CMMC vs. NIST SP 800-171 vs. DFARS: How They Fit Together
- Brandon Alsup
- May 26
- 5 min read
For defense contractors, cybersecurity compliance can feel like a pile of acronyms: CMMC, NIST SP 800-171, DFARS, SPRS, CUI, FCI.
The confusion is understandable. These terms are closely related, but they are not interchangeable. A company may be told it needs to “meet NIST,” “comply with DFARS,” or “get ready for CMMC” as if those are three separate projects.
They are not separate projects. They are different parts of the same compliance structure.
The simplest way to understand it is this:
NIST SP 800-171 defines the cybersecurity requirements. DFARS makes those requirements contractual. CMMC verifies whether contractors have actually implemented them.
That distinction matters because DoD cybersecurity compliance is moving from “we say we do this” to “we can prove we do this.”
What Is NIST SP 800-171?
NIST SP 800-171 is a cybersecurity standard published by the National Institute of Standards and Technology. It provides security requirements for protecting Controlled Unclassified Information (CUI) when that information lives on nonfederal systems, such as a defense contractor’s network, cloud environment, endpoints, or business systems. NIST describes the standard as requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.
In plain English, NIST SP 800-171 answers the question:
What security practices should a contractor have in place to protect sensitive government information?
The requirements cover areas such as access control, audit logging, configuration management, incident response, media protection, physical protection, risk assessment, security assessment, and system integrity.
For many defense contractors, NIST SP 800-171 is the technical foundation of compliance. It is where the actual cybersecurity work lives: multifactor authentication, user access controls, endpoint protections, logging, documentation, policies, procedures, and evidence that those practices are operating.
A key note: NIST SP 800-171 Revision 3 has been published, and NIST lists Revision 2 as withdrawn and superseded by Revision 3. However, CMMC implementation and many current DoD compliance references continue to center on the CMMC model and contract-specific requirements, so contractors should always check the exact contract clause, solicitation language, and current DoD guidance before assuming which revision applies.
What Is DFARS?
DFARS stands for the Defense Federal Acquisition Regulation Supplement. It is not a cybersecurity framework in the same way NIST SP 800-171 is. DFARS is part of the DoD contracting rulebook.
DFARS answers a different question:
What cybersecurity obligations are written into DoD contracts?
For cybersecurity, the most important DFARS clause has historically been DFARS 252.204-7012, which requires contractors to provide adequate security for covered contractor information systems and, for certain systems, implement NIST SP 800-171. It also includes cyber incident reporting obligations.
Additional DFARS clauses built on that foundation. DFARS 252.204-7019 requires offerors that must implement NIST SP 800-171 to have a current assessment posted in the Supplier Performance Risk System, or SPRS. DFARS 252.204-7020 describes the DoD assessment requirements and gives the government the ability to conduct medium or high assessments.
Now, DFARS 252.204-7021 brings CMMC requirements directly into covered DoD contracts. The clause requires contractors to maintain the required CMMC status for systems that process, store, or transmit Federal Contract Information or Controlled Unclassified Information, and to flow down appropriate CMMC requirements to subcontractors.
So DFARS is the contractual enforcement layer. If NIST tells you what to implement, DFARS tells you why it matters for contract eligibility.
What Is CMMC?
CMMC, or the Cybersecurity Maturity Model Certification, is the DoD’s assessment and verification program for defense contractors.
CMMC answers the question:
Can the contractor prove that required cybersecurity practices are actually implemented?
DoD’s current CMMC rollout is underway. Phase 1 began November 10, 2025 and runs through November 9, 2026, focusing primarily on CMMC Level 1 and Level 2 self-assessments. The final DFARS acquisition rule took effect November 10, 2025 and formally integrated CMMC into DoD contracts through DFARS clauses 252.204-7021 and 252.204-7025.
CMMC has three levels:
Level 1 applies to contractors that handle Federal Contract Information, or FCI. It focuses on basic safeguarding requirements.
Level 2 applies to contractors that handle CUI. It is aligned with the security requirements in NIST SP 800-171 under the CMMC model.
Level 3 applies to higher-risk environments and includes additional enhanced requirements beyond Level 2.
The important point is that CMMC does not replace NIST SP 800-171. It operationalizes it. CMMC is the mechanism DoD uses to evaluate whether the contractor has implemented the necessary practices, documented the environment, defined the scope, and can support the required assessment path.
How They Work Together
Think of the relationship this way:
Requirement | Main Role | Simple Explanation |
NIST SP 800-171 | Security standard | Defines the cybersecurity requirements for protecting CUI |
DFARS | Contract rule | Puts cybersecurity obligations into DoD contracts |
CMMC | Assessment program | Verifies that required practices are implemented and maintained |
A contractor handling CUI may need to implement NIST SP 800-171 because DFARS 252.204-7012 requires it. The contractor may need to submit or maintain assessment information in SPRS because of DFARS 7019 and 7020. And the contractor may need the correct CMMC status because DFARS 7021 now ties CMMC into contract performance and award requirements.
That is why CMMC is often described as complementing NIST SP 800-171. NIST provides the control baseline. CMMC adds structure, assessment expectations, status tracking, affirmations, and accountability.
Why This Matters for Contractors
For local defense contractors, manufacturers, engineering firms, technology providers, and subcontractors, the risk is not just failing an assessment. The bigger risk is misunderstanding the compliance landscape.
A company may believe it is “NIST compliant” because it has an old SPRS score. But CMMC readiness requires more than a spreadsheet score. It requires accurate scoping, clear CUI boundaries, a real System Security Plan, evidence that controls are operating, subcontractor awareness, and leadership accountability.
This is where many organizations get caught off guard. The cybersecurity tools may be partially in place, but the documentation, evidence, and operational discipline are not ready for review.
The Bottom Line
CMMC, NIST SP 800-171, and DFARS are not competing frameworks.
They are connected layers of the same DoD cybersecurity compliance model:
NIST SP 800-171 defines the security requirements. DFARS makes them part of the contract. CMMC verifies that contractors can prove implementation.
For contractors pursuing or supporting DoD work, the practical question is no longer, “Do we have cybersecurity tools?”
The better question is:
Can we prove that the right controls are implemented, documented, maintained, and aligned to the contracts we want to win?
That is the heart of CMMC readiness.
Official Resources
DoD CMMC Program
Use this as the main official CMMC reference. It covers current CMMC status, phased implementation, assessment levels, and DoD resources.
NIST SP 800-171: Protecting CUI in Nonfederal Systems
Use this as the official source for the security requirements behind CUI protection and CMMC Level 2.
DFARS 252.204-7021: Contractor Compliance with CMMC Requirements
Use this as the official contract-clause reference showing how CMMC is being tied into DoD contracts.
Disclaimer
The information contained in this communication is intended for limited use for informational purposes only. It is not considered professional advice, and instead, is general information that may or may not apply to specific situations. Each case is unique and should be evaluated on its own by a professional qualified to provide advice specifically intended to protect your individual situation. TK Compliance is not liable for improper use of this information.
Comments