CMMC builds directly on NIST Special Publication 800-171 by turning self-attestation into a formal, verifiable compliance program for Department of Defense contractors. The mapping is close to one for one. Level 1 draws from the 15 basic safeguarding requirements in FAR 52.204-21, Level 2 is the 110 security requirements in NIST SP 800-171 Revision 2, and Level 3 adds 24 enhanced requirements from NIST SP 800-172.

Almost nothing changes about the controls themselves when you map one to the other. What changes is the standard of proof. A contractor who met NIST 800-171 by writing a policy that says multifactor authentication is in use now has to produce the configuration, the logs, and the records that show it has been in use continuously.

Below we cover the mapping level by level, where the two frameworks genuinely differ, how scoring works and where partial credit is allowed, what suppliers should expect in practice, how to run a self-assessment, and what happens when the underlying NIST standard moves to Revision 3.

How Does NIST Map to CMMC Levels?

NIST maps to CMMC levels in a direct, published alignment: Level 1 to FAR 52.204-21, Level 2 to NIST SP 800-171 Revision 2, and Level 3 to selected requirements from NIST SP 800-172. The Department of Defense built the program this way deliberately, leveraging existing federal requirements rather than inventing a separate control set.

The alignment below comes from the DoD Chief Information Officer's published guidance on CMMC alignment to NIST standards and from the CMMC program rule at 32 CFR Part 170.

CMMC LevelSource StandardRequirementsData ProtectedAssessment PathLevel 1 (Foundational)FAR 52.204-2115 basic safeguarding requirementsFederal Contract InformationAnnual self-assessmentLevel 2 (Advanced)NIST SP 800-171 Rev. 2110 requirements across 14 familiesControlled Unclassified InformationSelf-assessment or third-party assessment, every three years with annual affirmationLevel 3 (Expert)NIST SP 800-17224 enhanced requirements, on top of all 110The most sensitive CUIGovernment assessment by DIBCAC, after a Final Level 2 status

Level 3 carries a prerequisite worth noting, because it changes sequencing for anyone aiming there. A company cannot pursue Level 3 directly; it must first hold a Final Level 2 status from a third-party assessment, then meet the enhanced requirements aimed at advanced persistent threats. That ordering makes Level 2 the practical centre of gravity for the whole program, which is why most NIST compliance work in the defense base targets the 110.

What Are the Requirements for NIST and CMMC Compliance?

The requirements for NIST and CMMC compliance are the same technical requirements measured two different ways. NIST SP 800-171 Revision 2 states what has to be implemented to protect Controlled Unclassified Information on nonfederal systems. CMMC states which of those requirements apply to your contract, who verifies them, how often, and what you must affirm afterward.

DFARS 252.204-7012 is the clause that makes the NIST side contractually binding, and it has done so since 2017. CMMC did not add security requirements to that clause so much as add a verification layer on top of it. Building to the 110 therefore serves both obligations at once, which is the single most useful thing to know before any CMMC readiness work begins.

What Are the 14 NIST 800-171 Control Families?

The 14 NIST SP 800-171 control families are access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

Those families carry all 110 requirements, and CMMC Level 2 adopts them without modification. The families most often found incomplete during an assessment are audit and accountability, where logging exists but review does not, and configuration management, where baselines are documented but drift is unmonitored.

What Is the Difference Between NIST 800-171 and 800-172?

The difference between NIST SP 800-171 and NIST SP 800-172 is the threat each one addresses. NIST SP 800-171 sets the baseline for protecting CUI on nonfederal systems. NIST SP 800-172 supplements that baseline with enhanced requirements aimed specifically at advanced persistent threats, the sophisticated and persistent adversaries that defeat ordinary controls.

CMMC uses 24 of those enhanced requirements for Level 3, and they come with Organization-Defined Parameters, which let an organization set specific values to fit its mission while still meeting the intent of the control. Flexibility of that kind is useful and it creates governance work, since every parameter you set has to be justified, approved, and tracked.

What Is the Difference Between CMMC and NIST?

The difference between CMMC and NIST is that NIST defines the security requirements and CMMC verifies that you implemented them. One is a standards body publishing guidance. The other is a Department of Defense program with assessment types, reporting obligations, affirmations, and contractual consequences attached.

That difference exists because the honor system failed. Contractors self-reported compliance with NIST SP 800-171 for years, and the gap between reported and implemented security proved wide enough that the Department built a verification program around it. CMMC is the answer to a measurement problem rather than a security problem, which is why government contractors who were genuinely compliant all along often find the transition straightforward.

Does CMMC Replace NIST 800-171?

No, CMMC does not replace NIST SP 800-171. CMMC Level 2 is defined as implementing those 110 requirements, so the standard sits inside the program rather than beside it. A contractor cannot satisfy Level 2 without satisfying NIST SP 800-171 Revision 2, and there is no alternative control set that substitutes for it.

The practical consequence is that existing NIST work carries forward completely. An organization already running the 110 requirements has implemented virtually everything Level 2 asks for, and the remaining effort sits in scoping rigor, evidence, and documentation rather than in new technology.

Does the DoD Use NIST?

Yes, the Department of Defense uses NIST standards throughout its cybersecurity requirements. CMMC Level 2 uses NIST SP 800-171 Revision 2, Level 3 uses NIST SP 800-172, scoring runs against the assessment objectives in NIST SP 800-171A, and the federal systems side of the house uses NIST SP 800-53.

Leveraging existing federal standards was a stated design goal rather than a convenience. Using published NIST publications gives contractors a stable target, lets the Department reuse assessment guidance it already maintains, and avoids forcing the defense base to learn a separate control language built only for defense work.

Is NIST 800-53 the Same as CMMC?

No, NIST SP 800-53 is not the same as CMMC, and the two rarely apply to the same systems. NIST SP 800-53 is the control catalog for federal information systems, used by agencies and by cloud services seeking FedRAMP certification. CMMC governs contractor-owned systems through NIST SP 800-171, which was derived from 800-53 and adapted for nonfederal environments.

One place the two meet is your cloud. DFARS 252.204-7012 requires external cloud providers holding covered defense information to meet security equivalent to the FedRAMP Moderate baseline, and FedRAMP baselines are drawn from NIST SP 800-53. So your own systems answer to 800-171 while the platforms inside your boundary answer to 800-53 through a different program.

How Scoring Works When You Map NIST to CMMC

Scoring follows the DoD Assessment Methodology, which evaluates the assessment objectives published in NIST SP 800-171A. You start at 110 points and subtract the assigned value of each requirement that is not met, with values of 1, 3, or 5 points and a resulting range from negative 203 to 110. The minimum passing score is 88.

There is no partial credit for a requirement that is mostly implemented. A control is met or it is not, which is the arithmetic reason optimistic self-scores collapse under assessment. A requirement worth 5 points that is 90 percent complete costs the full 5 points.

Requirements that are not met can be carried on a plan of action, within limits, and those items must close within 180 days. Certain requirements cannot be placed on a POA&M at all and have to be met on assessment day, which makes the choice of what to defer a planning decision rather than an afterthought.

Can You Get Partial Credit on a NIST 800-171 Score?

Yes, partial credit exists for exactly two requirements, and the DoD guidance states the rules precisely. Multifactor authentication costs 5 points if it is not implemented or implemented only for general users rather than remote and privileged users, and 3 points if it is implemented for remote and privileged users but not for general users. Cryptography costs 5 points if none is employed and 3 points if cryptography is employed but is not FIPS-validated.

Those two exceptions matter more than their size suggests, because they are the two requirements most often found half-finished. Multifactor authentication enabled for administrators and not for the staff who actually handle CUI is the single most common partial state we see. Encryption that is turned on but not FIPS-validated is the second. Knowing that each one has a defined point consequence turns a vague worry into a scoring line you can plan around.

What DoD Suppliers Should Expect

Suppliers mapping NIST to CMMC should expect the same controls assessed to a much higher standard of proof, a smaller and more deliberate data boundary, and a single combined project rather than two parallel compliance efforts. The technology changes least. The discipline around it changes most.

That shift is where most of the real work sits, and it is why we deliver this as managed compliance with a fixed monthly fee rather than as a project with an end date. Evidence has to exist continuously, not on the day someone asks for it.

The Shift From Saying to Showing

Under traditional NIST self-attestation, a policy document stating that multifactor authentication is in use was frequently treated as sufficient. Under CMMC, an assessor expects technical artifacts that demonstrate the control operates, and expects them to match what your documentation claims.

Evidence an assessor will ask for includes:

• System configurations showing the control as actually deployed, not as intended
• Log exports covering a meaningful period rather than a sample generated last week
• Ticket and change history demonstrating that the process described in your procedures is the process people follow
• Written procedures that line up exactly with the system security plan rather than contradicting it
• Training records with dates, completion status, and content
• Personnel interviews, since assessors ask the people operating the systems how things actually work

Mismatch is what fails assessments. A plan describing a quarterly log review against a log platform showing no reviews for eight months is a finding regardless of how secure the environment genuinely is. Keeping the System Security Plan synchronized with the live environment is therefore a maintenance task rather than a writing task.

Tightening the CUI Scope

Suppliers should expect scope to receive more rigor than it did under internal NIST reviews. Many organizations that passed their own reviews never defined the CUI environment precisely, never drew the supporting asset boundary, and never documented which controls they inherit from cloud providers.

Shrinking the footprint is the strongest cost lever available. Isolating the specific network segments, servers, and people that touch CUI reduces the number of assets subject to every one of the 110 requirements, and the saving compounds across documentation, monitoring, and evidence collection. A dedicated enclave usually costs less over time than hardening an entire corporate network, particularly for companies where defense work is a minority of revenue. What a CMMC audit examines first is exactly that boundary, so defining it carelessly is expensive in both directions.

One Project, Not Two

Treating NIST remediation and CMMC readiness as separate initiatives produces duplicate tool purchases, mismatched documentation, and twice the meetings. They are the same 110 requirements. The only separation worth maintaining is between implementing a control and evidencing it, and even that is one workflow rather than two projects.

Combined preparation also fits how most defense suppliers are staffed, which is why we scope compliance support around one effort rather than two. The same small group runs the network, writes the policies, and answers the prime's questionnaire, and splitting their attention across two compliance tracks guarantees that neither finishes.

What the Phase 2 Suspension Changed

As of early October 2026, the third-party assessment gate is paused. The Department of War suspended the CMMC Phase 2 transition on July 13, 2026, and during the suspension requiring activities may designate only Level 1 (Self) or Level 2 (Self).

Nothing in the NIST mapping changed. The 110 requirements, DFARS 252.204-7012, SPRS scoring, and annual affirmations all continue exactly as before, and the Department has said it will enforce NIST SP 800-171 Revision 2 during the interim through self-assessments and selected government-led assessments. If anything, the suspension raises the stakes on self-scoring accuracy, because the outside reviewer who would have checked your arithmetic is temporarily out of the process. Our post on CMMC certification covers what the suspension did and did not touch in detail.

How to Perform a CMMC Self-Assessment

You perform a CMMC self-assessment by scoping the environment, assessing each applicable requirement against the NIST SP 800-171A objectives, scoring the result, documenting it, posting the score to SPRS, and affirming it. Self-assessment is the active path during the current suspension, which makes doing it honestly more important than doing it quickly.

1. Define the boundary. Identify every system, segment, and location that processes, stores, or transmits FCI or CUI, and document what sits outside it and why.
2. Assess against the objectives. Work requirement by requirement using the assessment objectives rather than the requirement text alone, since that is what a government assessor will use.
3. Score the result. Start at 110, subtract the assigned value of each unmet requirement, and apply the partial-credit rules for multifactor authentication and cryptography.
4. Document implementation. Record how each control works in your environment, where the evidence lives, and who owns it.
5. Build the plan of action. List unmet requirements with owners and dates, confirm none of them is a requirement that cannot be deferred, and set the 180-day clock.
6. Post and affirm. Submit the score to the Supplier Performance Risk System and have your affirming official enter the affirmation, then diary the annual renewal.

Step two is where most self-assessments go wrong, because teams score what they believe is true rather than what they can evidence. An honest gap analysis performed by someone who did not build the environment surfaces that difference early, while it is still inexpensive to fix.

Cadence matters as much as accuracy. Running the assessment cycle on a schedule rather than in the weeks before each bid keeps the score defensible and the remediation list short, which turns compliance into routine maintenance rather than a periodic emergency.

When Should You Conduct a Self-Assessment?

You should conduct a self-assessment before you need the score rather than when a solicitation asks for it. Level 1 runs annually, and Level 2 self-assessments run on a three-year cycle with annual affirmations in between, so a calendar exists whether or not anyone is watching it.

Three events should trigger an assessment outside that calendar: a material change to the systems handling CUI, a change in the type of information a contract brings in, and an upcoming option exercise or recompete. A current risk assessment performed ahead of any of those is considerably cheaper than remediation performed during one.

Who Can Conduct a Level 3 CMMC Assessment?

Only the Defense Industrial Base Cybersecurity Assessment Center, part of the Defense Contract Management Agency, can conduct a Level 3 CMMC assessment. No third-party organization is authorized to perform it, and no self-assessment path exists at that level.

Level 3 also requires a Final Level 2 status from a third-party assessment before the government assessment can proceed. Both Level 3 and the Level 2 third-party path are among the designations paused under the current suspension.

Where Do CMMC Assessment Results Go?

Self-assessment results go to the Supplier Performance Risk System, where contracting officers can see them. Third-party and government assessment results are recorded in the Enterprise Mission Assurance Support Service and transmitted to SPRS from there.

Either way, SPRS is the record a contracting officer consults, and the affirmation sits alongside the score. An assessment without a current affirmation does not count under the clause, which catches companies that scored well and then let the annual signature lapse.

What Happens When NIST Moves to Revision 3?

Everything above rests on NIST SP 800-171 Revision 2, and Revision 2 has a published end state. The Department will adopt Revision 3 through future rulemaking, and until that happens a class deviation keeps assessments running against Revision 2. A new scoring methodology will be developed as part of that adoption.

Revision 3 is a genuine restructuring rather than a renumbering. It reduces the requirement count from 110 to 97 and adds three families that did not previously exist in the standard: Planning, System and Services Acquisition, and Supply Chain Risk Management. It also extends Organization-Defined Parameters across the standard, letting organizations set values such as log review frequency and session timeouts while taking on the governance work of justifying and tracking each one.

Fewer requirements does not mean less work. The companion assessment guidance increases the number of determination statements, which means more artifacts and more procedural evidence per requirement rather than less. The supply chain family in particular requires supplier clauses and cross-departmental processes that most contractors have never budgeted for.

Organizations may implement Revision 3 voluntarily today, with one firm condition: you must still meet Revision 2 for compliance and assessment purposes. The sensible position for most suppliers is to run a gap review between the two revisions, build new controls to the Revision 3 shape where doing so costs nothing extra, and keep Revision 2 as the measured standard until the rulemaking lands. Watching the CMMC timeline alongside the NIST one keeps both clocks visible.

Frequently Asked Questions

Does CMMC Level 2 Align With NIST 800-171?

Yes, CMMC Level 2 aligns fully with NIST SP 800-171 Revision 2. The program rule states that the Level 2 security requirements are identical to that publication, which means the 110 requirements across 14 families transfer without modification. CMMC adds the assessment type, the reporting, and the annual affirmation around them.

What Is NIST SP 800-171A?

NIST SP 800-171A is the companion assessment publication that defines how each security requirement in NIST SP 800-171 is evaluated. It breaks requirements into assessment objectives, and the DoD Assessment Methodology scores against those objectives rather than against the requirement text alone. Assessing yourself against the objectives is the closest you can get to assessing yourself the way the government will.

What Is the Minimum SPRS Score?

The minimum passing score is 88 out of 110, which is 80 percent of the security requirements. A score between 88 and 109 supports a Conditional status carrying a plan of action that must close within 180 days. The scale runs from negative 203 at the bottom to 110 at the top, so a negative score is possible and not unusual for organizations that have never implemented the standard.

What Is an Organization-Defined Parameter?

An Organization-Defined Parameter is a value a control leaves to the organization to set, such as how often logs are reviewed or how long a session may stay idle. The DoD guidance describes them as flexibility that still meets the intent of the control. The trade-off is governance: a parameter you choose has to be justified, approved, documented, and defended during assessment.

What Is a CUI Enclave?

A CUI enclave is an isolated environment that holds all Controlled Unclassified Information, separated from the rest of the corporate network. It concentrates the systems subject to the 110 requirements into a defined space, which reduces the number of assets to secure, document, monitor, and evidence. For companies where defense work is a minority of revenue, an enclave is usually the cheaper path.

Should You Implement Revision 3 Now?

You may implement Revision 3 voluntarily, provided you continue to meet Revision 2, which remains the standard assessments are conducted against. The practical approach is to review the gap between the revisions, build anything new to the Revision 3 shape where it costs nothing extra, and avoid retiring Revision 2 controls until the Department completes the rulemaking.

The Bottom Line

Mapping NIST to CMMC is mostly a translation exercise. Level 1 is the 15 requirements in FAR 52.204-21, Level 2 is the 110 requirements in NIST SP 800-171 Revision 2 across 14 families, and Level 3 adds 24 enhanced requirements from NIST SP 800-172 on top of a Final Level 2 status. Scoring starts at 110, subtracts 1, 3, or 5 points per unmet requirement, and allows partial credit in exactly two places: multifactor authentication and FIPS-validated cryptography.

What suppliers should expect is a change in proof rather than a change in controls. Configurations, logs, ticket history, and procedures that match the plan replace the policy statement that used to suffice, a tighter data boundary replaces a vague one, and one combined project replaces two parallel tracks. That pattern repeats across the frameworks our government contracting, manufacturing, healthcare, and financial clients run throughout Huntsville and North Alabama, where the organizations that keep evidence current spend far less than the ones that reconstruct it.

If you want a clear read on where your environment scores today and what the distance is to the level your contracts require, the team at Interweave Technologies is glad to work through it with you. Give us a call at 256.837.2300.

‍