NIST Assessment Guide: 800-171, CMMC and Control Assessments

Which “NIST assessment” do you mean?

People searching for a NIST assessment usually need one of three things:

Assessment	Based on	Who needs it
NIST SP 800-171 self-assessment / CMMC	SP 800-171 requirements for Controlled Unclassified Information (CUI); CMMC program (32 CFR Part 170)	Defense contractors and subcontractors handling Federal Contract Information or CUI
Security control assessment	NIST SP 800-53A Rev. 5 (January 2022) procedures for assessing SP 800-53 controls	Federal systems, FedRAMP cloud services and organizations using 800-53 as their control set
NIST CSF assessment	NIST Cybersecurity Framework 2.0 profiles	Any organization measuring its program against CSF outcomes (see our cybersecurity risk assessment guide)

For a NIST CSF 2.0 gap assessment template, see NIST CSF 2.0 Gap Assessment Template: Current vs Target Profiles.

CMMC: the dates that matter now

The CMMC program rule (32 CFR Part 170) took effect December 16, 2024. The contract rule (48 CFR, DFARS) was published September 10, 2025 and took effect November 10, 2025, according to Cooley. It phases in requirements:

Phase	Date	Requirement
1	November 10, 2025	Level 1 or Level 2 self-assessment required at award
2	November 10, 2026	Level 2 certification by a third-party assessor (C3PAO) required at award
3	November 10, 2027	C3PAO certification to exercise options; Level 3 required at award
4	November 10, 2028	Full implementation across applicable contracts

Level 1 covers 15 basic requirements for Federal Contract Information. Level 2 implements NIST SP 800-171 Rev. 2 for CUI, by self-assessment for some contracts and by C3PAO certification for others. Level 3 adds 24 enhanced requirements from SP 800-172, assessed by DoD. Contractors need a current status in SPRS and an annual affirmation by an “affirming official.” Primes must verify their subcontractors directly, Cooley notes, because DoD will not share subcontractor SPRS data with them.

Note the version: NIST published SP 800-171 Rev. 3 in May 2024, but CMMC Level 2 is tied to Rev. 2.

How a NIST 800-171 / CMMC Level 2 self-assessment works

Under 32 CFR 170.16 and 170.24:

Every requirement is scored MET or NOT MET. Requirements carry 5, 3 or 1 points depending on how much harm a gap could cause.
A NOT MET requirement needs a plan of action and milestones (POA&M), but “a POA&M addressing NOT MET security requirements is not a substitute for a completed requirement.” No POA&M is permitted at Level 1.
With qualifying POA&Ms, the result is a Conditional status. All gaps must be closed and a closeout assessment posted to SPRS within 180 days, or the status expires.
Level 2 self-assessments are repeated every three years, with affirmations annually.
Assessment artifacts must be kept for six years.

Practical steps

Scope. Identify where FCI and CUI are stored, processed or transmitted, including cloud services and subcontractors.
System security plan. Describe how each requirement is implemented.
Assess each requirement using the companion SP 800-171A procedures: examine documents, interview people, test mechanisms.
Score and record NOT MET items with POA&Ms.
Remediate within 180 days where conditional status applies.
Submit to SPRS and affirm.
Prepare for C3PAO if your contracts will require certification from November 2026.

Security control assessments with SP 800-53A

NIST SP 800-53A Rev. 5 provides procedures to assess security and privacy controls, which can be tailored to an organization’s risk tolerance, and guidance on assessment plans and analyzing results. A control assessment answers three questions per control: is it implemented correctly, operating as intended, and producing the desired outcome? It is the testing layer underneath risk assessments, authorizations and audits.

Evidence that holds up

Requirement area	Typical evidence
Access control	Access policy, user lists, access review records, MFA configuration
Audit and accountability	Log configuration, retention settings, review records
Configuration management	Baselines, change tickets, scan results
Incident response	Plan, test records, incident tickets
Media protection	Procedures, encryption settings, disposal records
Personnel security	Screening and termination procedures, records
System and communications protection	Network diagrams, boundary configurations, encryption evidence

The common failure is a system security plan that says one thing and evidence that shows another.

Common weaknesses

CUI scope drawn too narrowly, leaving systems or cloud services out
System security plans copied from templates
Scores reported to SPRS without evidence to support them
POA&Ms that run past 180 days
Subcontractors not verified
Confusing Rev. 3 with the Rev. 2 baseline CMMC requires

NIST assessment checklist

Check NIST evidence with AskDona

CMMC and 800-171 assessments come down to whether the system security plan and the evidence agree. AskDona reads the SSP, policies, configuration exports, logs and records against each requirement, flags requirements with missing or contradictory evidence, and links each finding to its source page so your team can fix gaps before an assessor finds them. Run a sample NIST evidence review on one requirement family. AskDona shows the evidence; your compliance team decides.

FAQ

What is a NIST 800-171 self-assessment? An evaluation of whether your systems handling CUI meet each NIST SP 800-171 requirement, scored and reported to DoD’s SPRS.

When is CMMC Level 2 certification required? From November 10, 2026 (Phase 2), solicitations can require Level 2 certification by a C3PAO at award.

Does CMMC use NIST 800-171 Rev. 3? No. CMMC Level 2 is based on Rev. 2, although NIST published Rev. 3 in May 2024.

What is a security control assessment? Testing whether security controls are implemented correctly, operating as intended and producing the desired outcome, often using NIST SP 800-53A procedures.

Can I have open items and still be eligible? With a qualifying POA&M you can hold a Conditional status, but all gaps must be closed within 180 days.

References

All pages opened and checked by October 14, 2026.

Source	Type	Used for
Cooley, DoD final rule implementing CMMC contract clause (Sept 2025)	Law firm insight	DFARS rule, phases, levels
Greenberg Traurig, DoD publishes final CMMC program rule (Oct 2024)	Law firm alert	32 CFR effective date
eCFR, 32 CFR 170.16	US regulation	Level 2 self-assessment
eCFR, 32 CFR 170.24	US regulation	Scoring and POA&Ms
NIST SP 800-171 Rev. 3	US standards publication	Rev. 3 date
NIST SP 800-53A Rev. 5	US standards publication	Control assessment procedures