NIST SP 800-171 Controls SDVOSBs Most Often Implement Incorrectly

Small defense contractors, including service-disabled veteran-owned small businesses (SDVOSBs) competing for information technology work, rarely fail their NIST SP 800-171 self-assessment because they ignore cybersecurity. They fail because a handful of the 110 requirements are implemented in a way that looks complete on the surface but does not satisfy the requirement as written. Those partial implementations are what drive a Supplier Performance Risk System (SPRS) score negative and surface as findings during a Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment. For the complete compliance framework that governs these requirements, read the CMMC Compliance for Small Defense Contractors guide.

This article identifies the NIST SP 800-171 requirements that small contractors most often implement incorrectly, explains the specific failure mode for each, and describes the remediation a contracting officer or prime contractor expects to see before teaming.

Why a Few Controls Decide the Score

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, defines 110 security requirements across 14 practice families. The DoD Assessment Methodology, published by the DoD Chief Information Officer, converts the implementation status of those 110 requirements into a single score submitted to SPRS.

The methodology is not a simple percentage. It assigns each requirement a deduction of 5, 3, or 1 point, weighted by the risk that its absence poses to Controlled Unclassified Information (CUI). The maximum score is 110; the minimum is negative 203. Because the highest-consequence requirements each deduct 5 points, a contractor that has genuinely implemented most of the 110 requirements can still post a negative score if the specific requirements it missed happen to be high-weight ones. The methodology and its scoring template are published at the DoD CIO CMMC assessments page, and the underlying control set is maintained by NIST at csrc.nist.gov.

The practical consequence: remediation effort should be triaged by point weight, not by requirement number. Fixing three high-weight requirements moves a score more than fixing a dozen low-weight ones.

The Controls Most Often Implemented Incorrectly

The following requirements are the ones that assessors and primes cite most frequently as partially or incorrectly implemented in small-contractor environments. The common failure mode matters more than the citation; a control marked "implemented" in a spreadsheet is only implemented if it meets the description below.

The two that most often decide the outcome

3.5.3, multifactor authentication. This is the requirement small contractors most often believe they have satisfied when they have not. Enabling MFA on webmail does not satisfy 3.5.3 if local and network access to CUI systems, and every privileged account, are not also covered. It carries one of the largest score deductions, and under the CMMC final rule it receives heightened scrutiny for POA&M eligibility.

3.13.11, FIPS-validated cryptography. Contractors routinely conflate "encrypted" with "FIPS-validated." The requirement is satisfied only when the cryptographic module protecting CUI appears on the NIST Cryptographic Module Validation Program list at the CMVP validated-modules search. A product that uses strong encryption without a validated module does not meet 3.13.11, and this is a frequent assessment finding.

How These Map to CMMC Level 2

CMMC Level 2, established by the CMMC final rule at 32 CFR Part 170, requires implementation of all 110 NIST SP 800-171 requirements, verified either through a DoD-authorized C3PAO assessment or through a formal self-attestation, depending on how the requiring activity scopes the contract. The requirements above do not become easier to satisfy under CMMC; they become non-negotiable.

Two points matter for small primes and subs planning a Level 2 effort. First, a subset of requirements are not POA&M-eligible under the final rule and must be fully implemented to reach even a conditional certification. Second, the SPRS self-assessment score is the pre-CMMC posture indicator, so a low score today is a direct predictor of assessment findings tomorrow. For the practical distinction between the two certification levels, see CMMC Level 1 vs. Level 2, and for how that score is read by primes during teaming, see how DoD primes use SPRS scores to screen subcontractors.

A Remediation Sequence That Moves the Score

Small contractors with constrained budgets should remediate in the order that produces the largest defensible score movement per dollar.

1. Fix multifactor authentication (3.5.3) across every access path and privileged account. Highest weight, and typically achievable with existing identity tooling.
2. Validate the cryptographic modules protecting CUI (3.13.11, 3.13.16). Confirm each module against the CMVP list; replace anything that is not validated.
3. Write a real System Security Plan (3.12.4) that describes the actual boundary and each requirement's implementation. Without it, an assessor cannot credit any control, and a prime cannot rely on the self-attestation.
4. Document remaining gaps in a POA&M (3.12.2) with owners and milestone dates. A negative score with a credible, dated remediation plan is a far stronger teaming position than an undocumented one.
5. Stand up the operational controls, vulnerability scanning (3.11.2), flaw remediation (3.14.1), and audit logging (3.3.1 / 3.3.2), so the environment demonstrably maintains its posture over time.

The safeguarding obligation behind all of this rests in DFARS 252.204-7012, and the assessment-currency obligation in DFARS 252.204-7019 and 252.204-7020, all published at acquisition.gov DFARS Part 252. A small contractor that implements the high-weight requirements correctly, documents the rest, and keeps the score current in SPRS is positioned to team, to bid, and to pass a Level 2 assessment when the contract requires one.

Frequently Asked Questions

Why does a single unimplemented NIST SP 800-171 control lower an SPRS score by more than one point?

The DoD Assessment Methodology does not weight the 110 requirements equally. It assigns a deduction of 5, 3, or 1 point to each requirement based on the risk that its absence poses to Controlled Unclassified Information. High-consequence requirements, such as multifactor authentication and FIPS-validated cryptography, carry the largest deductions. Because the maximum score is 110 but the highest-weight requirements deduct 5 points each, a contractor missing several high-weight requirements can score well below zero. The methodology's minimum score is negative 203.

Can a control be left in a Plan of Action and Milestones instead of being implemented?

Some requirements may be addressed through a Plan of Action and Milestones (POA&M) for scoring purposes, but the score submitted to the Supplier Performance Risk System must reflect the current implementation state, not the planned future state. Under the CMMC final rule at 32 CFR Part 170, a subset of requirements are not POA&M-eligible at all and must be fully implemented to achieve a conditional or final Level 2 status. Multifactor authentication and FIPS-validated cryptography are among the requirements that assessors most closely scrutinize for POA&M eligibility.

Is a self-assessment against NIST SP 800-171 enough to win a CMMC Level 2 contract?

Not by itself once the contract specifies CMMC Level 2. A self-assessment produces the SPRS score that DFARS 252.204-7019 and 252.204-7020 require, but a contract designated for CMMC Level 2 certification requires either a third-party assessment by a DoD-authorized C3PAO or a formal self-attestation under 32 CFR Part 170, depending on how the requiring activity has scoped the effort. The self-assessment is the foundation; the CMMC process is the verification layer built on top of it.