NIST 800-171 Self-Assessment: How to Score Yourself Honest

A NIST 800-171 self-assessment is the Basic Assessment that defense contractors run on their own systems, score against the DoD methodology, and post to the Supplier Performance Risk System (SPRS). You review your system security plan (SSP), check each requirement, subtract points for what is not met, and submit the result. The work is simple to describe and easy to get wrong, because the score is only as good as the evidence behind it.

This guide walks through the process the way we run it with Wisconsin manufacturers and other small contractors: scope first, then documents, then scoring, then submission. It also covers what to do if you are preparing for CMMC at the same time.

TL;DR

A Basic Assessment is a contractor-led self-assessment under the DoD methodology. It produces a score from -205 to 110 and a "Low" confidence level, and you post it in SPRS.
DFARS 252.204-7020 requires at least a Basic Assessment before award of a contract that calls for NIST SP 800-171, and the score must be no more than 3 years old.
Shrink your scope first. Isolating CUI to fewer systems cuts both the assessment effort and the cost of fixes.
The score is the visible part. Your SSP, your Plan of Action and Milestones (POA&M) and your evidence are what hold up under review.
Do not post a number you cannot prove. Self-attestation carries real legal risk.

What the self-assessment actually is
Who has to do one
Step 1: Scope your CUI environment before you score anything
Step 2: Build or update your System Security Plan
Step 3: Assess each requirement with Examine, Interview, Test
Step 4: Calculate your score
Step 5: Write the POA&M you will be held to
Step 6: Submit the score in SPRS
Preparing for CMMC while you self-assess
Our perspective: the score is the smallest part
When to get outside help
Mistakes that sink small-contractor assessments
FAQ
Sources

What the self-assessment actually is

The DoD calls it a Basic Assessment: a contractor's own review of how it implements NIST SP 800-171, based on its system security plan and conducted under the DoD methodology. Because you generate the score yourself, it carries the lowest confidence level in the DoD Assessment Methodology. Medium and High assessments are performed by the government and look much harder at your evidence.

Three facts shape everything else:

The score range is -205 to 110. 110 means every requirement is implemented. Each unmet requirement subtracts points according to the methodology's weighting.
It expires. Assessments must be updated at least every 3 years.
It is the only self-service level. In SPRS, the Basic level is the only confidence level that is a self-assessment, according to the SPRS entry tutorial.

Who has to do one

If your contract includes DFARS 252.204-7020 and your systems process, store or transmit Controlled Unclassified Information (CUI), you do. The clause says you must have at least a Basic Assessment on file before award. Under DFARS 204.7303, the contracting officer checks that a current score is posted in SPRS before awarding a contract or exercising an option.

That reaches past prime contractors. Many Wisconsin machine shops, fabricators and component suppliers touch CUI only because a prime sent them drawings or specs. If that is you, expect the requirement to arrive through a flowdown clause. Read your contract language rather than assuming.

Step 1: Scope your CUI environment before you score anything

The biggest money-saver in this process happens before you open a checklist. NIST's small business primer for SP 800-171A Rev. 3 warns that many small firms over-invest in tools before scoping their CUI environment. Logically or physically isolating CUI onto a smaller set of systems shrinks both the assessment and the implementation bill.

Start with three questions:

Where does CUI enter? Email attachments, a customer portal, a file share, a engineering workstation.
Where does it live and move? Servers, laptops, USB drives, cloud storage, backups.
Who touches it? Name the people and the accounts. Everyone else stays outside the boundary.

If CUI sits on one file server and four workstations, your assessment covers those systems and the services that protect them, not the whole company network. For a plant with shop-floor equipment, that distinction can decide whether the project takes weeks or most of a year. Where it is practical, build a separate enclave for CUI work.

Our post on cutting NIST 800-171 work by scoping the 110 controls goes deeper on this step.

Step 2: Build or update your System Security Plan

Your SSP describes how each requirement is met in your environment. It is the document the Basic Assessment is based on, so a thin or generic SSP undermines the whole score.

The common failure is a plan that drifts from reality. If the SSP says multifactor authentication is enforced and an admin turned it off six months ago, your paperwork says one thing and your systems say another. Treat the SSP as a living document and review it whenever you change firewalls, identity settings, or the way remote staff connect.

For each requirement, the SSP should state:

What control is in place and how it works.
Which systems, people and locations it covers.
Who owns it.
Where the proof lives.

Step 3: Assess each requirement with Examine, Interview, Test

NIST SP 800-171A Rev. 3 defines the assessment procedures. The small business primer summarizes three methods:

Method	What you do	Example
Examine	Inspect documents and artifacts	Read the access control policy, review firewall rule exports, check training records
Interview	Talk to the people who run or use the control	Ask the office manager how new accounts are approved
Test	Check the control while it operates	Try to sign in without MFA, confirm a disabled account cannot log in

For each objective, the finding is either Satisfied or Other than satisfied. There is no partial credit in your head. If you can show it by examining, interviewing and testing, mark it satisfied. If you can show it only on paper, it is not satisfied yet.

The publication itself is available from NIST's CSRC. Check which revision your contract and the DoD methodology reference before you pick your objective list, since the DoD scoring is tied to its own methodology document.

What good evidence looks like

Auditors want artifacts, not assurances. Collect them as you go:

Audit log samples and the retention settings behind them.
Configuration baselines and screenshots with dates.
Employee security training rosters.
Account lists showing who has privileged access.
Incident response plan and the last time you tested it.
Backup and patch reports.

The NIST primer points out that a perfect-looking number with no artifacts behind it can turn into a serious compliance problem if a Medium or High assessment asks you to produce proof.

Step 4: Calculate your score

Start at 110. For every requirement not fully implemented, subtract the value the DoD methodology assigns to it. Some are worth 1 point, some 3, and some 5. The weights reflect risk, so a missing MFA control costs far more than a missing policy line. Use the weights in the DoD Assessment Methodology itself, not a third-party spreadsheet that may be out of date.

Two scoring habits keep you out of trouble:

Partial is not implemented. If MFA covers remote access but not administrators, the requirement is not met.
Be conservative. The reviewers who validate your work later will not give you the benefit of the doubt you gave yourself.

Step 5: Write the POA&M you will be held to

A score below 110 is not disqualifying by itself. It does mean your POA&M matters. For every gap, record the weakness, the fix, the owner, the resources, and a completion date. The methodology expects you to state when you will reach full implementation, and the government can hold you to those dates.

Realistic dates beat optimistic ones. A POA&M promising everything in 30 days on a shop with one part-time IT person will read as unserious. Prioritize the gaps that cost the most points and that reduce real risk: MFA, patching, logging, endpoint protection, encryption, and backups.

Step 6: Submit the score in SPRS

The mechanics catch plenty of firms off guard.

Get a PIEE account with the right role. To enter or edit Basic Assessment data, you need the SPRS Cyber Vendor User role. Being a registered contractor is not enough, per the SPRS tutorial.
Check your CAGE hierarchy in SAM. Misaligned CAGE codes in the System for Award Management can block you from posting a score. Fix them well before a proposal deadline.
Enter the summary data. That covers the system security plan name and version, the date, the score, and the date you expect to reach 110.
Calendar the renewal. Put the three-year expiry on a shared calendar, and review sooner whenever your environment changes materially.

Budget a few weeks for account approvals. Waiting until a contracting officer asks for your score is how small firms lose time on an award.

Preparing for CMMC while you self-assess

The self-assessment and CMMC readiness overlap heavily, because Level 2 is built on the same 110 requirements. If you do the work above carefully, you already have most of what a gap assessment looks for: a defined scope, an SSP, evidence, and a POA&M.

The timing of formal certification requirements has been moving. One law-firm analysis reports that DoD suspended CMMC Phase 2 in July 2026, which had been scheduled for November 10, 2026. The same analysis notes that existing DFARS cybersecurity requirements and prime contractor flowdowns stay enforceable, and that annual SPRS affirmations are still required. Read that as a reason to keep going, not to pause. Confirm what your prime expects in writing, since flowdown terms can be stricter than DoD's own posture.

For a practical starting list, see our CMMC compliance easy wins and our security assessment checklist.

A short readiness checklist

CUI data flows mapped and the boundary documented.
SSP matches how systems are actually configured.
MFA enforced for all users who touch CUI, including admins and remote access.
Logging turned on and retained, with someone reviewing it.
Patching on a schedule with reports. Our guide to NIST and CISA aligned patch management shows what that looks like.
Security awareness training recorded for every user in scope.
Backups tested, not just running.
Incident response plan written and exercised.
POA&M with owners and dates for every open item.
PIEE role and SAM CAGE data confirmed.

Our perspective: the score is the smallest part

We work with manufacturers, financial firms, and other small and mid-sized organizations in Southeastern Wisconsin, and the pattern is consistent. Owners ask for a number. What protects them is the discipline behind it.

Three things we tell every contractor:

Scope is a business decision, not an IT afterthought. The cheapest control is the one you never need to implement because CUI never touched that system. Decide where CUI lives before buying any tools.

Documentation has to describe what is true on the day you sign. A clean SSP on top of an environment nobody monitors is a liability. This is why we run IT as continuous ownership of the infrastructure, with 24/7 monitoring and documented configurations, rather than an annual scramble before a deadline.

Predictable cost beats surprise remediation. Compliance work lands hardest on firms that treat IT as an expense to minimize. When security, monitoring, backup, and audit readiness are part of one fixed per-user arrangement, you are not negotiating each fix as an upsell.

If your SPRS score exists only because someone filled in a spreadsheet once, plan to revisit it with fresh eyes.

, Dustin Collett

When to get outside help

Self-assessment does not mean unassisted. Reasons to bring in a partner:

You cannot tell whether a requirement is met or only described.
Nobody on staff can test controls objectively, including the person who built them.
Your gaps are technical: network segmentation, logging, endpoint management, encryption.
A prime has asked for evidence, not just a score.

Our IT & Security Assessment is a paid, upfront engagement that scores your environment, prioritizes what to fix, and gives you a documented starting point for your SSP and POA&M. If you want a quick read first, the free IT risk score takes about 60 seconds. For contractors on the shop floor, see how we approach managed IT for manufacturers, and if you already have an internal IT person, co-managed IT can fill the security and documentation gaps without replacing them.

Book the IT & Security Assessment and walk away with a prioritized list instead of a guess.

Mistakes that sink small-contractor assessments

Scoring 110 without proof. If you cannot produce the artifacts, the number is a risk. The DOJ's Civil Cyber-Fraud Initiative continues to target false cybersecurity certifications, according to that same analysis.
Scoping the whole company. Every extra system in scope is another system to defend and document.
Treating it as annual paperwork. Environments change monthly. Reassess when they do.
Ignoring the account setup. No Cyber Vendor User role, no submission.
A POA&M nobody owns. Dates without owners do not get met.

FAQ

Is a NIST 800-171 self-assessment the same as CMMC?

No. The self-assessment is the Basic Assessment under DFARS 252.204-7020, scored and posted in SPRS. CMMC is a separate program with its own levels and assessment rules. The overlap is the 110 requirements, so good self-assessment work carries over.

How often do I need to redo it?

Assessments must be updated at least every 3 years, and a contracting officer checks for a current score before award. Treat that as the ceiling. If your environment changes or you close POA&M items, update the score sooner.

Can I submit a score below 110?

Yes, as long as your SSP and POA&M document the gaps and when you expect to close them. The government can hold you to those dates, so set ones you can meet.

What do I need before I can enter my score?

A PIEE account with the SPRS Cyber Vendor User role, plus accurate CAGE codes in SAM. Request both early, because approvals can delay a contract award if you wait.

NIST 800-171 Self-Assessment: How to Score Yourself Honestly