The 110 requirements behind CMMC Level 2, and what your C3PAO auditor will check. Readiness help for Minnesota DoD contractors: gap review, remediation recommendations, SSP and POA&M documentation, and the technical fixes.
NIST Special Publication 800-171 is the control set the Department of Defense relies on to protect Controlled Unclassified Information in nonfederal systems. Under DFARS clauses 252.204-7012, 252.204-7019, and 252.204-7020, every DoD contractor and subcontractor that processes, stores, or transmits CUI has been required since 2017 to implement the 110 security requirements in NIST SP 800-171 Rev 2 and, since November 2020, to post a self-assessment in the Supplier Performance Risk System (SPRS). CMMC adds a third-party certification process on top, but the substantive control set (the practices, the assessment objectives, the evidence) is NIST SP 800-171.
McNallan Technology Solutions is not an assessor, and we don't issue scores or certifications. Certification comes from a C3PAO. Our job is readiness: we review your environment against the requirements your C3PAO will check, give you the results and remediation recommendations, help you build a System Security Plan and Plan of Action and Milestones that reflect what's actually deployed, and fix the gaps. That work is the starting point for DFARS obligations today, for upcoming CMMC Level 2 certification, and for the prime contractor requests that keep arriving in your inbox. This page is part of our broader CMMC compliance practice for Minnesota.
Three things are happening simultaneously in the Minneapolis DoD supply chain, and all of them point at NIST SP 800-171.
DFARS 252.204-7012 is being enforced again. The clause has been in DoD contracts since 2017, requiring NIST SP 800-171 implementation and rapid incident reporting for CUI handlers. For years the enforcement teeth were limited. That changed with the False Claims Act cases: the 2022 Aerojet Rocketdyne settlement and the 2024 Penn State settlement both involved misrepresenting NIST SP 800-171 compliance under DFARS. The DOJ's Civil Cyber-Fraud Initiative has signaled that contractor cybersecurity misrepresentation is a sustained enforcement priority.
Primes are checking SPRS. Under DFARS 252.204-7019 and -7020 (in effect since November 2020), contractors must have a current Basic Assessment posted in SPRS to be eligible for a DoD contract that includes the DFARS 252.204-7012 clause. A contractor without a recent, defensible self-assessment can lose work.
CMMC raises the stakes. The CMMC program rule, in effect since December 2024, with the DFARS contract rule following in November 2025, doesn't change the 110 NIST SP 800-171 Rev 2 requirements. It changes who verifies compliance and how. The contractors who already have a clean, defensible NIST SP 800-171 program in place are positioned to certify. The contractors with an old self-assessment nobody can back up with evidence are not.
A C3PAO assessment isn't a questionnaire. It evaluates your environment against 110 security requirements and 320 assessment objectives in NIST SP 800-171A, using documented evidence, interviews, examinations, and tests. These are the pieces you need in place.
What systems process, store, or transmit CUI? What people interact with those systems? What data flows in and out? A contractor who scopes "the entire company" when only a 15-user engineering enclave touches CUI buys a much larger compliance program than necessary. In our readiness work, we map where your CUI flows before any controls work begins.
Each of the 110 requirements is evaluated against NIST SP 800-171A assessment objectives. For each objective the evidence includes: documented policy, operational procedure, technical evidence (configuration excerpts, log samples, screenshots, training records), and walkthrough verification. Each objective is rated MET, NOT MET, or NOT APPLICABLE.
The DoD methodology starts at 110 points. Each requirement not met subtracts a weighted value (most subtract 1, some 3, critical ones 5), down to a minimum of -203. Partial implementation counts as not implemented. A self-assessment that counts partial controls as complete is a False Claims Act exposure waiting to surface.
The narrative document describing the system, boundary, data flows, operational environment, and implementation of each requirement. A core document for the assessment. We help you build an SSP that matches operational reality, not templated narratives that describe an environment you don't have.
Any requirement not fully implemented gets entered with a remediation plan, target completion date, and assigned owner. In CMMC Level 2 context, only certain practices are POA&M-eligible, and items must close within 180 days for Conditional status to become Final.
Your Basic Assessment is posted in SPRS under your CAGE code by your own registered SPRS user. The self-assessment and the submission are yours. Our readiness results and remediation recommendations help you understand what you're reporting.
The relationship is direct. NIST SP 800-171 Rev 2 is the control set behind CMMC Level 2. The 110 practices in CMMC Level 2 are the same 110 requirements in NIST SP 800-171 Rev 2. The assessment objectives in NIST SP 800-171A are the same objectives a C3PAO uses.
Readiness work against these requirements positions you for CMMC. You finish with the results of a gap review, remediation recommendations, an SSP, a POA&M, and a remediation roadmap. From there:
This is why we recommend readiness work as the first step for any Minneapolis contractor uncertain about their compliance posture. It produces an honest baseline and a clear path forward.
It depends on your scope, your systems, and how much documentation you already have.
Larger environments, multi-site operations, or uncertainty about where CUI lives extend the timeline. We set a firm timeline after the initial scoping conversation.
No. A self-assessment is performed by you and self-submitted to SPRS. A CMMC assessment is performed by a C3PAO third party.
The substantive control set is the same (110 NIST SP 800-171 Rev 2 requirements). The difference is who performs the assessment and what certification it produces. CMMC Level 2 assessment produces a certification recorded in CMMC eMASS.
SPRS is the DoD database tracking contractor performance, including NIST SP 800-171 self-assessment results.
Self-assessments are stored under each contractor’s CAGE code. Primes flowing CUI work down are increasingly checking their subs’ SPRS entries before placing the order.
Update it. An old self-assessment with unclear methodology is a False Claims Act exposure.
The DOJ has signaled that misrepresenting NIST SP 800-171 compliance under DFARS is an active enforcement priority. Our readiness review checks your environment against the requirements as it stands today and gives you results and remediation recommendations. The updated self-assessment and the SPRS submission remain yours.
Not exactly, but the assessment artifacts must be current, comprehensive, and evidence-backed.
Most older self-assessments don’t meet that standard. Current, evidence-backed readiness work becomes the foundation for the CMMC Level 2 readiness work, and the SSP, POA&M, and evidence library carry forward directly into the C3PAO assessment.
NIST published Rev 3 in May 2024 with restructured control families. CMMC 2.0 is built on Rev 2.
Rev 2 remains the assessable standard for current CMMC certification. DoD has not yet incorporated Rev 3 into DFARS or CMMC, and the transition timeline is still being finalized. For Minneapolis contractors today, Rev 2 is the target.
If you're a Minneapolis DoD contractor and you need to know where you stand on NIST SP 800-171, whether to answer a prime contractor's SPRS request, meet DFARS 252.204-7012 obligations, or prepare for upcoming CMMC Level 2 certification, talk to us. A 45-minute scoping call covers your contract environment, the data you handle, your current security posture, and what a readiness engagement would look like.
Start with the CMMC compliance hub for the broader picture, or our cybersecurity services page for the operational layer.
McNallan Technology Solutions works best with growth-focused Minnesota businesses (25+ employees) that view technology as a productivity investment, not a cost to minimize.
Prefer a real conversation? Skip the form and call us directly during business hours.
+1 763-424-3388Working hours
Mon–Fri
Emergency
8:00 AM – 5:00 PM
24/7 on-call support
Share a few details and we’ll follow up with next steps and a clear path forward.
"*" indicates required fields
