Security · Compliance & Audit Readiness · 03
NIST SP 800-171 gap assessment
A NIST SP 800-171 gap assessment measures an organization’s implementation of the security requirements for protecting Controlled Unclassified Information in nonfederal systems, requirement by requirement, with objective evidence. It is needed when a contract requires compliance with the publication, when a self-assessment score must be reported, when a prime contractor or customer asks for the organization’s status, or as the foundation of CMMC readiness. The assessment produces a status for every requirement with the evidence examined, the resulting score and the requirements that most affect it, the Plans of Action and Milestones for what is not yet met, and the System Security Plan content that describes how each requirement is satisfied.
Scope
What the review covers.
- Boundary definition for the systems that handle CUI
- Assessment of each requirement against the assessment objectives
- Evidence examination, interviews and technical verification
- Scoring and the requirements with the greatest score impact
- Plans of Action and Milestones for unmet requirements
- System Security Plan content for met requirements
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Gap assessment report | Every requirement with status, evidence and notes |
| Score and impact analysis | The score and what changes it most |
| Plans of Action and Milestones | Owners, dates and dependencies |
| System Security Plan content | Descriptions of how met requirements are satisfied |
Prerequisites
What we need from you.
- The contractual clause that requires compliance and any reporting deadline
- Identification of the systems that store, process or transmit CUI
- Access to those systems and to the people who administer them
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is the score reported to anyone?
Contracts may require reporting a self-assessment score. The report gives you an accurate score and the record behind it; what you report is your decision.
What if we have no System Security Plan?
The assessment produces the content for one. A plan that describes the real environment is more valuable than a template.
How does this relate to CMMC?
CMMC practices derive from these requirements. This assessment is the first step of CMMC readiness and stands on its own where CMMC is not yet required.