What's the relationship between 800-171 and CMMC?

CMMC Level 2 requires implementing the same 110 800-171 controls, plus a formal assessment by a C3PAO. CMMC Level 3 adds additional controls from NIST 800-172. So 800-171 work directly transfers to CMMC.

Do we need to be assessed?

For DFARS, primes generally rely on contractor self-assessments scored and posted to SPRS. For CMMC Level 2, a C3PAO assessment is required. Many contractors run a basic self-assessment now and prepare for CMMC formally.

What is the SPRS score?

The Supplier Performance Risk System score is a numeric value (from 110 down to -203 depending on non-compliance) that you submit to DoD reflecting your 800-171 self-assessment status. Many primes filter subs based on SPRS score.

800-171 without the SSP-Word-document slog

Protect CUI without the spreadsheet

All 14 control families and 110 security requirements pre-mapped. SSP and POA&M workflows ready out of the box. A lift-and-shift path to CMMC Level 2.

Start free trial Book a demo

What is NIST 800-171?

NIST Special Publication 800-171 ("Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations") is a set of 110 security requirements that organizations must meet when they handle Controlled Unclassified Information on behalf of the US federal government. It is the operative standard underneath DFARS 252.204-7012 (and -7019/-7020/-7021), making it a baseline obligation for nearly every Department of Defense contractor and subcontractor.

The 110 controls are organized into 14 families and are derived from a tailored subset of NIST 800-53 controls. Rev. 2 (published 2020) is the current revision; Rev. 3 is on the NIST roadmap.

Who needs 800-171

If you're a DoD prime or subcontractor handling Controlled Unclassified Information — or if you expect to be one — 800-171 applies to you. Many primes flow the obligation down to their entire supply chain via contract.

How episki helps

episki ships the full 800-171 Rev. 2 catalog at the requirement level. The SSP, POA&M, and SPRS score are produced from your real control evidence — no parallel Word document. When you're ready to formalize for CMMC Level 2, the same controls map directly to CMMC practices.

NIST 800-171 outcomes with episki

Quantify the impact security and compliance brings to your business.

110 controls

The full 800-171 Rev. 2 catalog implemented as living episki controls.

14 families

Access Control through System and Information Integrity, all covered.

CMMC L2 ready

The 110 controls are the foundation of CMMC Level 2 — same evidence, same workspace.

Why teams choose episki for NIST 800-171

Framework-specific automation, collaboration, and reporting in one workspace.

14 control families, pre-mapped

Every 800-171 requirement implemented as a control with mapped evidence and testing.

Access Control, Audit, AT, CM, IR, MA, MP, PE, PS, RM, CA, SC, SI
Identification & Authentication, plus all enhancements
Pre-built testing procedures per requirement

SSP and POA&M

Generate your System Security Plan and Plan of Action & Milestones from live evidence.

SSP narrative composed from real controls
POA&M items tracked to closure
Self-assessment scoring per DFARS 252.204-7019/-7020

Bridge to CMMC Level 2

The same 110 controls map directly to CMMC L2 practices, so your 800-171 work isn't wasted.

CMMC Level 2 practice mapping
C3PAO-friendly evidence packaging
Reuse 800-171 evidence in your CMMC assessment

NIST 800-171 readiness inside episki

Everything DoD primes look for, ready to deploy.

Plug episki into your stack and work directly from this checklist during the free trial.

✓ 800-171 Rev. 2 control catalog at the requirement level
✓ SSP narrative generated from control evidence
✓ POA&M tracking with milestone management
✓ DFARS self-assessment scoring methodology
✓ Supplier Performance Risk System (SPRS) score export
✓ CMMC Level 2 practice mapping

NIST 800-171 accelerators

NIST 800-171 program accelerators

Move from "we got the letter from our prime" to a credible SSP fast.

SPRS scoring calculator

Compute your DoD self-assessment score with the official methodology.

SSP generator

Compose the SSP narrative from your control implementations.

CMMC Level 2 mapping

See exactly which 800-171 controls become which CMMC practices.

NIST 800-171 frequently asked questions

Other compliance frameworks

CCPA / CPRA CMMC FedRAMP GDPR HIPAA HITRUST CSF ISO 27001 ISO 27701 ISO 42001 NIST 800-53 NIST CSF PCI DSS SOC 1 Type I/II SOC 2 Type I/II SOX

Get a credible 800-171 program standing

Start in episki, score yourself, and bridge to CMMC Level 2 in the same workspace.

Start free trial Book a walkthrough