CMMC and NIST 800-171 Readiness for Government Contractors
Get ready for the requirements your contract and your prime are already asking about, with security you can document and defend.
What Applies to Defense Contractors and Subcontractors
Whether you hold a prime contract or sit several tiers down the supply chain, the requirements flow to you. Here is how we support each piece.
| Requirement | What it asks | How we support it |
|---|---|---|
| DFARS 252.204-7012Safeguarding covered defense information | Implement NIST SP 800-171 on systems that handle CUI, report cyber incidents to DoD within 72 hours, and use compliant cloud services. | Scoping, control implementation, incident response procedures, and cloud guidance. |
| NIST SP 800-171 Rev. 2110 security requirements | Fourteen families of requirements, from access control to system and communications protection. | Gap assessment against each requirement, remediation plan, and evidence collection. |
| SPRS scoreSelf-assessment score | Contractors submit a NIST SP 800-171 assessment score to DoD’s Supplier Performance Risk System. | Honest scoring and a plan of action to raise it. |
| System Security Plan and POA&MRequired documentation | Describe how each requirement is met, and track the ones that are not yet. | We write and maintain both, and keep them true as your environment changes. |
| CMMC Level 1Basic safeguarding of FCI | 15 practices from FAR 52.204-21, with an annual self-assessment and affirmation. | Implementation and the annual review. |
| CMMC Level 2Protecting CUI | 110 requirements aligned with NIST SP 800-171, assessed by self-assessment or a third party depending on the contract. | Readiness work and assessor coordination. |
Who We Serve
- Small and mid-sized defense subcontractors
- Manufacturers and machine shops in the defense supply chain
- Engineering, IT, and professional services firms working on government contracts
- Firms asked by a prime for evidence of NIST SP 800-171 compliance
What We Handle for You
- Scoping: where FCI and CUI live and flow
- Gap assessment and SPRS scoring
- System Security Plan and plan of action
- Remediation: MFA, encryption, logging, device and access controls
- Cloud and email guidance for CUI, such as Microsoft GCC High options
- Ongoing monitoring, evidence, and annual affirmation support
Common Questions
Is CMMC still required?
Yes, with caveats. Contract clauses requiring NIST SP 800-171 (DFARS 252.204-7012) remain in force, and CMMC Level 1 and Level 2 self-assessments with annual affirmations apply in contracts that include them. The later phase that would have required third-party (C3PAO) certification was suspended in July 2026 while the Department of War reviews the program, and timelines may change. Check your contract’s clauses, and we track current status for our clients.
Can NovaCore certify us for CMMC?
No. Certification assessments are performed by authorized third-party assessors (C3PAOs) or by the government. We prepare you: scoping, gap assessment, remediation, documentation, and evidence. We can also coordinate with your assessor when the time comes.
What is the difference between FCI and CUI?
Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract. Controlled Unclassified Information (CUI) is a more sensitive category the government designates for protection. FCI generally maps to Level 1, and CUI to Level 2 and NIST SP 800-171.
Do we need to start before a contract requires it?
Starting early is usually cheaper. Scoping, documentation, and evidence take time to build, and primes increasingly ask subcontractors about their posture before award.
Talk Through Your Compliance and IT Needs
Tell us about your practice. We will reply with an honest read on where you stand and what to fix first. Support hours are 7 a.m. to 7 p.m. MST, Monday through Friday, and we are available 24/7 for emergencies.