Assess Once, Comply to Many
Win and Retain DoD Contracts
To be awarded new DoW contracts, a contractor or supplier must comply with Defense Federal Acquisition Regulation Supplement (DFARS) that requires compliance with NIST SP 800-171.
Protect CUI
Safeguard the confidentiality of Controlled Unclassified Information across all system components that process, store, or transmit it.
Meet DFARS 252.204-7019 Requirements
Compliance with NIST 800-171 controls and submission of a NIST 800-171 SPRS score are required under DFARS 252.204-7019.
Prepare for CMMC
CMMC brings DFARS, SPRS, and NIST 800-171 together, so a strong NIST 800-171 compliance program positions you for CMMC certification.
What is NIST SP 800-171?
NIST SP 800-171, published by the National Institute of Standards and Technology, provides federal agencies with recommended security requirements for protecting the confidentiality of CUI when the information resides in nonfederal systems and organizations. The requirements apply to components of nonfederal systems that process, store, or transmit CUI, or that provide protection for such components, and are intended for use by federal agencies in contracts and other agreements with nonfederal organizations.
The current version, Revision 3, was published in May 2024 and superseded Revision 2. Its security requirements span 17 control families, including Access Control, Incident Response, Risk Assessment, and Supply Chain Risk Management. The companion publication, NIST SP 800-171A, provides the procedures for assessing the requirements. NIST 800-171 is required by DFARS. The Supplier Performance Risk System (SPRS) requires all contractors to submit their self-certification score method based on the NIST 800-171 framework, and scores cannot be more than 3 years old.
The current version, Revision 3, was published in May 2024 and superseded Revision 2. Its security requirements span 17 control families, including Access Control, Incident Response, Risk Assessment, and Supply Chain Risk Management. The companion publication, NIST SP 800-171A, provides the procedures for assessing the requirements. NIST 800-171 is required by DFARS. The Supplier Performance Risk System (SPRS) requires all contractors to submit their self-certification score method based on the NIST 800-171 framework, and scores cannot be more than 3 years old.
Who needs NIST 800-171?
Defense Industrial Base (DIB) contractors and suppliers whose unclassified networks store, process, or transmit Federal Contract Information (FCI) or CUI.
Defense Industrial Base (DIB) contractors and suppliers whose unclassified networks store, process, or transmit Federal Contract Information (FCI) or CUI.
Why Choose ControlCase for NIST 800-171 Assessment?
CMMC Registered Practitioner Organization (RPO) and Authorized CMMC Third Party Assessment Organization (C3PAO)
ControlCase is a CMMC C3PAO and RPO that assists companies with self-assessment and third-party assessment against NIST 800-171.
SPRS Scoring Support
ControlCase helps you calculate your NIST 800-171 score as required by DFARS 252.204-7019 and complete your SPRS submission.
Continuous Compliance
ControlCase's Continuous Compliance services reduce time, cost, and burden by making compliance a continuous process instead of a point-in-time exercise.
Formal Auditor Across Standards
In addition to federal regulations, ControlCase is a formal auditor for standards such as PCI and ISO, supporting an assess-once, comply-to-many approach.
Which Assessment Path Applies to You?
Path 1
Level 1
(FCI only)
(FCI only)
Self-assessment, optionally assisted by ControlCase.
Path 2
Level 2a
(CUI in addition to FCI, not critical to national security)
(CUI in addition to FCI, not critical to national security)
Self-assessment, optionally assisted by ControlCase.
Path 3
Level 2b
(CUI critical to national security)
(CUI critical to national security)
C3PAO assessment, once every three years.
Path 4
Level 3
(highest priority, most critical defense programs)
(highest priority, most critical defense programs)
Government audit, once every three years.
ControlCase NIST 800-171 Assessment Process
STEP 01
Document Your CUI SSP
Document your CUI System Security Plan.
STEP 02
Assess All Controls
Perform an assessment of all NIST 800-171 controls as documented in your CUI SSP, including formal evidence collection and reporting.
STEP 03
Calculate Your Score
Calculate your NIST 800-171 score as required by DFARS 252.204-7019.
STEP 04
Document Deficiencies
Record any deficiencies with remediation steps in a Plan of Action and Milestones (POA&M) documents.
STEP 05
Complete SPRS Affirmation
Submit your score and affirmation using the Supplier Performance Risk System.
STEP 06
Maintain Evidence
Maintain evidence of your NIST 800-171 compliance to avoid DoJ False Claims Act investigations.
STEP 01
Document Your CUI SSP
Document your CUI System Security Plan.
STEP 02
Assess All Controls
Perform an assessment of all NIST 800-171 controls as documented in your CUI SSP, including formal evidence collection and reporting.
STEP 03
Calculate Your Score
Calculate your NIST 800-171 score as required by DFARS 252.204-7019.
STEP 04
Document Deficiencies
Record any deficiencies with remediation steps in a Plan of Action and Milestones (POA&M) documents.
STEP 05
Complete SPRS Affirmation
Submit your score and affirmation using the Supplier Performance Risk System.
STEP 06
Maintain Evidence
Maintain evidence of your NIST 800-171 compliance to avoid DoJ False Claims Act investigations.
