NIST 800-171 & CMMC Readiness

What this covers

Contractors and subcontractors that handle controlled unclassified information for the Department of Defense must implement NIST SP 800-171 and, under the Cybersecurity Maturity Model Certification program, demonstrate it. HQT is implementing these requirements in its own environment and offers the same readiness support to partners.

Typical activities

• Scoping the environment that stores, processes, or transmits controlled unclassified information
• Gap assessment against NIST SP 800-171 and scoring
• System security plan and plan of action and milestones
• Control implementation, often through an enclave approach that limits scope
• Evidence collection and readiness review before a formal assessment

What you receive

A scoped environment definition, gap assessment and score, system security plan, plan of action, and an evidence package.

Considerations

Requirements and timelines under the CMMC program are set by the Department of Defense and change over time. We work from the current published rule and flag where an agency or partner should confirm requirements with its contracting officer.

Signals that the requirement has already arrived

Most state and local agencies never handle controlled unclassified information, and the ones that do learn it from a contract document. The clause in the award is the trigger, not a judgment about how sensitive the data feels. Signs it has already reached you:

• A prime contractor sends a subcontract or purchase order carrying the DFARS safeguarding and assessment clauses, or asks for a current assessment score in the Supplier Performance Risk System before award.
• A department is a subrecipient on federally funded research, test, or engineering work whose terms flow down NIST SP 800-171.
• Staff receive drawings, specifications, or data marked CUI, or marked with a category from the CUI Registry maintained by the National Archives, and keep them in ordinary email and file shares.
• A laboratory, port, airport, transit, or National Guard support function is doing defense work that central IT never scoped.
• A partner questionnaire asks which external service providers touch the data, whether cloud services meet a FedRAMP Moderate baseline, and whether encryption uses FIPS validated modules.

If none of these apply, this requirement is not yours yet.

Questions that test whether readiness work is real

Readiness is easy to document and harder to demonstrate. Checks that separate the two:

• Open the system security plan, pick a requirement at random, and ask to see the setting that satisfies it in your own tenant. Template language describing a generic organization does not survive this.
• Ask how each deduction in a posted score was derived. The assessment methodology weights requirements differently, and an assessor expects the reasoning, not only the number.
• Ask which revision of SP 800-171 the work maps to and whether that matches the revision named in the clause. Revisions differ in how requirements are organized and worded.
• Ask whether the boundary is enforced in configuration or only asserted in a document. A scope described as the entire network usually means nobody was willing to decide what is CUI.
• Ask staff inside the enclave how they move a file. A compliant path slower than email gets worked around, and the gap reopens.
• Treat any claim that a product is certified as a warning. Assessment applies to an organization and its defined scope; a product can support requirements but cannot satisfy them for you.

Where this lands in the systems and agreements you already have

The controls are rarely what fails first. The boundary is. Expect the work to reach the identity tenant and its service terms, the email and collaboration platform, backup targets, the ticketing system where screenshots of CUI accumulate, printing, removable media, and remote support tooling. A managed service provider or shared county IT arrangement is an external service provider here rather than a way to sit outside the boundary, so the remedy is usually amending that agreement rather than replacing products. Ask each provider for a written responsibility matrix naming which requirements it performs and which stay with you.

Existing obligations help without substituting. Agencies working under the CJIS Security Policy or IRS Publication 1075 have inventory, access control, logging, and training practice that transfers, but the scoping rules and assessment objectives differ enough to need a documented mapping rather than a claim of equivalence.

Terms to set in a solicitation for readiness work

• Artifacts delivered in editable form, owned and maintainable by agency staff, with evidence stored where the agency controls it.
• A responsibility matrix collected from every external service provider in the boundary, not a note that one was requested.
• Handling terms for the consultant, whose staff will see CUI: screening, where the work is performed, and where evidence may be stored.
• No guarantee of an assessment outcome, and disclosure of any relationship with an assessment organization, since program rules generally keep preparation and certification separate.
• Named responsibility for who posts the score, who signs the affirmation, and who refreshes each, because those obligations recur on the schedule the rule and the contract set.
• Knowledge transfer to named agency staff, since the requirements persist for the life of the contract.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions