Insights · Field note · Security assurance and compliance
NIST SP 800-171 gap assessments: common findings
Across contractors of different sizes, gap assessments against 800-171 turn up the same families of findings. Knowing them shortens the work.
Gap assessments against NIST SP 800-171 produce findings concentrated in a few families: access control, where least privilege and session rules are undocumented or unenforced; audit and accountability, where logs exist but are not reviewed or protected; configuration management, where baselines are absent and changes unrecorded; identification and authentication, where MFA coverage has exceptions; incident response, where a plan exists but was never tested; risk assessment and security assessment, where neither is periodic; and system and communications protection, where boundaries and encryption are assumed rather than shown. The findings are consistent because the requirements test operation, and operation is what most organizations have not evidenced.
In detail
What the evidence shows.
Access control and authentication
Requirements for least privilege, separation of duties, session lock and termination, remote access control and MFA are among the most numerous and the most frequently partial. The common gap is not absence but exceptions: the administrator account outside MFA, the shared account, the vendor connection nobody governs.
Audit, configuration and change
Logs that are generated and never reviewed. No defined retention. No protection against modification. Configuration baselines that were never written, so there is nothing to compare running systems against. Changes made without records. These requirements produce evidence only when the discipline runs, and the discipline is what is missing.
Assessment, response and risk
Periodic risk assessment, periodic security assessment, a tested incident response capability and a plan of action for deficiencies are all required. Contractors frequently have one of each from years ago. The requirement is a cycle, and the evidence is the cycle running.
Using the pattern
A gap assessment that starts from the common findings tests them first and documents them precisely, with consequence ratings and actions. The gap assessment template structures each row; see NIST SP 800-171 gap assessment and NIST CSF versus NIST SP 800-171.
Sources
Primary references.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days