Our expertise
NIST 800-171 Readiness for Defense Suppliers
Gap assessments, System Security Plan support, and SPRS score preparation for Upstate SC manufacturers that hold or bid on Department of Defense contracts.
A clear scope
The work behind the outcome.
If you hold a Department of Defense contract or subcontract, DFARS clause 252.204-7012 requires you to protect covered defense information to NIST SP 800-171 and report your self-assessment score in SPRS. The Department of Defense's suspension of CMMC Phase 2 in 2026 did not remove that obligation — the clause and the self-assessment requirements remain in force, and they flow down from primes to subcontractors of every size. NextGridIT translates NIST SP 800-171 into a practical gap assessment and remediation plan for small manufacturers, grounded in the same NIST framework experience applied daily to MARS-E and NIST 800-53 environments.
- Control-by-control gap assessment with evidence and interview notes
- Prioritized Plan of Action and Milestones (POA&M) for open gaps
- System Security Plan (SSP) support written for your actual environment
- SPRS score preparation with documentation you can stand behind
Our approach
A practical sequence of work.
- 01
Scoping and contract review
We identify which DFARS clauses apply, what information is covered, and which systems fall in scope — so the assessment matches your real obligations instead of a generic checklist.
Typical stage: 3-5 days - 02
Gap assessment
We assess the environment against NIST SP 800-171 requirements — access control, incident response, media protection, configuration management, and the rest — with evidence gathered on-site and remotely.
Typical stage: 1-2 weeks - 03
Prioritization and POA&M
Gaps are ranked by real risk and contract exposure, with practical fixes sized for a small manufacturer's budget and staff. You get a POA&M in the format your customer or auditor expects.
Typical stage: 3-5 days - 04
SSP and SPRS preparation
We support the System Security Plan documentation and prepare the inputs for your SPRS self-assessment score, so what you report matches what you actually do.
Typical stage: 1 week
Good questions
Before we get started.
Do we need CMMC certification to keep our DoD contracts?
Not currently. The Department of Defense suspended CMMC Phase 2 in July 2026, pausing the third-party certification rollout. The underlying DFARS 252.204-7012 clause remains in force: covered contractors still need to implement NIST SP 800-171 and self-assess, reporting scores in SPRS. Requirements can change — we track them so you don't have to.
What is a SPRS score, and why is our customer asking for one?
SPRS (Supplier Performance Risk System) is where DoD suppliers report their NIST SP 800-171 self-assessment score. Primes increasingly require a current score from subcontractors before awarding work. If you've been asked for a score, the path is a defensible self-assessment, documentation that backs it, and accurate reporting.
We're a small shop — is 800-171 realistic for us?
Yes, with proper scoping. Many controls map to what a well-run small environment needs anyway: access control, backups, updates, and documentation. A gap assessment tells you which controls apply to you, which you already meet, and which need work — so you invest where it counts instead of guessing.
Relevant to your organization.
Let’s work through it
Let’s work through your next step.
Choose a time to discuss your IT challenge, project fit, and practical next steps. Prefer to start by email? Send a few details instead.