A small defense contractor prepares for CMMC Level 2 against NIST SP 800-171: gap assessment, SPRS score and a limited POA&M
A precision-parts maker of about 85 people supplying a prime defense contractor, with controlled technical drawings in its mail and file shares.
- Scale
- 110 requirements in 14 families, 1 CUI enclave of 24 users, SPRS score from 47 to 104, 6 open POA&M items
- Engagement
- Seven months from kickoff to a mock assessment
The challenge
The prime contractor had asked for the firm's SPRS score and its plan for Cybersecurity Maturity Model Certification Level 2, and nobody at the firm could say what the score was. Controlled unclassified information in the form of drawings and specifications moved by email and lived on general file shares next to everything else, so it was unclear which systems were even in scope. Leadership wanted to keep the contracts without rebuilding the whole company.
CMMC is the Department of Defense program that checks whether contractors protect the information they are given. Level 2 covers controlled unclassified information, and its security requirements are the 110 in NIST Special Publication 800-171 Revision 2, grouped into 14 families such as access control, audit and accountability, and incident response. The firm's task was to learn where it stood against them, in a form an assessor accepts.
Scoping decided the cost of everything else. Instead of bringing the whole company up to the standard, we traced each flow of CUI and moved it into one small enclave: a separate cloud tenant for mail and files, 24 managed laptops and a controlled path for drawings from the engineering workstations. Machines that never touch CUI stayed outside. The boundary was drawn in a diagram, written into the system security plan and tested, because an assessor reads the boundary before anything else.
The gap assessment went requirement by requirement. Each one was marked met, partly met or not met, with the evidence behind it: a configuration export, a policy, a screenshot with a date or a log. The 110 requirements carry different weights in the SPRS calculation, 1, 3 or 5 points, so the baseline of 47 pointed straight at the expensive failures: no MFA on some accounts, no FIPS-validated encryption for CUI, thin logging and no tested incident response plan.
Remediation followed the weights. Five- and three-point items came first because only the encryption requirement SC.L2-3.13.11 can be partly met on a POA&M and still count toward a conditional status, and every other item above one point has to be fully implemented before an assessment. The remaining one-point gaps went on the plan with an owner, a date and an interim control, and the system security plan itself was finished, since that requirement cannot sit on a POA&M.
A mock assessment ran against the same objectives an assessor uses, by an engineer who had not touched the remediation. It checked each control by interview, by examining documents and by testing, and it produced the evidence binder the firm would hand to a certified third-party assessment organization. The firm also set its annual affirmation by a senior official as a calendar item, since Level 2 status has to be maintained, not just obtained.
What our team delivered
- A scoping exercise that traced where controlled unclassified information (CUI) enters, is stored, is processed and leaves, then moved it into one enclave of 24 users and their devices so the other 60 or so staff and the shop floor stayed outside the assessment boundary
- A gap assessment against the 110 requirements of NIST SP 800-171 Revision 2 (the assessment basis for CMMC Level 2), checked against the objectives in NIST SP 800-171A, with each requirement marked met, partly met or not met and backed by evidence
- A baseline SPRS score of 47, calculated with the DoD Assessment Methodology, which starts at 110 and subtracts 1, 3 or 5 points for each requirement that is not implemented
- A system security plan and a plan of action and milestones (POA&M), written so that every open item had an owner, a date and an interim control
- Remediation of the heavy items first: multifactor sign-in, FIPS-validated cryptography for CUI at rest and in transit, audit logging with weekly review, vulnerability scanning, boundary protection, incident response and media handling
- A check that each cloud service touching CUI met the FedRAMP Moderate baseline or equivalent that the DFARS clause requires, plus a mock assessment run by an engineer who had not done the remediation
Result
The mock assessment scored 104 of 110. Six requirements, each worth one point, remained open on a POA&M, which sits inside the rules for a conditional Level 2 status: a score of at least 88 (80 percent of 110), and only one-point items on the plan, which must be closed within 180 days. The firm closed four of the six in the first two months. This is readiness work, not a certification: only an authorized assessor or the government can grant a CMMC status, and the program's phase-in dates and contract clauses should be checked against the 32 CFR Part 170 final rule and the contract itself. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 4 more
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Critical patches in days, not months
Distribution of days from vendor patch release to deployment for critical-severity CVEs, before and after a managed patching service. The dashed line marks two weeks: under CISA BOD 22-01, US federal agencies must remediate Known Exploited Vulnerabilities within two weeks for CVEs assigned in 2021 or later (six months for older ones). Private organisations are not bound by it, but it is a sensible benchmark. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.