CMMC vs NIST 800-171: which one defense contractors need first
NIST SP 800-171 is the requirement set that protects controlled unclassified information (CUI) in nonfederal systems, and CMMC is the Department of Defense program that verifies implementation of those requirements. If you handle CUI under a defense contract, DFARS 252.204-7012 already requires you to implement NIST SP 800-171 whether or not CMMC applies to your contract. The first job is therefore the implementation work, and CMMC decides how that work is later checked. The CMMC final rule states that Level 2 adds no requirements beyond NIST SP 800-171 Rev. 2, so the question is not which document to adopt but when and how you must prove it.
Pursue the implementation work first and treat it as the baseline for every contract. Confirm with your contracting officer and the clause in each solicitation which CMMC level and assessment type applies, because the Department of War suspended CMMC Phase II on 13 July 2026 and lets requiring activities specify Level 1 (Self) or Level 2 (Self) assessments for now. Self-assessment results must be entered in SPRS, so the score you post must match evidence that is in final form. A Level 2 C3PAO certification becomes the relevant question only when a contract requires it, and you should not treat it as optional planning for a future date without written direction.
Doing both is the normal path, not an either-or choice. The same control work produces the SP 800-171 evidence, the SPRS score and the artifacts a certification assessor would examine. Start by asking your sponsor to confirm which Rev. 2 requirements your scoped systems must meet, which subcontractors handle CUI and must flow the clause down, and whether your contracts name a Level 2 self-assessment or certification. Keep the work anchored to the Rev. 2 requirements now, and watch for the pending FAR overhaul, which would move contractors toward Rev. 3, before you plan any changes to your control set.
How the two compare on scope, version and proof
This table compares NIST SP 800-171 as a requirement set with CMMC as the DoD verification program that applies it to contracts. Read the rows as two layers: the requirements you implement and the proof you produce for a defense contract.
| Factor | NIST SP 800-171 (Rev. 2 and Rev. 3) | CMMC Level 2 |
|---|---|---|
| What it is | Requirement set for protecting CUI in nonfederal systems, issued by NIST | DoD program under 32 CFR Part 170 that verifies implementation of the SP 800-171 requirements |
| Who requires it | Federal agencies set it for CUI on nonfederal systems, and DFARS 252.204-7012 requires implementation by contractors | Defense contractors and subcontractors whose contracts carry the CMMC clause, as set by the requiring activity |
| Current version | Rev. 3 is NIST's current version (14 May 2024); Rev. 2 was withdrawn on the same date | Built on Rev. 2; the DoW says it will enforce Rev. 2 in the interim (13 July 2026) |
| Number of requirements | Rev. 2: 110 requirements in 14 families. Rev. 3: 97 requirements in 17 families | 110 requirements, identical to SP 800-171 Rev. 2 (32 CFR 170.14(c)(3)) |
| Assessment method | SP 800-171A Rev. 3 is the companion assessment guide for Rev. 3 | Self-assessments and certification follow SP 800-171A (June 2018), not Rev. 3 (32 CFR 170.16(c)(1)) |
| Proof produced | No certificate. NIST does not run a conformity program, so proof is your own documentation | Level 2 self-assessment posted to SPRS, or a C3PAO certification assessment; Conditional status requires at least 88 of 110 |
| SPRS posting | Not applicable | Required for self-assessment results, including the overall score and POA&M status (32 CFR 170.16) |
| Published cost estimates | None in the supplied rule text for implementing Rev. 2 or Rev. 3 | DoD estimated $43,403 (other than small) or $34,277 (small) for a self-assessment plus affirmation; $112,345 or $101,752 for a C3PAO assessment plus affirmation (CMMC final rule, October 2024) |
| What the estimates exclude | Not applicable | Implementation and maintenance of SP 800-171 Rev. 2, because DFARS 252.204-7012 already required it by 31 December 2017 |
Why CMMC Level 2 still uses Rev. 2 while NIST publishes Rev. 3
CMMC Level 2 is still assessed against the 110 requirements of NIST SP 800-171 Rev. 2, even though NIST withdrew Rev. 2 on 14 May 2024 when it published Rev. 3. The 32 CFR Part 170 rule makes the Level 2 requirements identical to Rev. 2, so the contract obligation is tied to that text until the regulation changes. Rev. 3 is a different document: it contains 97 requirements in 17 families, numbered 03.01.01 to 03.17.03, and it introduces organization-defined parameters (ODPs) that the nonfederal organization must assign when no federal agency has done so. Rev. 2 and Rev. 3 are not interchangeable checklists, so a gap analysis against one does not answer questions about the other.
The Department of War has reinforced the Rev. 2 position. DoW Class Deviation 2026-O0025, Revision 3 (signed 3 September 2026) has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly, and it cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A separate FAR overhaul proposed rule published 23 June 2026 would require contractors handling CUI to comply with Rev. 3 using ODP values published by the DoW CIO. Comments closed 23 July 2026, and the rule was not final as of October 2026. Treat the Rev. 3 move as a proposal, not a current obligation.
Confirm the operative clause and the requirement version in each contract before you plan remediation. Ask the contracting officer which DFARS 252.204-7012 text and which SP 800-171 revision apply to the solicitation or award, and whether any ODP values have been published. Record the answer in your System Security Plan so the assessment scope and evidence match the version named in the contract. Revisit the question when the FAR rule is finalized or a new class deviation is issued, because a Rev. 3 requirement would add ODP decisions and new assessment determinations that a Rev. 2 program does not carry.
Where the work overlaps between SP 800-171 and CMMC
CMMC Level 2 and SP 800-171 Rev. 2 describe the same requirements, so most of the technical work carries over between a self-assessment and a certification. The cards below cover the shared structure, the assessment rules, the flow-down to subcontractors and the Rev. 3 differences that affect planning.
Shared requirement families
The CMMC Model has 14 domains that map to the security requirement families of NIST SP 800-171 Rev. 2. Each domain traces back to a Rev. 2 family, so a control owner in one family answers for the same requirement in both programs. Check that each domain owner can name the Rev. 2 family and requirement numbers they are responsible for, since a gap there usually shows up first during assessment preparation.
Requirement ID format
CMMC requirement IDs use the format DD.L#-REQ, where DD is the domain, L# is the level and REQ is the source requirement number. For example, AC.L2-3.1.1 is an access control requirement at Level 2 that traces to Rev. 2 requirement 3.1.1. Use these IDs in your system security plan, POA&M and evidence index so that the record you build for NIST 800-171 can be reused without rework when a CMMC assessor asks for it.
Shared SP 800-171A assessment objectives
Level 2 self-assessments and certification assessments both use the assessment objectives in NIST SP 800-171A (June 2018). A requirement counts as MET only when every applicable objective is satisfied with evidence in final form, not drafts. Self-assessment and certification therefore use the same bar, so a self-assessment that scores a requirement as met on draft evidence will not survive a C3PAO review.
DFARS 252.204-7012 flow-down
DFARS 252.204-7012(m) requires the clause to flow down to subcontracts involving covered defense information. A subcontractor that handles CUI must implement NIST SP 800-171 whether or not CMMC applies to its contract. Identify which suppliers receive CUI, confirm the flow-down language is in each subcontract, and collect their evidence early, because a prime's CMMC status depends on the security of the suppliers in its boundary.
Rev. 2 to Rev. 3 mapping
The CIS Controls Navigator and NIST's CSF 2.0 Reference Tool both list mappings to SP 800-171 Rev. 2 and Rev. 3. These mappings help teams see where their Rev. 2 evidence also answers Rev. 3 requirements. NIST notes that it does not check the correctness of non-NIST mappings and that a listed mapping does not imply endorsement, so validate any mapping against the requirement text before you rely on it for a contract.
Rev. 3 changes that affect planning
Rev. 3 withdrew 33 Rev. 2 requirements and added 19 new ones, and it introduced organization-defined parameters that the nonfederal organization may need to set itself. Because CMMC Level 2 still assesses Rev. 2, these differences do not change this year's assessment. They do matter for a multi-year roadmap, so ask your contracting officer which version will apply before you fund Rev. 3 work.
Who assesses, what gets issued and how often
This table compares who checks CMMC Level 2 and Level 3 claims, what each assessment produces and how often it repeats. Read it to find the proof your contracts will ask for, then confirm the current requirement with the contracting officer because the 2026 suspension changed the near-term schedule.
| Item | Self-assessment (Level 1 and 2) | C3PAO certification (Level 2) or DCMA DIBCAC (Level 3) |
|---|---|---|
| Who performs it | The organization itself, with senior official affirmation | Level 2: C3PAOs authorized or accredited by The Cyber AB. Level 3: DCMA DIBCAC |
| What gets recorded or issued | Score entered in SPRS, including POA&M status, plus annual affirmations | Certification assessment result tied to the contract requirement; confirm the exact record format with the sponsor |
| Scoring threshold to note | Level 2 Conditional status requires at least 88 of 110 requirements met (32 CFR 170.21) | Requirements must be MET to the same standard; confirm how POA&M items are treated for your level |
| Evidence standard | A requirement is MET only when all applicable NIST SP 800-171A (June 2018) objectives are satisfied with final, not draft, evidence | Same standard: all applicable SP 800-171A (June 2018) objectives satisfied with final evidence (32 CFR 170.17 and 170.24(b)) |
| Repeat cycle | SPRS results repeated every three years, with annual affirmations in between (32 CFR 170.16) | Confirm the certification validity period and renewal rules in the current eCFR text before scheduling |
| Status after the 13 July 2026 suspension | Phase I self-assessments, SPRS postings and annual affirmations remain in place | Suspended for applicable contracts: the November 2026 Phase II C3PAO requirement was paused pending a 60-day review |
| Schedule to confirm | The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, while the DoW CIO page reflects the pause | Ask the contracting officer whether your solicitation requires a certification assessment or a self-assessment at Level 2 |
| Ongoing obligation under DFARS 252.204-7012 | Subcontractors and primes handling CUI must still implement SP 800-171 Rev. 2 regardless of assessment type | Same obligation applies; certification does not replace implementing the requirements |
What to do first when pursuing both paths
This sequence turns a contract requirement into a verified, scored position that you can defend in a self-assessment today and reuse if a third-party certification is required later. Each step produces a record that the next one depends on.
Confirm the CMMC level and assessment type per contract
Ask the contracting officer which CMMC level and assessment type each solicitation or contract requires, and whether it is Level 1 (Self) or Level 2 (Self) under the current DoW direction, or a Level 2 certification assessment. Record the answer per contract number, along with the DFARS 252.204-7012 clause that applies. Ask for the answer in writing. The step is done when every active contract has a recorded level, assessment type and clause reference that your team can point to.
Establish the SP 800-171 Rev. 2 baseline and SSP
Scope the systems that store, process or transmit CUI, then assess each of the 110 Rev. 2 requirements against your current environment. Document the results in a System Security Plan that names the boundary, the owners and the implementation status of each requirement. Keep a Plan of Action and Milestones for every requirement that is not yet met. Your security lead and system owners do this work, with counsel reviewing contract language. The step is done when the SSP and POA&M are signed off and cover every in-scope system.
Produce final-form evidence against 800-171A objectives
Assess each requirement against the assessment objectives in the June 2018 edition of SP 800-171A, which is the edition the CMMC Level 2 self-assessment must follow. A requirement counts as MET only when every applicable objective has evidence in final form, not drafts. Collect configuration exports, policy approvals, access reviews, scan results and training records with dates and owners. An internal reviewer who did not perform the implementation should check each record. The step is done when each requirement has an objective-by-objective evidence file that an outside assessor could follow.
Calculate and post the SPRS score
Calculate the overall score from the requirements you have met, using the 110-point Level 2 scale, and enter it in SPRS together with POA&M status, as 32 CFR 170.16 requires. Before posting, confirm that the score reflects only requirements supported by final-form evidence. Senior officials who can affirm the posting should review the figure and the POA&M before it is entered. The step is done when the SPRS entry matches the internal scoring worksheet and the affirmation is on file, and you know the date you must re-affirm.
Track the Rev. 3 transition through the FAR rule
Rev. 3 is the current NIST version, but the CMMC rule and the revised DFARS deviation still point to Rev. 2 for now. Assign an owner to monitor the FAR overhaul rulemaking, which proposes requiring SP 800-171 Rev. 3 with organization-defined parameters published by the DoW CIO. Map your Rev. 2 SSP to Rev. 3 requirements now, noting the 33 withdrawn requirements and 19 new ones in NIST's change analysis, and list the ODP values you would need to set. The step is done when a dated gap view of Rev. 2 against Rev. 3 exists and the monitoring owner has a standing review.
Reuse the same evidence for later certification
Store the SSP, POA&M, objective-level evidence and SPRS records in one controlled repository with version history, so the material does not have to be rebuilt if a C3PAO assessment is later required for a contract. Confirm with the contracting officer and The Cyber AB process which records an assessor will request. The step is done when the repository can produce any requirement's evidence, with dates and approvals, on request. Evidence built this way serves a self-assessment and a certification review alike, so the work is not repeated.
Prepare for any later certification assessment
If a contract later requires a Level 2 certification assessment, a C3PAO authorized or accredited by The Cyber AB performs it, and the assessment still uses the Rev. 2 requirements and SP 800-171A objectives. Schedule a mock review against the evidence repository, ask the assessor for its scoping and evidence requirements in writing, and close the open POA&M items that can be closed with final-form evidence. The step is done when an internal review shows that every requirement claimed as MET can be traced to evidence that an assessor could examine.
What drives the cost of meeting SP 800-171 and CMMC
The DoD's October 2024 final rule set different Level 2 estimates by entity size. The rule estimated a Level 2 self-assessment plus initial affirmation at $34,277 for a small entity and $43,403 for an other-than-small entity. These figures cover assessment-side activity only. The rule states that its Level 1 and Level 2 estimates exclude the cost to implement or maintain the SP 800-171 Rev. 2 requirements, because DFARS 252.204-7012 already required implementation by 31 December 2017.
- Who pays for implementation: Your organization pays its own staff, consultants and tooling to meet the 110 requirements. None of that appears in the DoD estimate.
- Who pays for the assessment: The estimate line covers the self-assessment and initial affirmation, which your organization performs or buys.
- Which line applies: Confirm which size classification applies to your entity, because the two figures differ.
- Recurring work: Annual affirmations and the three-year SPRS repeat continue after the first cycle.
Ask your counsel or contracting officer to confirm your size classification and which estimate line, if any, your internal budget should reference.
Level 2 has two verification paths with different fee structures. A self-assessment is performed by your organization or a party you engage, and results are entered in SPRS. A certification assessment is performed by a C3PAO authorized or accredited by The Cyber AB. The DoD estimated a Level 2 C3PAO certification assessment plus affirmation at $101,752 for a small entity and $112,345 for an other-than-small entity. On 13 July 2026, the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required C3PAO certification for applicable contracts.
- Self-assessment cost: Mostly internal time, plus any outside help you buy to prepare evidence and score the requirements.
- C3PAO cost: The C3PAO is paid for the assessment itself, and the DoD estimate covers that plus affirmation.
- Phase I obligations: Self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place after the suspension.
- Evidence standard: A requirement counts as MET only with final evidence, so documentation time is a cost under either path.
Check the solicitation for the assessment level it requires and whether it names Level 1 (Self) or Level 2 (Self), since the July 2026 memorandum allows requiring activities to specify those.
Scope often moves cost more than the choice of assessment path. Systems that process, store or transmit CUI fall within the assessment, along with security protection assets and external service providers in that scope. Each in-scope system adds requirements to implement and evidence, and each additional system adds assessor time. Limiting the CUI boundary usually reduces the number of systems that must meet every requirement, but that depends on how your environment is built.
- CUI enclave: Separating CUI systems from the rest of the network can shrink the set of systems that must satisfy every requirement.
- Managed and cloud providers: Providers that store or process CUI are part of the assessment picture. Confirm how each is handled under your CMMC scope.
- FedRAMP for cloud: Ask the contracting officer which cloud offerings holding CUI must meet FedRAMP Moderate, since that changes the cost of those services.
- Subcontractor flow-down: DFARS 252.204-7012(m) requires the clause in subcontracts involving covered defense information, so subcontractors handling CUI must implement SP 800-171 regardless of CMMC status.
Request a written boundary diagram and a list of in-scope external service providers before comparing any price.
A quote is only comparable when its scope is written down. Most differences between proposals come from what each one excludes. DeployOpen works to fixed scope, agreed in writing before work starts, and does not publish a price list. A quote follows from that written scope. DeployOpen prepares systems, controls and evidence for assessment, but it does not perform or certify the assessment. Assessment fees, affirmations and ongoing maintenance are separate line items that a quote may or may not include.
- Scope boundary: The systems, sites, enclaves and external service providers included, and those excluded.
- Deliverables: The documentation, evidence packages and POA&M support to be delivered, with acceptance criteria.
- Exclusions: Whether assessment fees, affirmations, licenses for tooling and remediation work are included.
- Client dependencies: The staff time and access your organization must provide, written as assumptions.
- Recurring work: Annual affirmation support, SPRS updates at the three-year cycle, and any retainer terms.
Before you compare quotes, confirm in writing which estimate line, if any, your budget references, and note that the DoD figures exclude implementation.
Questions contractors ask before hiring help on CMMC and NIST 800-171
Is a self-assessment enough for CMMC right now?
For most contracts today, a Level 2 self-assessment is the assessment type the Department of War is currently requiring, because it suspended the Phase 2 step that would have required C3PAO certification. The 13 July 2026 suspension left Phase 1 self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations in place. Whether a specific contract requires Level 1 or Level 2 (Self) depends on its solicitation, so confirm the requirement in the contract and with the contracting officer. Self-assessments must follow the June 2018 edition of SP 800-171A, and every requirement must be met with evidence in final form.
What does the work need from our own staff?
Your staff must own the decisions that an outside firm cannot make for you. These include the system boundary, which assets process, store or transmit CUI, who is accountable for each requirement, and the written policies and evidence that show a control operates. Your team also has to be able to answer for the environment during interviews and review. An outside provider can plan, configure, document and test controls, but the company remains responsible for the result and for keeping the evidence current after the engagement ends. Ask any provider to state in its written scope which tasks your staff must perform.
How long does CMMC readiness take?
No readiness duration is supplied for this page, and the timeline depends on the size of the environment, the number of CUI systems, how much documentation already exists and how many requirements are open. Ask any provider for a written scope with a timeline tied to deliverables and the systems in scope, and ask for the assumptions behind it. DeployOpen agrees scope, deliverables and timelines in writing before work starts, so you can compare them against your own gap assessment. Also confirm your contract dates, because the SPRS posting and affirmation steps add fixed points to the calendar.
Can DeployOpen certify us for CMMC?
No. DeployOpen does not issue CMMC certificates or assessment results. Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB, and Level 3 certification assessments are performed by DCMA DIBCAC. DeployOpen can help you prepare systems, controls and evidence for the assessment that applies to your contracts, and it is independent of the assessing body. Ask any provider to confirm in writing that it does not perform the assessment it is helping you prepare for.
What changes if we adopt NIST SP 800-171 Rev. 3?
Rev. 3 changes the requirement set, not the current CMMC Level 2 rule. NIST published SP 800-171 Rev. 3 with 97 requirements in 17 families, while the CMMC Level 2 requirements remain identical to the 110 requirements of Rev. 2. Rev. 3 adds organization-defined parameters, and NIST does not assign their values, so a nonfederal organization must assign them when no federal agency does. A FAR overhaul proposed rule published 23 June 2026 would require Rev. 3 with ODP values published by the DoW CIO, but it was not final as of October 2026. Plan your gap analysis against Rev. 2 for CMMC, and track the Rev. 3 rulemaking separately.
What is a SPRS score, and why does it matter?
A SPRS score is the overall result of your Level 2 self-assessment, recorded in the Supplier Performance Risk System. Under 32 CFR 170.16, the entry must include the overall score, for example 105 out of 110, and your POA&M status, and it must be repeated every three years with annual affirmations. Under 32 CFR 170.21, at least 88 of 110 is required for Conditional status, which allows open items on a plan of action and milestones. The score matters because it is the figure a contracting officer sees when assessing your eligibility and your declared position, so a score that does not match your evidence creates contract and False Claims risk. Review each entry against documented evidence before you post it.
Can we do the work ourselves without outside help?
Yes, a company can prepare its own CMMC and SP 800-171 program, as long as its people can read the requirements, apply SP 800-171A's assessment objectives and produce final evidence for each requirement. Self-assessment is open to you, and the requirements are public. The question is capacity and independence. Internal teams often underestimate the work of defining the CUI boundary, documenting policies and collecting evidence in final form. If you go alone, assign named owners, keep an assessment log and have someone who did not write the controls check the evidence before the SPRS entry is made.
What may change next and how to track it
Before you commit budget to CMMC Level 2, confirm the current status of Phase II with your contracting officer, because the Department of War suspended it on 13 July 2026. That suspension halted the Phase II start scheduled for 10 November 2026, which would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Ask the contracting officer which assessment level your solicitations specify and whether the review outcome has been announced, since the review window may have closed by the time you read this page.
Expect conflicting signals about the schedule. The DoW CIO About CMMC page describes Phase 1 as paused and says it may require only Level 1 and Level 2 self-assessments, while the eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Treat the official eCFR text as the regulation until a rulemaking changes it, and treat the CIO page as the current enforcement posture. Record the date you checked each source, and ask the contracting officer to confirm in writing which document governs your contract. Your Level 2 readiness work should not depend on whether the certification requirement returns in 2026 or later.
Track the FAR overhaul separately. A proposed rule published 23 June 2026 would require contractors handling CUI to comply with SP 800-171 Rev. 3 using organization-defined parameter values published by the DoW CIO. Comments closed 23 July 2026 and the rule was not final as of October 2026. If it is finalized, the requirement set your assessors use could change from Rev. 2 to Rev. 3, which would affect your gap analysis and evidence plan. Check the Federal Register entry for the final rule status, and confirm with your contracting officer whether any solicitation already references Rev. 3 or the revised DFARS 252.204-7012 deviation.
How DeployOpen prepares SP 800-171 and CMMC readiness
DeployOpen works on the NIST SP 800-171 requirements and the evidence a CMMC assessor would later review, in the client's own infrastructure. Engagements are fixed-scope, so the systems, controls and documentation covered are agreed in writing before work starts.
How we scope
- Written scope names the systems that store, process or transmit CUI and the boundary around them.
- Scope records which requirements apply to each system and where the organization must assign its own parameters.
- Scope states whether the work targets a self-assessment or a certification assessment, and which evidence gaps are included.
How we build
- Controls are implemented against the requirement wording and the assessment objectives of the version your contract names.
- Technical hardening, access configuration and logging are tested against each applicable requirement before sign-off.
- Security testing of in-scope systems is available where the written scope includes it, with findings tracked to remediation.
How we hand over
- Deliverables include a system security plan, policies, configuration records and a requirement-by-requirement evidence map.
- Plans of action and milestones for open gaps are documented with owners and the conditions for closing them.
- Evidence is delivered in final form so your assessor can review it directly, with a note on what remains your responsibility.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Retainers can cover annual affirmation evidence, SPRS score updates and changes when DoD requirements or contract clauses change.
- Confirm with your contracting officer and assessment body which version and assessment type apply before scoping starts.
