What's the relationship between 800-171 and CMMC?

CMMC Level 2 requires implementing the same 110 800-171 controls, plus a formal assessment by a C3PAO. CMMC Level 3 adds additional controls from NIST 800-172. So 800-171 work directly transfers to CMMC.

Do we need to be assessed?

For DFARS, primes generally rely on contractor self-assessments scored and posted to SPRS. For CMMC Level 2, a C3PAO assessment is required. Many contractors run a basic self-assessment now and prepare for CMMC formally.

What is the SPRS score?

The Supplier Performance Risk System score is a numeric value (from 110 down to -203 depending on non-compliance) that you submit to DoD reflecting your 800-171 self-assessment status. Many primes filter subs based on SPRS score.

800-171 without the SSP-Word-document slog

Protect CUI without the spreadsheet

All 14 control families and 110 security requirements pre-mapped. SSP and POA&M workflows ready out of the box. A lift-and-shift path to CMMC Level 2.

Start free trial Book a demo

What is NIST 800-171?

NIST Special Publication 800-171 ("Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations") is a set of 110 security requirements that organizations must meet when they handle Controlled Unclassified Information on behalf of the US federal government. It is the operative standard underneath DFARS 252.204-7012 (and -7019/-7020/-7021), making it a baseline obligation for nearly every Department of Defense contractor and subcontractor.

The 110 controls are organized into 14 families and are derived from a tailored subset of NIST 800-53 controls. NIST published Rev. 3 in May 2024 — the current revision of the standard itself — but the Department of Defense still requires Rev. 2 (published 2020) for DFARS and CMMC compliance until a future rulemaking adopts Rev. 3. For defense contractors today, Rev. 2 remains the operative baseline.

Who needs 800-171

If you're a DoD prime or subcontractor handling Controlled Unclassified Information — or if you expect to be one — 800-171 applies to you. Many primes flow the obligation down to their entire supply chain via contract.

How episki helps

episki maps all 110 requirements to controls evaluated on every sync, derives the CMMC crosswalk through the SCF hub with recorded provenance, and turns a failing check into a POA&M item with an owner and a due date that syncs into Jira, Linear, or GitHub. The CUI boundary is enforceable through scope rules on cloud account, region, resource, and tag. Start a free trial or book a demo.

NIST 800-171 outcomes with episki

Quantify the impact security and compliance brings to your business.

110 controls

The full 800-171 Rev. 2 catalog implemented as living episki controls.

14 families

Access Control through System and Information Integrity, all covered.

CMMC L2 ready

The 110 controls are the foundation of CMMC Level 2 — same evidence, same workspace.

Why teams choose episki for NIST 800-171

Framework-specific automation, collaboration, and reporting in one workspace.

14 control families, pre-mapped

Every 800-171 requirement implemented as a control with mapped evidence and testing.

Access Control, Audit, AT, CM, IR, MA, MP, PE, PS, RM, CA, SC, SI
Identification & Authentication, plus all enhancements
Pre-built testing procedures per requirement

SSP and POA&M

Generate your System Security Plan and Plan of Action & Milestones from live evidence.

SSP narrative composed from real controls
POA&M items tracked to closure
Self-assessment scoring per DFARS 252.204-7019/-7020

Bridge to CMMC Level 2

The same 110 controls map directly to CMMC L2 practices, so your 800-171 work isn't wasted.

CMMC Level 2 practice mapping
C3PAO-friendly evidence packaging
Reuse 800-171 evidence in your CMMC assessment

NIST 800-171 readiness inside episki

Everything DoD primes look for, ready to deploy.

Plug episki into your stack and work directly from this checklist during the free trial.

✓ 800-171 Rev. 2 control catalog at the requirement level
✓ SSP narrative generated from control evidence
✓ POA&M tracking with milestone management
✓ DFARS self-assessment scoring methodology
✓ Supplier Performance Risk System (SPRS) score export
✓ CMMC Level 2 practice mapping

NIST 800-171 accelerators

NIST 800-171 program accelerators

Move from "we got the letter from our prime" to a credible SSP fast.

SPRS scoring calculator

Compute your DoD self-assessment score with the official methodology.

SSP generator

Compose the SSP narrative from your control implementations.

CMMC Level 2 mapping

See exactly which 800-171 controls become which CMMC practices.

NIST 800-171 frequently asked questions

Get a credible 800-171 program standing

Start in episki, score yourself, and bridge to CMMC Level 2 in the same workspace.

Start free trial Book a walkthrough