For buyers
Fractional CISO (fCISO)
Learn more
Both
CMMC L2 / NIST SP 800-171 gap
We map your CUI environment against NIST SP 800-171 so your SPRS score and affirmation have real evidence behind them.
Who it’s for
Organizations that handle Controlled Unclassified Information, or are about to, and need to know where they really stand against NIST SP 800-171. That might be for an SPRS score, a prime’s flow-down, or the senior official who has to sign the annual affirmation. Consulting firms also bring us in for this work as a subcontractor.
Most Level 2 trouble starts with scope. We trace where CUI actually lives, then go practice by practice through NIST SP 800-171 Rev. 2, marking each one met, partial, or open and tying it to the assessment objectives in NIST SP 800-171A.
You come away with an SSP outline that matches the environment you actually run, an evidence index, and a POA&M with an owner and a date on every open item. If you’re producing an SPRS score, we help you land on a number you can explain, and we flag what your affirming official is putting their name to each year. Miss that annual affirmation and your Level 2 status lapses, so it belongs on someone’s calendar.
If C3PAO assessments come back for new awards, this is the same evidence an assessor would ask to see.
Deliverables
- CUI scoping: systems, people, facilities, and the boundary.
- A gap review mapped to NIST SP 800-171 practices and NIST SP 800-171A objectives.
- A System Security Plan outline and an evidence index.
- A POA&M with an owner and a target date on each open item.
- Notes for preparing your SPRS self-assessment score and the annual affirmation.
Timeline
Tell us the contract deadline and what evidence you already have. The quote names the first two steps and the dates.
Related
Next step
Start with a 30-minute call.
Tell us what you’re working on and when it’s due, and we’ll tell you the first two steps.
30-minute intro call on Google Meet