturity matters because each unmet requirement needs remediation, and open items must be tracked in a plan of action and milestones. Evidence quality matters because assessors look for final, dated, approved records such as scan results, system inventories, configuration baselines and multi-factor authentication settings. Rev. 3 also adds organization-defined parameters, which you must set yourself where the agency does not, so ask whether those values are documented before pricing.
What changed under the 2026 deviation and proposed FAR rule?
Under DoW Class Deviation 2026-O0025, Revision 3 (3 September 2026), contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly. It cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended, and it lets requiring activities specify CMMC Level 1 (Self) or Level 2 (Self) assessments. Government Medium or High assessments can still occur under clause 252.240-7997. A FAR overhaul proposed rule published 23 June 2026 would move contractors handling CUI to Rev. 3 using DoW CIO ODP values, but it was not final as of October 2026. Confirm the revision in each solicitation and contract with the contracting officer.
How DeployOpen prepares systems and evidence for your assessment
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so that the systems and evidence behind your NIST 800-171 assessment are ready for review. Your organization owns its controls, and an independent assessor or the Government decides the outcome.
How we scope
- Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
- We map which systems store, process or transmit CUI and which assets fall inside the assessment boundary.
- We confirm with you which requirement set and assessment method apply to your contract before planning begins.
How we build
- We configure controls against the requirement families in your scope, such as access control, audit and configuration management.
- We set up logging, MFA, encryption and vulnerability scanning so that they produce records an assessor can examine.
- We draft the system security plan and plan of action items from the current state of your environment.
How we hand over
- We deliver a documented control set with configuration baselines, system inventories and scan outputs in final form.
- We provide an evidence index that maps each artifact to the assessment objective it supports for your review.
- We record open gaps and remediation owners so your team can keep the plan of action current after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
- A retainer can keep evidence current, refresh the system security plan and prepare for re-assessment.
- Your organization decides which findings to accept, remediate or report, and an independent assessor issues any results.
