Cmmc Nist 800 171

CMMC NIST SP 800-171 (Level 2)

Overview

This skill implements Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 2 readiness aligned to NIST SP 800-171 Revision 2 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020). Level 2 applies to contractors handling CUI and requires 110 security requirements (including enhanced requirements from NIST SP 800-171A assessment objectives).

| CMMC 2.0 level | NIST alignment | Assessment type | | --- | --- | --- | | Level 1 | FAR 52.204-21 (17 practices) | Annual self-assessment | | Level 2 | NIST SP 800-171 Rev 2 (110 practices) | Triennial C3PAO assessment (priority acquisitions) or self-assessment per contract | | Level 3 | NIST SP 800-172 (advanced) | Government-led assessment |

CUI is government-created or -owned information requiring safeguarding per 32 CFR Part 2002 and the CUI Registry. Contractual obligations flow from DFARS 252.204-7012 (Safeguarding Covered Defense Information), 252.204-7019 (NIST SP 800-171 DoD Assessment), and 252.204-7020 (NIST SP 800-171 DoD Assessment Requirements).

SPRS (Supplier Performance Risk System) score:

• Submit self-assessment score to SPRS at https://piee.eb.mil/ (PIEE)
• Score calculation: −110 + (5 × MET) + (3 × NOT APPLICABLE) per DoD methodology—document each practice status
• Minimum score expectations vary by solicitation; 110 MET is target for full compliance

14 NIST 800-171 requirement families: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI.

Cross-skill mapping: cloud and boundary patterns overlap fedramp-moderate-baseline; access and identity testing uses access-control-identity-audit.

Reference documents: CMMC AB, NIST SP 800-171 Rev 2, NIST SP 800-171A (assessment objectives).

When to Use

Use this skill when:

• Preparing for CMMC Level 2 C3PAO assessment or self-assessment per contract
• Calculating or validating SPRS score and POA&M for DoD contracts
• Defining CUI boundary (enclave) and marking/handling procedures
• Mapping 800-171 practices to Microsoft GCC High, AWS GovCloud, or on-prem environments
• Responding to DFARS 7012 incident reporting and cyber incident obligations
• Harmonizing CMMC with existing FedRAMP inherited or commercial cloud architectures

Do not use this skill when:

• FedRAMP Moderate SSP/POA&M for agency cloud ATO (use fedramp-moderate-baseline)
• SOX 404 ITGC for financial reporting (use sox-itgc-audit)
• PCI payment card environments (use pci-dss-network-segmentation)
• Export-controlled ITAR technical data without CUI scoping analysis (consult legal/export compliance)

Core Process

Execute steps in order.

Step 1: CUI scoping and enclave definition

1. Identify CUI categories from contract DD Form 254, contract clauses, and CUI Registry entries.
2. Define CMMC assessment scope (enclave):

• Systems storing, processing, or transmitting CUI
• Security Protection Assets (SPAs) supporting the enclave
• Contractor Risk Managed Assets (CRMAs) if applicable per CMMC scoping guidance

1. Document data flows: email, file share, ERP, engineering (CAD/PLM), cloud SaaS, subcontractor portals.
2. Verify CUI marking per 32 CFR 2002 and DoD CUI marking handbook.
3. Artifact: cui-enclave-boundary-{id}.json.

Step 2: Practice baseline and 800-171A assessment objectives

1. Load all 110 NIST SP 800-171 Rev 2 requirements.
2. For each practice, map NIST SP 800-171A assessment objectives (determine if MET, NOT MET, or N/A).
3. Status definitions:

• MET: fully satisfied with evidence
• NOT MET: gap requiring POA&M
• NOT APPLICABLE: justified exclusion (document rationale; affects SPRS score)

1. Priority families for DIB environments:

| Family | Examples | Cross-skill | | --- | --- | --- | | AC | AC.L2-3.1.1–3.1.22 authorized access, remote access | access-control-identity-audit | | IA | IA.L2-3.5.1–3.5.11 authenticator management | access-control-identity-audit | | AU | AU.L2-3.3.1–3.3.9 audit records, review, protection | audit-logging-integrity | | SC | SC.L2-3.13.1–3.13.16 boundary protection, crypto | fedramp-moderate-baseline (SC mapping) | | IR | IR.L2-3.6.1–3.6.3 incident handling | breach-incident-response |

1. Artifact: 800-171-assessment-{id}.csv.

Step 3: SPRS score calculation and submission readiness

1. Calculate SPRS score using DoD formula; verify each practice scored consistently with evidence.
2. Prepare System Security Plan (SSP) or equivalent documentation per organization size—Level 2 expects documented implementation narratives.
3. Identify minimum score required by active solicitations; gap analysis if below threshold.
4. Document assessment date, scope, and point of contact for SPRS entry.
5. Plan annual self-assessment updates even when C3PAO certification is valid.

Step 4: Access control and identification (AC, IA families)

1. Execute access-control-identity-audit with 800-171 mapping:

• AC.L2-3.1.5 (least privilege), AC.L2-3.1.12 (monitoring remote access)
• AC.L2-3.1.3 (control CUI flow), AC.L2-3.1.20 (external connections)
• IA.L2-3.5.3 (MFA for privileged and network access)

1. Verify local account restrictions on enclave systems (AC.L2-3.1.1).
2. Test session lock and encryption for CUI at rest and in transit (SC family coordination).
3. Document subcontractor access paths and flow-down clauses (DFARS 7012 paragraph (m)).

Step 5: Audit and accountability (AU family)

1. Execute audit-logging-integrity mapped to AU.L2-3.3.x:

• Audit record content, retention, review, and protection
• Time synchronization (AU.L2-3.3.7) via NTP configuration evidence

1. Verify non-repudiation for critical CUI access where required.
2. Use Postgres MCP or SIEM exports for log retention and review cadence evidence.

Step 6: Configuration, system integrity, and boundary (CM, SI, SC families)

1. Verify baseline configurations (CM.L2-3.4.1–3.4.9): inventories, change control, security settings.
2. Malware protection (SI.L2-3.14.2–3.14.7): AV/EDR, updates, scans.
3. Boundary protection (SC.L2-3.13.1–3.13.16): firewalls, network segmentation, encryption.
4. Cross-ref fedramp-moderate-baseline Step 1 for boundary diagram patterns; adapt to CUI enclave (not full FedRAMP baseline).
5. Use Terraform MCP for IaC evidence of security group and encryption configurations.

Step 7: Incident response and DFARS 7012 reporting

1. Verify incident handling (IR.L2-3.6.1–3.6.3) capability per breach-incident-response.
2. Document 72-hour reporting obligation to DoD CIO for cyber incidents affecting covered defense information (DFARS 252.204-7012(c)).
3. Maintain media preservation and forensic procedures for CUI incidents.
4. Tabletop exercise evidence for IR plan within assessment period.

Step 8: POA&M and remediation planning

1. For each NOT MET practice, create POA&M entry:

• Weakness, risk, milestones, resources, scheduled completion

1. POA&M items do not count as MET for SPRS until remediated and reverified.
2. Prioritize: AC, IA, SC gaps affecting CUI exfiltration; IR gaps affecting 7012 compliance.
3. Artifact: cmmc-poam-{id}.yaml.

Step 9: C3PAO readiness and evidence packaging

1. Organize evidence binder by 800-171 family:

• Policies, procedures, screenshots, configs, interview notes, test results

1. Prepare personnel for C3PAO assessor interviews (PS, AT practices).
2. Cross-walk partial overlap to FedRAMP CRM if using authorized cloud—document inherited vs organizational controls.
3. Package with SHA-256 hashes per templates/audit-evidence-manifest.yaml.
4. Emit findings:

id: FIND-CMMC-001
severity: HIGH
control_id: 3.5.3
observation: "MFA not enforced for non-privileged remote access to CUI enclave"
recommendation: "Enable MFA for all VPN and cloud console access to CUI systems per IA.L2-3.5.3"
owner: ""
due_date: null
status: open

Common Rationalizations

| Excuse the agent might generate | Required rebuttal | | --- | --- | | "Commercial cloud is FedRAMP, so CMMC is automatic." | FedRAMP ≠ CMMC—contractor must implement 800-171 in tenant config; CRM/inheritance gaps are common C3PAO findings. | | "SPRS score uses self-attestation—we can mark all MET." | False attestation risks False Claims Act exposure—each MET requires evidence per 800-171A objectives. | | "CUI is only on one laptop—not in scope." | CUI on any contractor system triggers enclave scoping—unmarked/uncontrolled CUI expands assessment scope. | | "POA&M items count toward certification." | Open POA&M means practice is NOT MET for SPRS until closed with verification. | | "Subcontractor CUI is their problem." | DFARS 7012 flow-down requires prime to verify subcontractor compliance—prime liability remains. | | "Level 1 practices cover us for CUI." | CUI contracts require Level 2 / 800-171—17 FAR practices are insufficient for 110 requirements. |

Red Flags

• CUI stored in commercial SaaS without BAA-equivalent/data protection agreement and encryption
• SPRS score submitted without documented 800-171A objective evidence
• No defined CUI enclave boundary; CUI mixed with FCI-only systems without segmentation
• Remote access to CUI without MFA (IA.L2-3.5.3)
• Missing DFARS 7012 incident reporting procedure or 72-hour contact list
• Audit logs modifiable by users being audited (AU.L2-3.3.8)
• POA&M older than 180 days with no milestone progress for high-risk gaps
• Subcontractor handling CUI without flow-down clause verification
• Assessment uses outdated NIST SP 800-171 Rev 1 control numbering

Verification

• [ ] CUI categories identified; enclave boundary and SPA/CRMA scoping documented
• [ ] All 110 NIST SP 800-171 Rev 2 practices assessed against 800-171A objectives
• [ ] SPRS score calculated with MET/N/A/NOT MET documentation per practice
• [ ] AC/IA and AU families tested via access-control and audit-logging skills
• [ ] CM, SI, SC configuration and boundary evidence collected
• [ ] IR plan includes DFARS 7012 cyber incident reporting procedure
• [ ] POA&M current for all NOT MET practices with milestones
• [ ] Subcontractor flow-down and CUI marking procedures verified
• [ ] C3PAO evidence binder organized by family with interview readiness
• [ ] Evidence manifest complete with SHA-256 hashes and engagement ID

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vaquarkhan
• Source: vaquarkhan/compliance-agent-skills
• License: MIT
• Homepage: https://github.com/vaquarkhan/compliance-agent-skills#readme

Install and usage instructions live in the source repository linked above.