Basic
Your own review of your System Security Plan, scored by the methodology. Its confidence level is Low, because the score is self-generated.
NIST SP 800-171 and the DFARS clauses that require it
A defense contract with DFARS 252.204-7012 requires the security requirements of NIST SP 800-171 on every contractor system that processes, stores or transmits covered defense information. Before award, the 7019 provision asks for a current assessment score in the Supplier Performance Risk System (SPRS).
Those clauses apply whatever stage CMMC is at. We score each requirement, write the System Security Plan and close the gaps with your engineers.
System Security Plan: engineering enclave
95out of 110
- Standard
- NIST SP 800-171 Rev. 2
- Assessed by
- Contractor self-assessment
- Completed
- September 29, 2026
- Score of 110 by
- March 31, 2027
What each DFARS clause requires
| Clause | Requires |
|---|---|
| 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (opens in a new tab) | Adequate security on every covered contractor information system: the SP 800-171 requirements in effect when the solicitation was issued, or as the contracting officer authorizes. A cloud provider that holds covered defense information must meet requirements equivalent to the FedRAMP Moderate baseline. The clause flows down to subcontracts that involve that information. |
| 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements (opens in a new tab) | A solicitation provision. To be considered for award, a current assessment, not more than three years old unless the solicitation sets less, for each covered system relevant to the offer, with its summary score posted in SPRS. |
| 252.204-7020 NIST SP 800-171 DoD Assessment Requirements (opens in a new tab) | The Basic, Medium and High assessments, access for the Government to conduct the last two, and no subcontract under SP 800-171 until the subcontractor has completed at least a Basic Assessment within the last three years. |
| 252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (opens in a new tab) | The CMMC level the contract names, met through the assessment it specifies. CMMC Level 2 readiness |
Basic, Medium and High assessments
Each is scored by the NIST SP 800-171 DoD Assessment Methodology (PDF, opens in a new tab). SPRS keeps one summary score out of 110 for each System Security Plan, never the value of each requirement, with the date its plan of action reaches 110.
Medium
The Government reviews your Basic Assessment and your documents, and asks your team for anything it needs. Its confidence level is Medium.
High
Government personnel also verify, examine and see demonstrated what your System Security Plan describes, using NIST SP 800-171A. Its confidence level is High. After a Medium or High assessment you have 14 business days to send more evidence or rebut a finding.
When a cyber incident reaches covered defense information
- On discovery
Review
Look for compromised computers, servers, data and user accounts, on the affected systems and on any others the incident could have reached.
- Within 72 hours
Report
Report through DIBNet, which takes a medium assurance certificate. A subcontractor also gives its prime the incident report number.
- For 90 days
Preserve
Keep images of the affected systems and their monitoring and packet capture data from the report, and send any malicious software you isolate to DC3.
- On request
Give access
Provide the information and equipment the Government needs for a forensic analysis or a damage assessment.
From a Basic Assessment to a score of 110
Basic Assessment
We assess every requirement in your environment, with the reason for each point taken off, then prepare the summary SPRS takes: the plan, its CAGE codes, the date, the score and the date you reach 110.
System Security Plan
The SSP and the plan of action come from that assessment, so the date you give for 110 follows from the work they list.
Remediation
Our engineers make the fixes in GCC High, Google Workspace, your clouds, network and endpoints, and each one closes its item in the plan of action.
SP 800-171 before CMMC
- Does SP 800-171 still apply while CMMC Phase 2 is suspended?
- Yes, under every contract with DFARS 252.204-7012. DoW says that while Phase 2 is suspended it will enforce SP 800-171 Rev. 2 through self-assessments and select government-led assessments.
- How old can our SPRS score be?
- No more than three years, unless the solicitation sets a shorter time, and you need one for each covered system relevant to the offer. Without one, you can submit a Basic Assessment for posting.
- Can a cloud provider hold our covered defense information?
- Yes, if it meets requirements equivalent to the FedRAMP Moderate baseline and the clause’s terms for incident reporting, malicious software, media preservation, forensic access and damage assessment.
- Do our subcontractors need a score too?
- Yes. A subcontract that involves SP 800-171 cannot be awarded until the subcontractor has completed at least a Basic Assessment within the last three years, and 7012 itself flows down to subcontracts that involve covered defense information.