Register:Glossary3 recordsSHA3-256 chainedhead sha3:5bb790e86688ac7b9d66688d80160f9c03b9b73b9f288fa45650c64d19046851Intact
REC 0001DEFINITIONsha3-2567a6acaf1e5f2fbba0cf82db6d55e5dca9628dad649557301ddd8bd3103c185f5prev:aff2611bd0ac

NIST Special Publication 800-171 defines 110 security requirements across 14 control families, from Access Control to System and Communications Protection. CMMC Level 2 is, in practice, an assessment against these 110 controls.

Revision 2 remains the assessment baseline under DoD's current class deviation. Revision 3 restructures the families and introduces Organization-Defined Parameters, but CMMC has not yet moved its assessment baseline to Rev 3.

Each control is scored, and unimplemented controls subtract points from a maximum of 110 — which is how an environment that feels 'mostly compliant' can produce a deeply negative SPRS score.

REC 0002RELATED RECORDSsha3-2565bb790e86688ac7b9d66688d80160f9c03b9b73b9f288fa45650c64d19046851prev:7a6acaf1e5f2

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Related terms and reading

  1. CUI: Controlled Unclassified InformationCUI is government-created or -owned information that requires safeguarding under law, regulation, or government-wide policy, but is not classified.
  2. SPRS: Supplier Performance Risk SystemSPRS is the DoD system where contractors post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.
  3. SSP: System Security PlanAn SSP is the document describing how an organization implements each required security control across its in-scope environment.
  4. POA&M: Plan of Action and MilestonesA POA&M is a tracked plan for remediating security controls that are not yet fully implemented, with owners and target dates.
  5. NIST 800-171 Cloud Compliance Guide

Know the term. Then see the record behind it.

Request AccessBook a call
Sealed
Last amended
Register colophonRecomputable by a second party
SeqLabelSHA3-256Prev
REC 0000HEADaff2611bd0ac16a60f665d9c
REC 0001DEFINITION7a6acaf1e5f2aff2611bd0ac
REC 0002RELATED RECORDS5bb790e866887a6acaf1e5f2

The record headers on this page are SHA3-256 digests of this page's own copy, chained in sequence from a fixed genesis value. Edit one word of any record's copy above and every digest after it changes. Head of chain: sha3:5bb790e86688. The product does the same thing to your evidence.