Home › CMMC FAQs › CMMC Model
CMMC Model — Official DoD FAQ

What Is the Relationship Between NIST SP 800-171 and CMMC?

💼
Need help mapping your NIST 800-171 controls to CMMC? Jun Cyber specializes in gap assessments.
Schedule Free Consultation
Official DoD Answer
Source Source: DoD CIO CMMC FAQs v5 (B-Q2)

NIST SP 800-171 is the federal safeguarding standard for controlled unclassified information (CUI) required by 32 CFR Part 2002, which the Department implemented contractually through inclusion of DFARS clause 252.204-7012 in applicable contracts. As of November 10, 2025, applicable contractors are required to undergo a Level 2 self-assessment to verify compliance with NIST SP 800-171 Revision 2 security requirements. Beginning November 10, 2026, CMMC Level 2 third-party assessments will be required.

In-Depth Analysis

NIST 800-171 Is the Foundation of CMMC

Understanding the relationship between NIST SP 800-171 and CMMC is critical. In simple terms: NIST SP 800-171 defines the requirements, and CMMC verifies you've implemented them.

The Evolution

Before CMMC, defense contractors were required to self-attest compliance with NIST SP 800-171 under DFARS 252.204-7012. The problem? A 2019 DoD IG report found that many contractors claimed compliance but hadn't actually implemented the security requirements. CMMC was created to add independent verification to the process.

How They Map Together

  • CMMC Level 1: 15 security requirements from FAR 52.204-21 (a subset of 800-171)
  • CMMC Level 2: All 110 security requirements from NIST SP 800-171 Rev 2
  • CMMC Level 3: 110 security requirements from 800-171 + 24 requirements from NIST SP 800-172

Key Timeline

Now through November 2026: Level 2 self-assessments against NIST SP 800-171 Rev 2 are required. After November 2026: Third-party (C3PAO) assessments become mandatory for applicable contracts.

If you've already been implementing NIST SP 800-171 under DFARS 7012, you're not starting from scratch. CMMC Level 2 uses the exact same 110 security requirements — the difference is that now someone independent verifies your implementation.

Have More Questions?

ChatCMMC can answer detailed questions about CMMC compliance, NIST 800-171, assessment preparation, and more — with source citations when available from selected official DoD and NIST sources.

Ask ChatCMMC →

CMMC Readiness Assessment

Find out where your organization stands and what steps you need to take. Jun Cyber's CMMC experts can help you interpret the requirements.

By submitting, you agree to be contacted by Jun Cyber. No spam, ever.

Related Questions

You Might Also Want to Know

CMMC Model

Will CMMC Update to Use NIST SP 800-171 Revision 3?

→ CMMC Model

How Will My Organization Know What CMMC Level Is Required for a Contract?

→ CMMC Model

What Is the Relationship Between NIST SP 800-172 and CMMC?

→
Jun Cyber

Ready to Start Your CMMC Journey?

Jun Cyber helps defense contractors prepare for applicable CMMC requirements. From scoping and gap assessments to documentation, remediation, and C3PAO assessment readiness — Jun Cyber provides hands-on compliance support.

📅 Schedule a Consultation Learn About CMMC Select →