CMMC vs NIST SP 800-171: the standard, and the program that checks it

Published 2026-10-22

They are not two competing rulebooks. NIST SP 800-171 is the standard: 110 security requirements for controlled unclassified information on a contractor's systems, which DFARS 252.204-7012 7012(b)(2) has required since the end of 2017. CMMC is the program that checks it: 32 CFR Part 170 says the Level 2 requirements are identical to NIST SP 800-171 Rev 2 170.14(c)(3), and adds who assesses, how the score is counted, which gaps you may carry and who signs for it.

So the work is the same; the proof is what changes. If you are unsure which data you hold, the FCI vs CUI page decides between Level 1 and Level 2 before anything here matters.

Status as of 2026-10-23

In force today: DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c); Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16; The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
Suspended: Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3; Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
Not yet known: The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23; DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824

Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
32 CFR Part 170 (eCFR), read 2026-10-23
Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
Federal Register: CMMC documents, read 2026-10-23

The standard

NIST SP 800-171

What to do: 110 requirements, written by NIST, that DFARS 252.204-7012 makes you implement on systems that hold CUI.

The check

CMMC

How DoD verifies it: a self-assessment or an outside assessment, scored under 32 CFR 170.24 and affirmed in SPRS.

Binding today

Both, on the self route

7012 and Rev 2 apply; contracts may require Level 1 or Level 2 (Self). The third-party Phase 2 step is suspended.

Mezzotint of a thick bound standard beside a checklist on a clipboard — The book and the clipboard: one says what to do, the other records whether someone checked it.

One standard, three levels

Read across a row to see where the levels part ways with the standard. Level 2 is the column that matches NIST SP 800-171 almost cell for cell; what differs is who checks and what a low score costs you.

One standard, three levels

NIST SP 800-171 Rev 2 compared with CMMC Levels 1, 2 and 3
The question	NIST SP 800-171 Rev 2The standard	CMMC Level 1A CMMC status	CMMC Level 2A CMMC status	CMMC Level 3A CMMC status
What each one asks
What it asks for32 CFR 170.14(c)	110 security requirements in 14 families	The 15 safeguards of FAR 52.204-21	The 110 requirements of NIST SP 800-171 Rev 2, unchanged	24 requirements from NIST SP 800-172, on top of Level 2
Source text, and the clause that applies itDFARS 252.204-7012(b)(2); FAR 52.204-21	NIST SP 800-171, applied by DFARS 252.204-7012	FAR 52.204-21, scored under 32 CFR 170	NIST SP 800-171 Rev 2, scored under 32 CFR 170	NIST SP 800-172 (Feb 2021), scored under 32 CFR 170
The data that triggers it32 CFR 170.3(d)	Covered defense information (CUI) on your systems	Federal contract information (FCI)	CUI	CUI, where the program office sets Level 3
Who checksDFARS 252.204-7020(a); 32 CFR 170.15–170.18	You (Basic Assessment); Government staff for a Medium or High	You, a self-assessment	You (Self), or a C3PAO (certification)	DCMA DIBCAC, after a Final Level 2 (C3PAO)
How it is scoredDoD Assessment Methodology; 32 CFR 170.24	Start at 110, subtract 1, 3 or 5 per gap	MET or NOT MET, all 15 together	Start at 110, subtract 1, 3 or 5 per gap	1 point per requirement, 24 at most
Where the score goesDFARS 252.204-7019(d); 32 CFR 170.15–170.18	SPRS, with the date you expect to reach 110	SPRS, with an affirmation	SPRS (Self); CMMC eMASS, then SPRS (C3PAO)	CMMC eMASS, then SPRS
Gaps you may carryDFARS 252.204-7019(d); 32 CFR 170.21	Any; the score drops and you post a completion date	None; no POA&M at Level 1	1-point items only, score of 88 or more, closed in 180 days	Score at least 0.8 of the maximum, closed in 180 days
How oftenDFARS 252.204-7019(b); 32 CFR 170.22	A current assessment, not more than 3 years old	Every year	Every 3 years, affirmed every year	Every 3 years, with a new Level 2 (C3PAO)
What binds a contract today
In force todayClass Deviation 2026-O0025 Rev 3	In force (DFARS 7012)	In force (Self)	Self in force; C3PAO requirement suspended	Suspended

What the last row means

In force: A contract can require it today.
Self in force; C3PAO requirement suspended: The self-assessment route only.
Suspended: Not being added to contracts under the deviation.

Same 110 requirements, a stricter proof

The overlap is not loose or approximate. Part 170 says it in one sentence, and it is the sentence to show anyone who tells you CMMC is a new set of controls:

What CMMC changes is the bar for calling the work done. Before CMMC, DFARS 252.204-7019 and -7020 asked for a current NIST SP 800-171 score in SPRS, counted by the DoD Assessment Methodology: start at 110 and subtract 1, 3 or 5 for each requirement not implemented. CMMC Level 2 keeps the same points but tightens what a low score means. The 7019 and 7020 text is explained in the SPRS score clauses.

One score, two rulebooks

The question	DFARS 7019 and 7020	CMMC Level 2 (32 CFR 170)
What is checked	Your implementation of NIST SP 800-171, as your system security plan describes it.	The same 110 requirements, against the NIST SP 800-171A assessment objectives.
Who does it	You, for a Basic Assessment. A Medium or High Assessment is done by Government staff.	You, for Level 2 (Self). A C3PAO for Level 2 (C3PAO). DCMA DIBCAC may still investigate either.
A score under 110	Posted as it is, with the date you expect to reach 110 from your plans of action.	A Conditional status only at 88 or more, with only 1-point items open, closed out within 180 days.
Who signs	The clause asks for the score and the plan details, not a named signer.	An Affirming Official, a senior person in the company, after every assessment and every year.
Evidence kept	No retention period for your evidence in either clause.	Six years from the CMMC Status Date.

The gap that hurts most is the score. Under 7019 a shop at 70 posts 70 and a date. Under CMMC Level 2 the same shop has no status at all until it reaches 88, and apart from encryption that is not FIPS-validated, no 3- or 5-point gap can sit on the plan of action. Run your own number in the SPRS score calculator before you assume you are close. If a platform will keep that number for you, Vanta vs Drata for CMMC shows which ones count it the CMMC way.

Which one binds your contract

Neither NIST nor CMMC binds you on its own. A clause does. DFARS 252.204-7012 is what makes NIST SP 800-171 mandatory, and DFARS 252.204-7021 is what requires you to have and keep a current CMMC status at the level the contract names. The full 7012 text, including the 72-hour reporting rule, is in DFARS 252.204-7012 explained; the program itself is in what is CMMC compliance.

Read your contract

Tick the clauses your contract or purchase order lists. Pre-filled with a typical machined-parts subcontract.

FAR 52.204-21Basic Safeguarding of Covered Contractor Information SystemsDFARS 252.204-7012Safeguarding Covered Defense Information and Cyber Incident ReportingDFARS 252.204-7019 or -7020NIST SP 800-171 DoD Assessment RequirementsDFARS 252.204-7021Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements

What these clauses ask of you today

In forceThe 15 basic safeguards on every system that holds federal contract information. FAR 52.204-21(b)(1)
In forceNIST SP 800-171 on every system that holds covered defense information; the deviated clause in new contracts names Revision 2. DFARS 252.204-7012(b)(2)
In forceCyber incidents reported to DoD within 72 hours, and any cloud that holds the data at FedRAMP Moderate or equivalent. DFARS 252.204-7012(b)(2)(ii)(D), (c)
In forceA current NIST SP 800-171 score, not more than 3 years old, posted in SPRS before award. DFARS 252.204-7019(b)

Rev 2 or Rev 3: which 800-171 counts

NIST moved on in May 2024; DoD did not. Part 170 incorporates Rev 2 by name, the DFARS 252.204-7012 text in new contracts says Revision 2, and the class deviation sets Rev 2 as the baseline. NIST's site marks Rev 2 withdrawn, which is why so many shops wonder whether they built to the wrong list. They did not.

Two revisions

The question	Rev 2	Rev 3
Published	February 2020, updated 2021-01-28	May 2024
Requirements	110	97
Families	14	17
NIST's own status	Withdrawn 2024-05-14	Current
What CMMC scores	Yes: Level 2 is Rev 2	No

Keep your system security plan and score on the Rev 2 numbering (3.1.1 to 3.14.7) until a rule change says otherwise. The NIST SP 800-171 checklist and the 110 controls by family both follow Rev 2.

Three mistakes that come from mixing them up

How we read the rules

Every row on this page comes from the rule text or from the named primary sources below, read on 2026-10-22: rule text is the rule's, and a standards body's, an agency's or a register's words are given as theirs. Where a rule is changing, the status box near the top says what is in force that day, and it is the one place we update when it moves.

CuiDeck is not a C3PAO, an assessor or a law firm. This page explains the rules; your contract and your contracting officer decide what applies to you.

Questions small shops ask

Questions

Is CMMC the same thing as NIST SP 800-171?

At Level 2 the requirements are the same: 32 CFR Part 170 says they are identical to NIST SP 800-171 Rev 2. The difference is everything around them. NIST wrote the requirements; CMMC sets who checks them, how the score is counted, what may stay open and who affirms the result. If you hold an ISO 27001 certificate, NIST's own map from its controls to these requirements is read in CMMC vs ISO 27001.

Do I need both?

If you hold CUI under DFARS 252.204-7012, you implement NIST SP 800-171 either way. CMMC is how a contract asks you to prove it. Today that proof can be a Level 2 (Self) assessment; the third-party requirement is suspended. Our CMMC level finder walks you to the level your data points to.

We only hold FCI. Does NIST SP 800-171 apply to us?

Not as a whole. Level 1 is the 15 safeguards of FAR 52.204-21, scored MET or NOT MET. Part 170 assesses them against the matching NIST SP 800-171A objectives, 17 entries in its mapping table, so a Level 1 shop does a small slice of 800-171. The Level 1 checklist covers all 15.

Is a Level 2 self-assessment the same as a DFARS 7019 Basic Assessment?

Close, not the same. Both start at 110 and subtract 1, 3 or 5 points per gap, but CMMC adds the 88-point floor, the short list of gaps a POA&M may hold, the 180-day closeout and the yearly affirmation. Under the class deviation, 252.240-7997 replaces 7020 in new contracts and the self-assessment route is CMMC Level 1 or 2 (Self); contracts already awarded keep the clause versions they carry.

Does a C3PAO certificate replace my SPRS score?

It feeds it. The C3PAO uploads the results to the CMMC instance of eMASS, which passes them to SPRS, and a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope. What a C3PAO is, and where they stand while Phase 2 is suspended, is in what is a C3PAO.

Where does NIST SP 800-172 fit?

Only at Level 3: 24 requirements selected from NIST SP 800-172, assessed by DCMA DIBCAC after a Final Level 2 (C3PAO). Part 170 brings Level 3 in from Phase 2, and with Phase 2 suspended, contracts are not adding the DIBCAC requirement.