The Cybersecurity Maturity Model Certification, or CMMC, has been a topic of conversation for a few years within the Defense Industrial Base (DIB). CMMC is a unified standard for implementing cybersecurity across the DIB, which includes over 300,000 companies in the supply chain. The CMMC is the DoD’s response to significant compromises of sensitive defense information located on contractors’ information systems. The US Department of Defense (DoD) released the much-anticipated Cybersecurity Maturity Model Certification (CMMC) version 1.0•• on January 31, 2020. Since then, CMMC has undergone much scrutiny and discussion. Here is a timeline of CMMC:

September 2020: The CMMC program published by the DoD (now known as CMMC 1.0). This framework assesses a Defense Industrial Base (DIB) contractor’s compliance with a set of cybersecurity standards.

November 2020: A Presidential interim rule became effective, establishing a five-year phase-in period and requiring compliance with NIST 800-71 rules.

March 2021: The DoD announced an internal review of CMMC’s implementation.

November 2021: The DoD announced CMMC 2.0, and updated program and requirements designed to meet certain goals, including:

  • Protecting sensitive information to enable and protect the warfighter.
  • Dynamically enhance DIB cybersecurity to meet evolving threats.
  • Ensuring accountability while minimizing barriers to compliance with DoD requirements.
  • Contributing to a collaborative culture of cybersecurity and cyber resilience.
  • Maintaining public trust through high professional and ethical standards.

Businesses of all sizes are increasingly aware of the need to protect their data and systems from cyberthreats. To meet this need, the National Institute of Standards and Technology (NIST) has developed NIST 800-171, a set of security requirements designed to help organizations protect sensitive information from unauthorized access or disclosure.

This article will provide an overview of NIST 800-171 and discuss who needs to comply with it and its control families. We’ll also outline typical compliance standards and compliance checklists. Working with a reputable Managed Security Services Provider like Braxton-Grant Technologies with the knowledge and experience is one of the most cost effective ways to understand the requirements and develop a plan of action . . . let’s dive right in!

Where is the NIST 800-171 Requirement Levied

The Defense Federal Acquisition Supplement (DFARS) 252.227-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting” clause is found in Government RFPs and finalized contracts. This clause contains the requirements for NIST 800-171, Fedramp when using cloud providers, and Cyber Incident Reporting.

As a note, companies the come under the FAR 52.204-21 Basic Safeguarding

What Is NIST 800-171

NIST 800-171 is a set of standards developed by the National Institute of Standards and Technology (NIST) to protect sensitive information from unauthorized access or disclosure. This standard applies to all organizations that handle sensitive data belonging to the U.S. government, and it requires these organizations to implement specific security controls designed to protect this data. NIST 800-171 aims to ensure that federal information is adequately protected regardless of where it is stored or processed.

Who Needs To Comply With NIST 800-171?

Organizations that handle sensitive data belonging to the U.S. government must comply with NIST 800-171 requirements. This includes contractors and subcontractors who manage government information systems and organizations that store or process government data, even if they do not have direct contracts with the government. Compliance with NIST 800-171 helps protect federal agencies from potential cyberthreats and vulnerabilities associated with handling sensitive data.

The NIST Compliance Standards

NIST 800-171 consists of numerous control standards designed to help protect sensitive information from unauthorized access or disclosure:

  • Access control:
    Organizations must develop and employ policies, procedures, and technical controls to grant authorized personnel access to federal information systems.

  • Awareness and training:
    Organizations must provide appropriate security awareness training and job-specific training for all personnel accessing federal systems regularly.

  • Audit & accountability:
    Organizations must track user activity on their networks to monitor access attempts, detect malicious activity, audit system usage, and assess compliance with security policies.

  • Configuration management:
    Organizations must create change management processes for their IT systems to maintain the security posture of federal systems over time.

  • Identification and authentication:
    Organizations must identify users on their network before granting them access to any data or system resources to ensure that only authorized individuals can access information assets stored on organizational networks.

  • Incident response:
    Organizations must establish response plans in case of a security incident, such as a breach or attack on their networks, so they can quickly address any potential damage caused by such incidents.

  • Maintenance:
    Organizations must evaluate their IT environment regularly to understand any changes that need to be made while identifying potential vulnerabilities that could be exploited by adversaries targeting such environments

  • Media protection:
    Organizations must apply physical protections such as locks and encryption techniques when storing media containing confidential information on removable storage devices so the media cannot be accessed without authorization.

  • Personnel security:
    Organizations need to vet all personnel who may come into contact with confidential data for them to guarantee trustworthiness when accessing/dealing with such data assets.

  • Physical protection:
    Organizations should enforce physical protection mechanisms like locks at their facilities hosting federal data assets so that only authorized personnel can access the premises.

  • Risk assessment:
    Organizations should conduct routine risk assessments to evaluate possible threats posed against its network environment, its personnel, the services provided by third parties, etc.

  • System and information integrity:
    Organizations should ensure the reliability, accuracy, completeness, and timeliness of their IT systems through routine maintenance, updates, etc.

  • System and services acquisition:
    Organizations should consider carrying out specified due diligence exercises during acquisition phases like hardware procurement, software deployment, etc.

Need a Gap Assessment? Reach out to Braxton-Grant and let us simplify the process for you.

NIST Compliance Assessment

The Complete NIST 800-171 Compliance Checklist

By following this comprehensive NIST 800-171 compliance checklist, businesses can ensure their systems and data are properly protected and compliant with standard regulations.

Identify the Scope of Your Company’s Environment

This first step includes outlining the system components subject to NIST 800-171 requirements, defining what data is considered CUI, and establishing who has access to this data. Knowing the complete scope of your network helps you determine what security measures need to be implemented.

Ensure Stakeholder Buy-In

For NIST 800-171 compliance checklists to be successful, the organization must have stakeholder buy-in from the top down. All departments should be aware of the importance of NIST 800-171 compliance and its implications for the company. It is also crucial that all stakeholders clearly understand their individual roles in maintaining compliance with NIST regulations.

Gap Assessment

Once the company has committed to complying with NIST 800-171, a Gap Assessment must be done. The assessment should leverage a NIST 800-171 automated compliance tool to reduce manual labor, improve accuracy, and leverage document templates.. The assessment provides a starting point for mitigation using the generated Plans of Action and Milestones (POAMs).

Plans of Action and Milestones (POAMs)

This implementation strategy for each applicable control, identifying resources needed for implementation, outlining timelines for completion, and creating metrics for measuring progress toward full compliance with NIST standards.


Mitigation is the process of executing the POAMs. The POAMs are organized in a priority manner to maximize benefit, cost, and time. The mitigation process includes technology and documentation.

Provide Supporting Documentation

In order to verify compliance with NIST regulations and demonstrate due diligence efforts taken by the organization, businesses must provide supporting documentation such as policies, procedures, and audit records that prove they are adhering to all applicable standards set forth by NIST 800-171 regulations.

Create Policies for Compliance Measures That Fail

Even with diligent efforts taken by organizations towards achieving compliance with NIST 800-171 standards, sometimes specific measures may fail or fall short of expectations or requirements set forth by regulators. To protect against such events, it is important to create policies that specifically outline steps necessary when dealing with failed or inadequate security measures to prevent further violations from occurring in the future.

Braxton-Grant Technologies: An Industry-Leading Provider of NIST 800-171 Compliance

Braxton-Grant is an experienced cyberdefense consultant with NIST 800-171 experts to help you prepare for DoD contract requirements. Our cost-effective approach ensures that your compliance goals can be met in a timely and affordable manner. To discover more details on our innovative three-step plan, give us a call today.