NIST 800-171 is the control standard — 110 security requirements for protecting Controlled Unclassified Information. CMMC is the DoD\u2019s program for verifying you actually meet it: Level 1 self-assessment for FCI, Level 2 assessment against all 110 NIST 800-171 controls, Level 3 for the most sensitive programs. One is the ruler, the other is the inspection.
Side by side
| NIST 800-171 | CMMC | |
|---|---|---|
| What it is | A NIST publication listing 110 security requirements in 14 families | A DoD certification program with 3 levels |
| Who writes it | NIST | DoD (32 CFR Part 170) |
| Applies via | DFARS 252.204-7012 clause in contracts | DFARS 252.204-7021 as CMMC phases roll into contracts |
| Verification | Self-assessment, score submitted to SPRS (DFARS 7019/7020) | L1: annual self-assessment. L2: triennial C3PAO assessment for most. L3: government assessment |
| Scoring | SPRS: start at 110, subtract weighted deductions (range -203 to 110) | Pass requires meeting all controls; limited POA&M allowed with minimum score |
So do you comply with NIST 800-171 or with CMMC?
Both — in sequence. If you hold DoD contracts with the 7012 clause today, you are already legally required to implement NIST 800-171 and submit an SPRS score. CMMC adds third-party verification of the same controls. That is why the smart move during the current Phase 2 suspension is finishing NIST 800-171 remediation now: everything you fix counts for CMMC later, and your SPRS obligation never paused.
The practical path
Start with the full 110-control list with SPRS weights, run a self-assessment (or use our SPRS score calculator), fix the 5-point items first (MFA, FIPS-validated crypto and the other heavy deductions), then work through the CMMC compliance checklist. Costs by company size are modeled in the CMMC Cost Index; if you will need a certified assessment, here is what a C3PAO is and what one costs.
Free CMMC gap analysis
Fixed-fee assessment against all 110 controls with a real SPRS score at the end.
Check your SPRS score now
Use our free calculator — all 110 NIST 800-171 controls with official DoD weights.
FAQ
Is CMMC Level 2 just NIST 800-171?
The control set is identical — all 110 requirements. What changes is proof: Level 2 requires assessment evidence for every control, and for most contractors that assessment is performed by a C3PAO rather than yourself.
Does the CMMC suspension mean I can wait?
No. The Phase 2 suspension paused new C3PAO assessment requirements in contracts, but DFARS 7012/7019/7020 — NIST 800-171 implementation and SPRS submission — remain fully in force. Details: CMMC Phase 2 suspension explained.
What SPRS score do I need?
There is no published minimum for 7019 compliance, but a low or negative score invites scrutiny and some primes now set thresholds. A perfect score is 110; scores below ~70 typically mean MFA, FIPS or logging gaps.
Do non-US suppliers need this?
Yes — the clauses flow down to subcontractors worldwide. We specialize in CMMC for contractors outside the US: CMMC international.
ITSECOPS is a CMMC readiness consultancy working with defense suppliers on four continents. General guidance, not legal advice — your contracting officer has the final word.