CMMC and NIST 800-171: How They Work Together

What NIST 800-171 Actually Requires

NIST 800-171 is a set of 110 security controls published by the National Institute of Standards and Technology. It was written specifically to protect Controlled Unclassified Information (CUI) in non-federal systems, which means it applies to any contractor or vendor that handles sensitive government data outside of federal networks.

The 110 Controls Across 14 Families

The 110 controls in NIST 800-171 span 14 practice families, covering areas like access control, incident response, system and communications protection, and configuration management. Each control addresses a specific risk to controlled unclassified information. Some are straightforward, like requiring multi-factor authentication. Others, like conducting regular security assessments or managing audit logs, require ongoing processes and documentation.

The Self-Assessment Problem

Here’s where many contractors run into trouble. NIST 800-171 is a self-assessment framework. Your organization evaluates its own controls, scores itself using the SPRS (Supplier Performance Risk System) scoring model, and submits that score to the DoD. There’s no third party verifying your work. That creates a significant gap between what contractors report and what their actual security posture looks like, and the DoD has been aware of that gap for years. It’s a core reason CMMC exists.

What CMMC 2.0 Adds to the Picture

The Cybersecurity Maturity Model Certification (CMMC) framework was introduced to solve the self-assessment problem and raise the bar on defense contractor security. Understanding CMMC and NIST 800-171 together means understanding what CMMC layers on top of the existing requirements.

The Three-Level Structure

CMMC 2.0 organizes requirements into three levels. Level 1 covers 17 foundational practices drawn from FAR 52.204-21 and applies to contractors handling Federal Contract Information (FCI). Level 2 aligns directly with all 110 controls in NIST 800-171 and applies to contractors handling controlled unclassified information. Level 3 goes further, incorporating requirements from NIST 800-172, and is reserved for contractors working on the most sensitive DoD programs.

The Critical Difference at Level 2

If your contract involves CUI, you’re looking at CMMC Level 2. And at Level 2, self-assessment is no longer enough for most contractors. The majority of Level 2 contractors must undergo a third-party assessment conducted by a Certified Third-Party Assessment Organization (C3PAO). A limited subset of lower-risk programs may still qualify for annual CMMC self-attestation, but that determination comes from the contract language itself, not from the contractor. The shift from “we say we’re compliant” to “an independent assessor verified we’re compliant” is the single biggest structural change CMMC introduces.

Why Passing NIST 800-171 Doesn’t Mean You’re CMMC-Certified

This is the most important thing to understand, and it’s where a lot of organizations get caught off guard. Implementing the 110 controls in NIST 800-171 gets you to the right technical destination for CMMC Level 2. But the certification itself requires a formal, third-party assessment against those same controls.

Documentation Still Has to Be There

Both frameworks require a System Security Plan (SSP) that documents your environment, your controls, and how each one is implemented. They also both require a Plan of Action and Milestones (POA&M) for any controls you haven’t fully implemented yet. These documents aren’t optional paperwork. They’re what an assessor reviews. If your controls are in decent shape but your documentation doesn’t reflect that, you can fail an assessment even when your technical posture is solid.

The Timeline Is Longer Than Most Contractors Expect

Getting from “we think we’re mostly compliant” to a passed CMMC Level 2 assessment typically takes 12 to 18 months or more, depending on where you’re starting. A CMMC gap analysis identifies the distance between your current posture and full compliance, which is why it’s almost always the right first step. Skipping straight to an assessment before you’ve closed your gaps is how organizations waste significant money.

If CMMC requirements are written into your next contract and you’re not sure where your organization stands, the window to act is now. BL King Consulting has been navigating CMMC and NIST 800-171 compliance since before CMMC existed, and we’ll show you exactly where you stand.

How to Sequence Your Compliance Work

Knowing that CMMC Level 2 is built directly on NIST 800-171 gives you a clear sequence to follow. You don’t need to approach these as two separate tracks.

Start With NIST 800-171 as Your Foundation

Your first priority is implementing and documenting all 110 NIST 800-171 controls. This means auditing your current environment, closing gaps, building out your SSP, and establishing the ongoing security processes that both frameworks require. Getting NIST 800-171 right is the work. CMMC certification is the formal verification that you did it.

Understand What Handles CUI and Where

One of the most underappreciated steps in compliance preparation is defining your CUI boundary clearly. Controlled unclassified information has to be identified, tracked, and protected wherever it lives in your environment, whether that’s in email, file shares, cloud storage, or endpoints. The cleaner your CUI boundary, the smaller and more manageable your compliance scope becomes, and the more straightforward your assessment will be.

Prepare Your Documentation Before You Engage a C3PAO

Before you bring in an assessor, your SSP and POA&M need to be current, accurate, and complete. Assessors work from your documentation first. Going into an assessment with an incomplete SSP is one of the fastest ways to extend your timeline and increase your costs. Organizations that treat documentation as the final step rather than an ongoing process tend to learn that lesson the hard way.

What Non-Compliance Actually Costs You

The business consequence of falling short on CMMC and NIST 800-171 requirements isn’t abstract. For DoD contractors navigating DFARS 252.204-7012, non-compliance can mean losing the contract that drives most of your revenue. It can mean failing a CMMC assessment and being locked out of new contract opportunities while your competitors move forward. And for contractors who have misrepresented their SPRS scores, there are now False Claims Act enforcement cases to point to.

The $200,000 average cost of a cybersecurity incident is the floor, not the ceiling, for organizations that don’t have their controls in place. A compromised environment that also triggers a compliance investigation compounds those costs significantly. The frameworks exist because the risk is real, and the enforcement mechanisms exist because the DoD intends to enforce them.

Work With a Team That Knows Both Frameworks Cold

CMMC and NIST 800-171 aren’t two separate problems. They’re one compliance journey with a formal certification at the end, and the work you put into NIST 800-171 is the same work that gets you through a CMMC assessment. BL King Consulting has been in this space since 2013, before DFARS went into effect and before CMMC was written, and the team has guided contractors through Level 1, Level 2, and Level 3 engagements with 130+ security controls implemented across commercial and defense clients. If you’re trying to figure out where you stand and what it’s going to take to get certified, reach out, and let’s work through it together.