Hello Nicki, you can find the NIST SP 800-171 DoD Assessment Methodology and the scoring methodology (Annex A) at the following link: securedbycss.com/wp-content/uploads/2021/02/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf

@@auditorsense4243 Thank you so much!

Whoops! thanks for the correction!

Free to use and share! We just ask that you do not remove the credits/give credit.

Entering your NIST SP 800-171 assessment details into the SPRS applies to DoD contractors that handle CUI and more specifically, have the contract clause DFARS 252.204-7019 "Notice of NIST SP 800-171 DoD Assessment Requirement" in their contract. 252.204-7019 is a newer contract clause that was added back in November of 2020 as an interim rule. We have a video explaining this further that can be found here: kzbin.info/www/bejne/oJeogZWHntaUoqc&t= Additionally, you can find more information about contract clause DFARS 252.204-7019 here: www.acquisition.gov/dfars/252.204-7019-notice-nist-sp-800-171-dod-assessment-requirements.

The level determination must be given by the information system owners... I believe that this example shows how to evaluate the criteria: The risk for a supermarket information system isn't as high as the risk for a bank information system. That said, a Bank information system has to be classified as a High level and the supermarket as moderate/low.

@@PabloSilva-ph6mk Thanks

Sorry for the late response, but you do not upload the actual POAM or SSP to the SPRS. You will just upload information about these items into the SPRS. The SPRS currently does not allow any documents or attachments to be uploaded.

Hi Chad, thank you. The template specifically is from ComplyUp. Here is the link! www.complyup.com/cmmc-ssp-template/

You do not need a score of 110 for the NIST 800-171 self-assessment to be compliant with DFARS 252.204-7012/7019. However, if the NIST 800-171 security requirements (controls) are not completely implemented, you must develop a Plan of Action & Milestones (POA&Ms). For every security control that is not implemented, you must document the security control in the POA&M, and describe when and how the unimplemented security control will be met. For more information on this, I recommend you check out the NIST SP 800-171 DoD Assessment Methodology, which can be found here: www.acq.osd.mil/dpap/pdi/cyber/docs/NIST%20SP%20800-171%20Assessment%20Methodology%20Version%201.2.1%20%206.24.2020.pdf Now keep in mind, POA&Ms are only acceptable for DFARS 252.204-7012/7019. When the Cybersecurity Maturity Model Certification (CMMC) is rolled out over the next few years, you cannot obtain a CMMC certification if your organization has unimplemented security requirements. For CMMC, you must have all required security practices and processes implemented at the time of the CMMC assessment. Outstanding security practices or processes will result in an organization failing the CMMC assessment.

Hello, sorry for the late reply. NIST RMF was developed back in 2014 with input from thousands of private sector organizations/individuals. That being said, there is not any guidance or dates surrounding private sector adoption as it is up to each individual organization. I am comfortable saying that adoption has increased vastly over the past few years among the private sector.

The controls have been re-written using strong action verbs to clearly define the goal of each control. The overall structure of each control is more outcome focused rather than impact focused. A good example is SC-10: Rev 4, the control reads: "The information system terminates the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time-period] of inactivity.". Rev 5, the control reads: "Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity." The control is a lot more clear and concise on the end goal of the control implementation.