NIST 800-171 Gap Assessment
A control-by-control review of all 110 NIST SP 800-171 requirements against your actual environment — with a clear, prioritized roadmap to close the gaps. Led by a Navy and Air Force veteran with 14 years in DoD cybersecurity.
If You Handle CUI, This Applies To You
NIST 800-171 governs how Controlled Unclassified Information (CUI) must be protected — and it's the technical foundation underneath CMMC 2.0 certification.
Direct DoD Contract Holders
Companies with active DoD contracts that include the DFARS 252.204-7012 clause requiring NIST 800-171 compliance.
Subcontractors To Primes
Suppliers to defense primes who are being asked to flow down compliance requirements before the next contract renewal.
Preparing For CMMC 2.0
Businesses getting ready for a formal CMMC Level 2 assessment, where NIST 800-171 control implementation is exactly what gets scored.
Uncertain Where They Stand
Companies that have self-attested compliance in the past but have never had an independent, outside review of their actual posture.
What A Gap Assessment Actually Covers
Not a checklist exercise — a real review of how each control is implemented in your specific environment.
Scoping & CUI Boundary Mapping
Identifying exactly where CUI lives, flows, and is processed across your systems — the boundary that defines what's actually in scope for assessment.
Control-by-Control Review
Walking through all 110 controls across the 14 NIST 800-171 families — access control, incident response, system integrity, and the rest — and documenting what's actually in place versus what's assumed.
Prioritized Remediation Roadmap
A findings report ranked by risk and effort, so you know what to fix first — not just a long list of gaps with no sense of where to start.
SSP & POA&M Documentation
Building the System Security Plan and Plan of Action & Milestones documentation that assessors, primes, and auditors actually expect to see.
NIST 800-171, Answered
What is NIST SP 800-171?
A NIST publication defining 110 security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems. It's required under DFARS 252.204-7012 for most DoD contractors and subcontractors, and it's the technical basis for CMMC 2.0 Level 2.
Is a gap assessment the same as a SPRS score submission?
Related, but not the same. A gap assessment is the independent review that tells you your true posture; your SPRS score is the self-assessment score you submit to the government based on that posture. A gap assessment is what makes sure your SPRS score is accurate rather than optimistic.
How long does a gap assessment take?
Typically 2-4 weeks for a small-to-mid-size business, depending on environment complexity and how quickly documentation and system access can be provided.
What does a NIST 800-171 gap assessment cost?
Pricing depends on company size and environment complexity. Reach out directly for a quote specific to your business.
What happens after the assessment?
You get a findings report and roadmap you can act on with your own team, or continue working with Linne Consulting on remediation, SSP/POA&M documentation, and eventual CMMC assessment preparation.
A self-assessment tells you what you hope is true. A gap assessment tells you what actually is.
Ready To Find Out Where You Stand?
Start with the free self-assessment, or reach out directly to talk through your specific environment and timeline.