What Is a NIST 800-171 Gap Assessment? What You Get

A NIST 800-171 gap assessment compares your current security with the practices your contracts call for, one practice at a time, and writes down every gap. For CMMC, it gives you a practice-by-practice picture of where you stand for Level 1 (17 practices) or Level 2 (110 practices). What you get at the end is a written report and a plan for what to fix first.

Why NIST SP 800-171 still matters during the suspension

NIST SP 800-171 Rev 2 is the security standard that underpins CMMC Level 2. A DoD contract that includes DFARS 252.204-7012, or that references NIST SP 800-171 compliance, almost certainly means you need CMMC Level 2.

The Phase 2 suspension did not change that. Both DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain in effect, and government-led assessments can still happen. While the suspension lasts, a new requirement may call for Level 1 (Self) or Level 2 (Self) only. The standard is still there to meet, and a gap assessment is how you find out how close you are. For the background, read CMMC Phase 2 Is Suspended.

The official CMMC links on Galaxy's resources page point to the source documents, including NIST SP 800-171 Rev 2, FAR 52.204-21 and DFARS 252.204-7012.

Scope first: level, boundary, and FCI or CUI

Before anyone reviews a single practice, settle the scope. That comes down to three decisions:

1. Which CMMC level applies to your contracts. Your contract language decides this, and a DFARS 252.204-7012 clause almost certainly points to Level 2.
2. Where your system boundary sits. Decide which systems, cloud services and people are inside the boundary you will assess.
3. Whether FCI or CUI is in scope. Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) are different kinds of information, and knowing which one you handle shapes the rest of the work.

A clear scope keeps the review on the systems that matter and stops it from drifting.

What a gap assessment checks

The heart of the work is a review of all applicable practices against your environment:

• Level 1: the 17 CMMC Level 1 practices. FAR 52.204-21 is the legal basis for Level 1, and its 15 requirements form the foundation of these practices.
• Level 2: the 110 Level 2 practices, which rest on NIST SP 800-171 Rev 2.

For each practice, the question is simple: is it in place and working in your environment today? At Galaxy, a Registered Practitioner guides you through all applicable practices to find the gaps, and each deficiency is written down by domain. Expect questions about how things really work day to day, not only about what a policy says. The goal is an accurate picture, so it pays to answer plainly, even when the answer is no.

What you should receive

Galaxy's gap assessment ends with five deliverables, and they make a useful checklist when you compare providers:

• a review of all applicable practices against your current environment
• a written gap report that identifies every deficiency by domain
• a risk-prioritized remediation roadmap, so you know what to fix first
• an SPRS score estimate based on where you stand today
• a recommended path: a Level 1 or Level 2 self-assessment

Each piece has a job. The written report is your record of every deficiency, organized by domain. The roadmap turns that long list into an order of work, sorted by risk. The recommended path tells you which self-assessment to plan for.

Treat the SPRS number as an estimate, not a final score. It shows roughly where you stand before any fixes, which makes it a planning tool rather than a result. In the same way, a gap assessment is not your self-assessment. It comes first, so you can fix what is missing before the self-assessment begins.

How to prepare

A little homework helps the review go smoothly:

• Gather your DoD contracts and subcontracts, and note any mention of FAR 52.204-21, DFARS 252.204-7012 or NIST SP 800-171.
• List your systems: computers, servers, cloud services, email and file storage, and who uses each one.
• Collect what you already have in writing, such as policies, a System Security Plan (SSP) or a Plan of Action and Milestones (POA&M).
• Pick one person to own the project and answer questions.
• Have someone who knows your network and cloud setup on hand to answer technical questions.
• Note any changes you know are coming, such as a new contract or a move to a new cloud service.
• Expect gaps. Finding them is the reason you are doing this.

After the gap report: remediation, SSP, POA&M and SPRS

The report is where the real work starts. Next come two kinds of work:

• Remediation: putting missing controls in place, deploying tools such as multi-factor authentication (MFA) and encryption, patching systems, and verification testing to confirm the fixes work.
• Documentation: the SSP, your policies and the POA&M. For Level 2, this also means CUI boundary documentation and data flow diagrams.

For Level 2, the SSP describes your system boundaries and operating environments, names the people responsible for security, and explains how you implement each of the 110 practices. The POA&M documents the deficiencies that are not yet fully remediated and the planned corrective actions, with responsible parties and target completion dates.

Work through the roadmap in its risk order, and update the POA&M as each gap closes. That way your documents always match where you really are.

Last comes your own Level 1 or Level 2 self-assessment. By then, the SPRS estimate from your gap report should have given way to a score your documents can support.

Next step

To see exactly what is included, read about Galaxy's CMMC Gap Assessment. Galaxy starts with a free, no-obligation discovery call, so you can talk through your contracts and scope first, and the checklist under How to prepare is a good list to bring. To book one, contact Galaxy Consulting.