Compliance & Regulatory Guidance
Your San Antonio defense contract requires NIST SP 800-171 compliance — so your team completed a self-assessment, submitted your SPRS score to PIEE, and assumed you were covered. Then the new contract bid came back with a CMMC Level 2 requirement, and suddenly you're not sure those two things are the same. They aren't — and the gap between them can cost you contract eligibility.
CMMC vs. NIST 800-171: How These Two Requirements Actually Differ
NIST SP 800-171 is the security control standard — 110 practices organized across 14 control families — that defines how Controlled Unclassified Information (CUI) must be protected. CMMC 2.0 is the DoD certification program built on top of those controls, adding mandatory third-party verification and tying the result directly to contract eligibility. Implementing the controls does not equal being certified.
Why the Confusion Exists
NIST SP 800-171 has been a DFARS requirement for years, so many contractors conflated satisfying it with being "compliant enough." CMMC 2.0 changed that equation: it transformed self-reported compliance into a verifiable, binary certification standard. Passing a self-assessment under NIST 800-171 does not produce a CMMC certificate, and no contracting officer will accept one as a substitute for the other.
This article focuses on resolving the CMMC vs. NIST 800-171 distinction before you walk into a bid situation unprepared. TechSage Solutions' CMMC compliance services in San Antonio address the broader picture — including timelines, assessment bodies, and remediation planning.
What NIST SP 800-171 Actually Requires (and Where It Stops)
NIST SP 800-171 requires contractors to implement 110 specific security controls across any system that touches CUI, document their posture in a System Security Plan and Plan of Action & Milestones, and submit a calculated SPRS score to the Supplier Performance Risk System. That score is already visible to contracting officers right now — before CMMC certification is even required.
Three Requirements Contractors Most Often Underestimate
- Full system scope: All 110 controls apply to every system that processes, stores, or transmits CUI — laptops, mobile devices, cloud storage, and remote access tools included. Contractors who scoped their assessment narrowly are often exposed on endpoint and cloud controls.
- Written SSP and POA&M: A System Security Plan documents how each control is implemented. A Plan of Action & Milestones documents gaps and remediation timelines. Without both, a self-assessment score is undefendable under audit.
- SPRS score under DFARS 252.204-7019: That score is visible to DoD contracting officers today. A low, negative, or missing score is already affecting contract competitiveness before CMMC phases in.
Contractors who completed their self-assessment under NIST SP 800-171 Rev. 2 — common prior to 2025 — likely have unaddressed gaps. Rev. 3, published in 2024, added new organizational controls, and C3PAOs will assess against the current standard.
What CMMC 2.0 Adds — and Why It Changes the Stakes
CMMC 2.0 adds three enforcement mechanisms NIST SP 800-171 alone does not have: mandatory third-party assessment by a certified organization, a binary pass/fail contract eligibility gate, and — at Level 3 — 24 additional controls from NIST SP 800-172. Self-attestation is no longer sufficient for the contracts most San Antonio defense contractors are pursuing.
| Dimension | NIST SP 800-171 | CMMC Level 2 | CMMC Level 3 |
|---|---|---|---|
| Applicability | All DoD contractors handling CUI under DFARS | CUI-handling contractors on covered DoD contracts | Contractors on highest-sensitivity DoD programs |
| Assessment method | Self-assessment (submitted to SPRS) | Triennial C3PAO third-party assessment | DCSA-led government assessment |
| Enforcement mechanism | DFARS clause 252.204-7019; score visibility | Contract eligibility gate under DFARS final rule | Contract eligibility gate; government oversight |
| Scope of controls | 110 controls across 14 families (Rev. 3) | Same 110 NIST 800-171 controls | 110 NIST 800-171 + 24 controls from NIST SP 800-172 |
| Pass/fail gate | No — score-based, self-reported | Yes — binary; no certification = no bid | Yes — binary; government-assessed |
Under the DFARS final rule, a contractor without CMMC Level 2 certification cannot bid on covered DoD contracts once required — regardless of SPRS score or prior performance. Remediating gaps before engaging a C3PAO is the correct sequencing: a failed assessment costs time and money to remediate and re-assess.
Where San Antonio Defense Contractors Commonly Get Caught
The three most common gaps TechSage Solutions identifies among San Antonio-area defense contractors are subcontractor flow-down misunderstandings, missing SSP and POA&M documentation, and CUI stored in non-compliant commercial cloud environments.
Gap 1: Assuming a Prime's CMMC Covers Subcontractors
Every entity in the supply chain that handles CUI must be independently assessed and certified. A sub without its own CMMC certification cannot legally handle CUI under a covered contract — and cannot represent to the prime that it is compliant. For small firms supporting JBSA-area primes, IT support for San Antonio defense contractors covers the infrastructure needed to support an independent compliance posture.
Gap 2: An SPRS Score With No Supporting Documentation
Many firms in the San Antonio–New Braunfels corridor submitted an SPRS score but never produced a formal SSP or POA&M. Without those documents, the score is undefendable. If a contracting officer or auditor requests supporting artifacts and none exist, the self-attestation carries no weight.
Gap 3: CUI in a Non-Compliant Cloud Environment
Moving CUI to a standard commercial Microsoft 365 tenant — not Microsoft 365 GCC High — is the single most common gap TechSage Solutions identifies in readiness assessments. Both NIST 800-171 and CMMC require a FedRAMP Moderate-equivalent cloud environment for CUI. Standard commercial Microsoft 365 does not meet that threshold; GCC High does. TechSage's San Antonio compliance services are designed to address these gaps before a C3PAO assessment, not after.
Frequently Asked Questions
Does NIST 800-171 compliance mean I'm already CMMC certified?
No. NIST SP 800-171 compliance means you have implemented — or self-attested to implementing — the required security controls and submitted an SPRS score. CMMC certification requires a formal third-party assessment by a C3PAO. Self-attestation does not satisfy CMMC Level 2 requirements for covered DoD contracts.
What is CUI and how do I know if my business handles it?
Controlled Unclassified Information (CUI) is government-created or government-managed information that requires safeguarding under law, regulation, or policy — but is not classified. If your contracts reference technical drawings, specifications, or program data tied to DoD programs, you likely handle CUI. Review your contract's DD Form 254 and any DFARS clauses referencing CUI or NIST SP 800-171 to confirm your scope.
When does CMMC certification become mandatory for DoD contracts?
Under the CMMC 2.0 DFARS final rule, CMMC requirements are being phased into DoD contracts beginning in 2025, with broader rollout continuing through 2026 and beyond. Contractors should expect CMMC Level 2 requirements to appear in new solicitations now and should not wait for a specific contract requirement to begin readiness work.
Do CMMC requirements apply to subcontractors, or only prime contractors?
CMMC requirements apply to every entity in the supply chain that handles CUI — including subcontractors. A prime contractor's CMMC certification does not flow down to subs. Each subcontractor that processes, stores, or transmits CUI must obtain independent CMMC certification for covered contracts.
What is an SPRS score and how does it relate to CMMC?
An SPRS score is a numerical value submitted to the Supplier Performance Risk System reflecting a contractor's NIST SP 800-171 self-assessment results. Under DFARS 252.204-7019, the score is visible to DoD contracting officers today. A low or missing score is already affecting bid competitiveness before CMMC certification fully phases in.
Does moving to Microsoft 365 make me NIST 800-171 compliant?
Not automatically. Standard commercial Microsoft 365 does not meet the FedRAMP Moderate-equivalent cloud environment requirement that NIST 800-171 and CMMC impose for CUI. Microsoft 365 GCC High is the appropriate environment. Contractors using standard M365 for CUI have a compliance gap requiring remediation before a CMMC assessment.
What is a C3PAO and do I need one for CMMC Level 2?
A C3PAO — CMMC Third Party Assessment Organization — is a DoD-authorized firm that conducts formal CMMC assessments. CMMC Level 2 certification for most CUI-handling contractors requires a triennial C3PAO assessment. Self-assessments are permitted only for a limited subset of Level 2 contracts as defined in the DFARS final rule.
Not Sure Where Your CMMC Readiness Actually Stands? Start With a Gap Assessment.
TechSage Solutions works with San Antonio defense contractors to assess your current posture against all 110 NIST 800-171 controls, identify the gaps that would fail a C3PAO audit, and build the remediation roadmap — so you can pursue contracts with confidence.
Schedule Your CMMC Gap Assessment
