The short answer: the CMMC Phase 2 pause did not remove a single NIST 800-171 compliance obligation. Defense contractors that handle Controlled Unclassified Information (CUI) still owe the 110 security requirements in NIST SP 800-171 under DFARS 252.204-7012. They also owe a current System Security Plan, a Plan of Action and Milestones for open gaps, an accurate score in the Supplier Performance Risk System (SPRS), and 72 hour reporting of cyber incidents. BetterWorld Technology helps contractors meet those obligations through its NIST 800-171 compliance services and its defense contractor IT practice.
This guide explains what still applies while CMMC is under review, where contractors most often fall short, and how to stay ready for whatever the program looks like next.
Key Takeaways
- NIST 800-171 compliance remains a contractual requirement under DFARS 252.204-7012, regardless of the CMMC review.
- Contractors must keep a System Security Plan, track open gaps in a POA&M, and post an accurate self assessment score in SPRS.
- Inflated SPRS scores create False Claims Act exposure, so accuracy matters more than a high number.
- Prime contractors continue to flow requirements down and request evidence from suppliers.
- Work done now on scoping, controls, and documentation carries directly into any future CMMC assessment.
What Changed With CMMC, and What Did Not
In July 2026, the Department of War suspended Phase 2 of the CMMC rollout and launched a program review. That pause stopped the scheduled shift toward third party Level 2 certification in new contracts. However, it did not change the underlying security requirements that DFARS clauses already place in existing contracts.
In practice, the pause changes how and when the government verifies compliance, not whether contractors owe it. Contracts that include DFARS 252.204-7012 still require NIST SP 800-171 controls. Likewise, DFARS 252.204-7019 and 7020 still require a current self assessment score in SPRS for covered contracts. As a result, contractors that paused their programs along with CMMC may now carry more risk than before.
Five NIST 800-171 Compliance Obligations That Still Apply
01Implement the Security Requirements
NIST SP 800-171 defines 110 requirements across areas such as access control, authentication, audit and accountability, configuration management, and incident response. Each one protects CUI wherever your systems store, process, or transmit it. Consequently, the first step is always knowing where CUI lives, since that scope determines which systems the controls must cover.
02Maintain a System Security Plan
The System Security Plan describes your environment, its boundaries, and how you meet each requirement. Assessors, primes, and contracting officers all treat it as the foundation document. A plan that no longer matches the real environment undermines every other piece of evidence.
03Track Gaps in a POA&M
Few contractors meet every requirement on day one. Therefore, a Plan of Action and Milestones documents each open gap, the remediation steps, owners, and target dates. Kept current, it shows steady progress and good faith effort.
04Post an Accurate SPRS Score
The DoD Assessment Methodology produces a score that ranges from 110 down to negative 203. Contractors then post that score in SPRS. Because an overstated score can expose a company to False Claims Act liability, accuracy and supporting evidence matter far more than the number itself.
05Report Incidents Within 72 Hours
DFARS 252.204-7012 requires contractors to report cyber incidents affecting covered defense information within 72 hours of discovery. In addition, they must preserve relevant images and data for potential review. A tested incident response plan makes that timeline achievable.
Where Contractors Most Often Fall Short
Gap assessments tend to surface the same issues across organizations of every size. Below, a summary shows the most common findings and how to address them.
| Common Gap | Why It Matters | Practical Fix |
|---|---|---|
| Unclear CUI scope | Controls cannot protect data no one has located | Map CUI flows and define a tight enclave or boundary |
| Incomplete MFA | Weak authentication remains a top entry point | Enforce multifactor authentication for all remote and privileged access |
| Missing audit logs | Teams cannot investigate or report incidents | Centralize logs and set retention through managed SIEM |
| Outdated SSP | Documentation no longer matches reality | Review the plan quarterly and after major changes |
| Unsupported score | Overstated SPRS entries create legal exposure | Tie every claimed control to current evidence |
| Cloud services out of scope | CUI in noncompliant cloud tenants breaks requirements | Use environments that meet FedRAMP Moderate equivalency |
How to Stay Ready While CMMC Is Under Review
The smartest approach treats the pause as time to build, not time to wait. First, confirm your CUI scope and refresh the System Security Plan. Next, close high value gaps such as multifactor authentication, logging, and access reviews. Then update your SPRS score so it reflects verified reality.
Because CMMC Level 2 maps directly to NIST SP 800-171, every improvement made now carries forward into future certification. Additionally, primes increasingly ask suppliers for evidence during proposals and renewals. Our CMMC readiness team helps contractors prepare documentation that answers those requests quickly.
BetterWorld Technology works alongside defense contractors as a long term partner. As a SOC 2 Type 2 certified and ISO/IEC 27001:2022 certified organization, we apply the same discipline to our own environment that we help clients build in theirs.
Keep Your Contracts Protected
Get a clear view of your NIST SP 800-171 posture, your SPRS score, and the gaps that matter most before the next CMMC milestone arrives.
Frequently Asked Questions
Do contractors still owe NIST 800-171 compliance while CMMC is under review?
Yes. DFARS 252.204-7012 continues to require NIST SP 800-171 controls in covered contracts, and SPRS scoring still applies.
What is an SPRS score?
It is the self assessment result, from 110 down to negative 203, that contractors post in the Supplier Performance Risk System to show how many requirements they meet.
Can we have open gaps and still bid on contracts?
Many contractors do, provided each gap appears in a current POA&M and the posted score accurately reflects their status.
How does NIST SP 800-171 relate to CMMC Level 2?
CMMC Level 2 uses the same 110 requirements, so work done on NIST SP 800-171 prepares you for a future Level 2 assessment.
Do subcontractors need to comply?
Yes. Primes flow DFARS requirements down to any subcontractor that handles CUI, and many now request evidence directly.