Find the clause
DFARS 252.204-7012 in your contract means the 110 requirements, a 72-hour incident report and flow-down to subcontractors. DFARS 7019 and 7020 mean a current SPRS score before award.
Federal & defense · NIST / DFARS 252.204-7012
NIST SP 800-171 Rev 2 (110 controls)
The 110 controls behind CMMC Level 2 and every DFARS 7012 contract. Rev 2 remains the contractual baseline.
Rather skip the call? Get a fixed-fee NIST 800-171 quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry NIST 800-171, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Government & Defense ContractorsArchitecture, Engineering & ConstructionManufacturing & Machine ShopsAgencies, Staffing & Consultancies
Which packages prepare you for it
CMMC Level 2 Gap Readiness Package
Defense manufacturers, engineering and design firms, and IT and service suppliers of 10 to 300 people handling CUI
CMMC Self-Assessment and SPRS Score Calculation
Suppliers who need a current, defensible SPRS score now and a clear path toward Level 2 later
What it asks for
In plain English, what NIST 800-171 expects you to have in place.
- Fourteen control familiesAccess control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
- A defined CUI boundaryThe systems, people and locations in scope, and the flow of controlled information between them.
- A System Security PlanHow each of the 110 requirements is implemented in your environment.
- A Plan of Action and MilestonesWhat is not yet met, who owns it and when it closes.
- A self-assessment score in SPRSPosted and current under DFARS 252.204-7019 and 7020.
- Flow-down to suppliersThe same requirements passed to subcontractors and cloud providers that touch CUI.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
CMMC in more detail: the certification path · what drives the cost · the 12-item checklist · rehearsing the C3PAO assessment
Where it starts
Your one-stop shop for NIST SP 800-171
The 110 requirements are the substance of CMMC Level 2 and the condition of every DFARS 7012 contract. The clause has required them since 2017; the CMMC pause did not touch it.
We score you honestly against Revision 2, write the system security plan and the POA&M, post a score you can defend, and track the Revision 3 changes so the move is easy later.
Trace the CUI: tick where it goes
Tick where CUI goes and we show the boundary the 110 requirements apply to.
The steps
Six steps from "does NIST SP 800-171 apply to us?" to evidence you can show
The whole NIST SP 800-171 journey, short version. We handle every step with you.
Scope the boundary
Where CUI arrives, where it is stored, which machines read it and who can reach it. A small boundary is a small assessment; CUI spread across every laptop is the expensive version.
With AccuSights: we trace the CUI flow with you on the intake form and a call, and put the boundary in writing before anyone buys an enclave.
Run the 110-requirement gap assessment
Each requirement met, not met or not applicable, using the DoD assessment methodology. The score starts at 110 and can fall to negative 203. An inflated score is a False Claims Act problem; an honest one is a plan.
With AccuSights: your engineer scores it the way an assessor would, so the number you post in SPRS is one you can defend.
Close the gaps and write the SSP
MFA on CUI systems, FIPS-validated encryption, logging, access control, incident response, and the system security plan that describes how each requirement is met. The POA&M lists what is still open, with owners and dates.
With AccuSights: remediation is in-house or with your IT provider, and we write the SSP and the POA&M in assessor language.
Stay continuously compliant
The affirmation is yearly, and a senior official signs it. Controls that drift between affirmations are the risk: a new hire without MFA, a laptop outside the boundary, a log nobody reads.
- MFA on CUI systemsPassing
- FIPS encryption on laptopsPassing
- Logs reviewed this weekPassing
- Subcontractor flow-down signedPassing
Does it pay for itself
-$2,640 a yearIt does not pay for itself on time alone. You would save about 117 hours, worth $9,360, against a $12,000 price. Break-even is 6.4 hours a week of manual work. It can still be worth it for a Type 2, where the real saving is exceptions you never get.
Most of a supplier's hours go into the SSP and the POA&M, which a platform tracks but does not write. Half is a fair starting guess for evidence; lower for the documents.
With AccuSights: our endpoint agent and monitoring watch the boundary around the clock and flag the drift to your engineer.
Post it in SPRS and keep it true
The score, the SSP date and the date you expect to reach 110 go in SPRS. Primes read it. So does the Justice Department when a score is inflated.
With AccuSights: we post it with you and update it as the POA&M closes.
Why AccuSights
Why small teams pick AccuSights for NIST SP 800-171
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What NIST SP 800-171 costs, in plain numbers
Here is what is published, with who published it and when.
From $6,000Gap assessment, SSP, POA&M and an honest SPRS score for a small supplier with contained CUI.Source: AccuSights pricing page (2026)
No assessor feeThe self-assessment is yours to perform under DFARS 7019; the DoD publishes its own estimates for third-party assessment in the CMMC rule.Source: 32 CFR Part 170, CMMC Program final rule, 15 October 2024
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on NIST 800-171, in plain words.
Questions
NIST SP 800-171 questions we get every week
Who has to comply with NIST SP 800-171?
Contractors and subcontractors whose Department of Defense contracts include DFARS 252.204-7012 and whose systems handle Controlled Unclassified Information. The clause requires the 110 security requirements, rapid reporting of cyber incidents within 72 hours, and the same terms flowed down to subcontractors that handle CUI. Size does not create an exemption.Source: DFARS 252.204-7012
How is the SPRS score calculated?
Under the DoD Assessment Methodology you start at 110 and subtract a weighted value of 1, 3 or 5 points for each requirement not met, so the lowest possible score is negative 203. Without a system security plan the assessment cannot be completed. DFARS 252.204-7019 and 7020 require a current score in SPRS before award.Source: DoD CIO CMMC FAQ
Does NIST SP 800-171 Revision 3 apply now?
Not yet for DFARS contracts. NIST published Revision 3 in May 2024, but DoD has kept Revision 2 as the contractual baseline for DFARS 252.204-7012 and CMMC Level 2 through a class deviation. Build to Revision 2 today and track the Revision 3 changes so the move is easy later. Our readiness work maps both.Source: NIST SP 800-171 Rev 3
Does the CMMC pause change our 800-171 obligations?
No. The July 2026 suspension and the September 2026 class deviation remove the third-party CMMC assessment from contracts for now. They do not touch DFARS 252.204-7012, which has required NIST SP 800-171 since 2017, or the SPRS score. Primes keep asking for the score, the SSP and the POA&M.Source: DFARS Class Deviation 2026-O0025 Rev 3
What is a POA&M, and what can stay on it?
A plan of action and milestones lists each requirement you have not met yet, with an owner, the fix and a date. Assessors read it beside the system security plan. CMMC limits which requirements may stay open and for how long, so the highest-weighted items should be closed, not planned.Source: DoD CIO CMMC FAQ
Do you certify NIST SP 800-171 compliance?
No. Contractors self-assess and post the score; when a contract requires CMMC certification, only an authorized C3PAO can certify. We are the readiness partner: scoping, the 110-requirement gap assessment, the SSP, the POA&M, an honest score and the fixes, from $6,000 for a small supplier with contained CUI.
Where do we start with NIST 800-171?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do NIST 800-171 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Federal & defense: CMMC 2.0 · CJIS 6.0 · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for NIST 800-171.
Book the demo and see how one control set carries NIST 800-171 and everything else you owe. Or leave your details and an engineer replies within one business day.