CMMC vs NIST 800-171: What's the Difference and Why It Matters

The Same 110 Controls — Completely Different Accountability

Let's start with the part that confuses a lot of people: CMMC Level 2 and NIST 800-171 cover exactly the same security requirements. Same 110 controls. Same 14 control families (Access Control, Audit and Accountability, Configuration Management, and so on). Same technical requirements.

So why is CMMC a bigger deal than NIST 800-171 ever was?

Because under NIST 800-171, you assessed yourself. You graded your own homework. You uploaded a score to a government database called SPRS and no one came to verify it. The DoD trusted you to be honest about where you stood.

Under CMMC Level 2, a certified independent organization — a C3PAO — comes in and verifies your implementation for themselves. They test your controls. They review your documentation. They interview your staff. They probe your network. And if you've been claiming a score you don't deserve, that's when it becomes a problem.

Why the DoD Created CMMC

The honest answer: self-attestation was failing badly.

The DoD required contractors to self-assess under NIST 800-171 and upload scores to SPRS starting in November 2020. It was supposed to create transparency — primes and contracting officers could see each contractor's score and make decisions accordingly.

What actually happened was widespread score inflation. The DoD Inspector General and external researchers found that contractors were self-reporting perfect or near-perfect SPRS scores while their actual security posture was far below that. Some contractors had experienced significant breaches — IP theft, Chinese APT intrusions — and still maintained high self-reported scores. Others simply didn't understand the requirements well enough to assess accurately.

A 2021 DoD IG report found that the military departments weren't even verifying that contractors had uploaded SPRS scores, let alone checking whether those scores were accurate. The system had essentially no enforcement mechanism.

CMMC was the DoD's answer: mandatory third-party verification. If you can't be trusted to assess yourself accurately, someone else will do it.

What Changes Practically — A Side-by-Side

SPRS Scores — The Bridge Between the Two

SPRS (Supplier Performance Risk System) is the DoD database where your compliance score lives. Understanding SPRS helps you understand the relationship between NIST 800-171 and CMMC.

When you self-assess under NIST 800-171, you calculate a score using the NIST scoring methodology: start at 110, subtract points for each control you're not fully implementing based on that control's assigned weight. Not all controls are equal — missing an access control requirement might cost you 5 points while missing multi-factor authentication costs 3 points. A perfect score is 110. Scores can go negative for significant gaps.

Your SPRS score is visible to any contracting officer and any prime contractor who looks you up. Even before CMMC certification is required, a low score can affect contract decisions.

The average self-reported SPRS score for small defense contractors is somewhere around 47 out of 110. That's not good. And remember — those are self-reported scores. The real numbers, once C3PAOs start verifying, are likely lower in many cases.

The DFARS Clauses That Connect Everything

Two DFARS clauses are the legal plumbing behind all of this. You should know what they are and whether they're in your contracts.

DFARS 252.204-7012 — Already in Your Contract

This clause has been in DoD contracts since 2016. It requires you to:

• Implement NIST 800-171 and maintain a System Security Plan
• Report cyber incidents to the DoD within 72 hours
• Preserve images of systems involved in an incident for 90 days
• Flow these requirements down to subcontractors who handle CUI

If your contract has DFARS 252.204-7012, you're already legally required to implement NIST 800-171. CMMC doesn't add new requirements — it adds verification.

DFARS 252.204-7021 — The CMMC Clause

This is the new clause that implements CMMC. When it appears in a contract, you're required to have CMMC certification at the level specified before you can be awarded the contract. DoD started including this clause in selected contracts in 2025, and it's rolling out more broadly through 2026 and beyond.

When you see DFARS 252.204-7021 in a solicitation, you need a CMMC certification before you can respond. If you don't have one yet, you need to start now — assessment slots are booked out months in advance.

If You've Been Working on NIST 800-171, You Have a Head Start

This is genuinely good news for contractors who have been serious about NIST 800-171 implementation. Everything you've done transfers directly.

Your existing System Security Plan, security policies, technical configurations, access controls, audit logging, incident response plan — all of it is directly relevant to CMMC Level 2. You're not starting over. You're getting verified.

The contractors who have been implementing NIST 800-171 in good faith — not gaming the SPRS score, but actually building and documenting the controls — often find they're 60–80% of the way to CMMC readiness. What they typically need:

• Documentation cleanup — Making sure their SSP accurately reflects current implementation (not what they planned to implement)
• Evidence collection — Gathering the artifacts an assessor will want to see for each control
• Gap remediation — Closing the remaining gaps, especially on higher-weight controls
• Mock assessment — A dry run with a Registered Practitioner to identify surprises before the real thing

What If You Haven't Done NIST 800-171 Work Yet?

If you've been on contracts that required DFARS 252.204-7012 but haven't actually implemented the controls — you're in a common but challenging position.

You likely have a SPRS score on file from when the requirement started. If that score was based on an honest self-assessment, it's a starting point. If it was optimistic (and many were), you need to get to an accurate score first before you can plan a path to CMMC readiness.

Don't try to hide the gap by filing an inflated score. With DOJ actively pursuing False Claims Act cases against contractors who self-attested to NIST compliance they didn't have, the risk-reward calculus has shifted dramatically. An accurate, lower SPRS score with a credible plan of action is much safer than an inflated score with no evidence to back it up.

The practical path forward:

1. Get an honest gap assessment — find out which controls you've actually implemented vs. which you haven't
2. Update your SPRS score to reflect reality
3. Build your remediation plan, starting with the highest-weight controls
4. Start documentation (SSP, policies) in parallel with remediation
5. Schedule your C3PAO assessment for when you're genuinely ready

Frequently Asked Questions