NIST SP 800-171 and CMMC Readiness for Small Defense Suppliers

Where CMMC stands in October 2026

On July 13, 2026, DoD announced that CMMC Phase 2 is suspended pending a review. Phase 2 had been planned for November 10, 2026 and would have made third-party Level 2 assessments by a C3PAO mandatory in applicable contracts. No replacement date has been announced.

What has not changed:

• Phase 1 remains. Level 1 and Level 2 self-assessments and annual affirmations in SPRS still apply where your contract requires them.
• DFARS 252.204-7012 remains in force, including safeguarding CUI and reporting cyber incidents to DoD within 72 hours.
• NIST SP 800-171 Rev. 2 and its 110 requirements remain the standard your contract references.

This situation is changing. Check your contract and the DoD CIO CMMC site for current requirements. The suspension delays third-party assessments. It does not remove the security obligations already in your contract.

FCI or CUI: scoping comes first

Getting scope right saves more time and money than anything else.

Federal Contract Information (FCI) is non-public information provided or generated under a government contract. It falls under FAR 52.204-21 and its 15 basic safeguarding requirements, which correspond to CMMC Level 1.

Controlled Unclassified Information (CUI) is information the government has identified as needing protection, such as certain technical drawings and specifications. It falls under DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171, which correspond to CMMC Level 2.

Scoping traces where this information enters your business (email, customer portals, shared drives), where it is stored and who touches it. Sometimes a smaller dedicated environment for CUI shrinks the scope a lot. Read FCI and CUI explained for more.

What the readiness work includes

• Scoping memo and data-flow diagram showing where FCI and CUI live and which systems are in scope
• Gap assessment against all 110 requirements, using the assessment objectives in NIST SP 800-171A (published at csrc.nist.gov)
• System security plan (SSP) drafted or updated to describe how each requirement is met
• Plan of action and milestones (POA&M) for every requirement not yet met, with owners and target dates
• SPRS score preparation using the DoD Assessment Methodology, which scores from 110 down to -203, with documentation behind each scored item
• Policies and procedures written for your actual operation, not copied templates
• Evidence collection, organized by requirement, so you can show your work
• Incident reporting readiness for DFARS 7012, connected to incident response planning

You own every document. Your company submits its score in SPRS and a senior official makes the affirmation. That responsibility stays with you.

Good to know

This is readiness help. Keith Systems is not a C3PAO, CMMC assessor or authorizing official and doesn't issue certifications, and it isn't a law firm, so contract questions go to your attorney.

Who this is for

Small machine shops, engineering firms, manufacturers and service subcontractors that received a DFARS flowdown clause from a prime or higher-tier sub, or a security questionnaire asking for an SPRS score. Lompoc sits next to Vandenberg Space Force Base, so some local businesses are in the defense supply chain. See CMMC help for defense suppliers near Vandenberg and the CMMC Level 2 readiness guide.

Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and has about six years of security compliance work on government systems. Keith Systems does not represent and is not endorsed by Vandenberg Space Force Base or any government agency.

How an engagement works

1. Free consult of about 30 minutes. Bring your contract clauses if you can, such as DFARS 252.204-7012, 7019, 7020, 7021 and FAR 52.204-21.
2. Written scope and fee before any work begins.
3. Scoping session, on site in the Lompoc, Santa Maria and wider Santa Barbara County area, or remotely.
4. Gap assessment through interviews and evidence review.
5. Documents drafted with you: SSP, POA&M, policies and score worksheet.
6. Readout with a realistic schedule for closing POA&M items.

Book a free security consult or call (805) 800-8163.

Who decides your score

The client alone determines and submits its own assessment results and annual affirmations in SPRS. Keith Systems does not sign affirmations or submit scores for anyone. Any worksheet or gap list we prepare is a draft for the client to validate, states the evidence it is based on, and lists the requirements that are not yet implemented. All readiness work is done in the client's own environment and on the client's own accounts.