How compliance is checked and enforced: running a Basic Assessment, DCMA DIBCAC Medium and High assessments, keeping the SPRS score accurate, and False Claims Act settlements over NIST SP 800-171.
The steps of a DoD Basic Assessment: starting from the system security plan, scoring each of the 110 requirements with the DoD Assessment Methodology, partial credit, requirements that cost nothing when not permitted, and what to post in SPRS for each system.
What a Government NIST SP 800-171 assessment by DCMA DIBCAC involves: Medium versus High assessments, the evidence and demonstrations assessors ask for, access you must provide, the 14-day rebuttal, how results override other scores, and how often it happens.
Why NIST SP 800-171 gaps turn into False Claims Act cases: the Raytheon, MORSECORP and Georgia Tech settlements, the missing SSPs and inaccurate scores behind them, whistleblower shares, liability that follows an acquired business, and what DoD said about FCA risk.
When an SPRS score stops being accurate and must be updated: what a posting contains, the three-year currency rule, scores for environments that do not exist, a consultant finding a much lower score, Government assessment results and annual CMMC affirmations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.