nist-800-171

Start at the maximum score of 110 and deduct points for each unmet control using the DoD Assessment Methodology. Most controls deduct 1 point, high-impact controls like MFA and encryption deduct 3 points, and critical controls like the SSP deduct 5 points. Negative scores are possible and reportable.

Follow six steps: define your CUI system boundary, develop a System Security Plan documenting all 110 controls, collect evidence through examination and testing, perform gap analysis on NOT MET controls, build a POA&M with milestones, then submit your SPRS score reflecting the current state.

CMMC Level 2 requires full compliance with all 110 NIST SP 800-171 controls in a direct one-to-one mapping. Achieving complete 800-171 compliance is equivalent to CMMC Level 2 compliance, though some contracts require a C3PAO third-party assessment rather than self-assessment.

Common deficiencies include MFA not deployed for privileged accounts (3.5.3), no formal System Security Plan (3.12.4), missing vulnerability scanning (3.11.2), audit logging gaps (3.3.1), unencrypted CUI at rest (3.13.16), and absent incident response plans (3.6.1).

Collect MFA enrollment reports showing 100% coverage of privileged accounts and non-privileged network accounts, screenshots of Conditional Access or equivalent enforcement policies, and documentation of any exception process for excluded accounts.