NIST SP 800-171 Readiness and Remediation
Winston & Miller assesses your organization against all 110 NIST SP 800-171 requirements, develops your SPRS score, and builds the documentation your government customers will ask to see. We do not sell certifications or make guarantees against deadlines.
What a Gap Assessment Produces
A completed gap assessment delivers a requirement-by-requirement review of all 110 controls: which are fully implemented, partially implemented, or not yet addressed. Each finding includes a current status, evidence reviewed, and a recommended action. The output drives your SPRS score calculation and forms the basis of your system security plan. Organizations pursuing CMMC Level 2 assessment will need to demonstrate compliance with all 110 NIST SP 800-171 requirements; our assessment builds that evidentiary record.
Our Engagement Model
Phase 1: Scoping
Identify the CUI boundary, applicable systems, and the subset of requirements that apply to your environment.
Phase 2: Gap Assessment
Interview-based review of all 110 requirements with evidence review — producing a finding for each requirement with current implementation status.
Phase 3: SPRS Score Development
Calculate the DoD Supplier Performance Risk System score from assessment findings, with a documented basis for each deduction.
Phase 4: System Security Plan
Draft SSP with implementation statements per requirement, describing how each control is or will be met.
Phase 5: POA&M
Prioritized remediation roadmap with estimated effort per finding, grouped by control family and risk level.
About the SPRS Score
The Supplier Performance Risk System (SPRS) score quantifies your organization’s gap against the 110 NIST SP 800-171 requirements on a scale from -203 to 110. DoD contractors must enter and maintain their score in the SPRS database. The score is self-attested, so the accuracy of your documentation directly affects your standing in source selection and contract award decisions. Our assessment provides the documented, evidence-backed basis for that attestation. Verified on current DoD guidance.
What We Do Not Do
We do not provide CMMC Third-Party Assessment Organization (C3PAO) assessments. We do not issue certifications. Our work prepares your organization for self-assessment or a third-party assessment; when and how you pursue assessment is your decision. We will not apply pressure tied to government deadlines.
Related White Paper
From SPRS Score to CMMC Level 2: A Readiness Roadmap for Defense Contractors
A defense contractor handling CUI moves from an SPRS score to CMMC Level 2 by implementing the 110 NIST SP 800-171 Rev 2 requirements, scoring them honestly with the DoD methodology, closing high-value gaps first, and preparing evidence for a self-assessment or C3PAO certification. A conditional status requires at least 88 of 110 points.
Frequently Asked Questions
What is the SPRS score?
The Supplier Performance Risk System (SPRS) score is a value between -203 and 110 that represents an organization's gap against the 110 NIST SP 800-171 requirements. DoD contractors are required to input their current SPRS score in SPRS. The score is self-attested; our assessment provides the documented basis for that attestation. Verified on current DoD guidance.
Do you certify us for CMMC?
No. We do not issue certifications and we do not conduct third-party assessments. We assess your posture, build your documentation, and help you remediate gaps. When you are ready for a C3PAO assessment, you engage a certified third-party assessor organization directly.
How long does the assessment take?
A focused gap assessment of a small to mid-size organization typically takes two to four weeks from kickoff to SPRS score delivery. Full SSP development adds four to eight weeks depending on the number of applicable systems and the completeness of existing documentation.
What is NIST SP 800-171 Rev 3?
NIST SP 800-171 Rev 3 was published in May 2024 and reorganized the requirements into organization-defined parameters (ODPs) and added alignment with NIST SP 800-53 Rev 5. As of the date of this review, DoD CMMC program rule remains tied to Rev 2; we track the transition and advise clients on the delta. Verified on current guidance.
Know Where You Stand Against 800-171
Start Your 800-171 Gap Assessment