Government Contractor IT Setup Guide: CMMC and NIST 800-171

Who this is for and how to read it

This white paper is for owners, facility security officers and IT leads at federal contractors and subcontractors with roughly 5 to 100 people, especially Department of Defense suppliers. Every recommendation is labeled:

• Required A regulation or contract clause requires it today.
• Recommended Official guidance recommends it.
• Proposed It is in a proposed rule and is not yet required.

Your obligations come from the clauses in your contracts. This is general guidance, not legal advice; confirm specifics with your contracting officer and counsel.

The rules that apply today

Federal Contract Information: FAR 52.204-21

Required Contractors whose systems hold Federal Contract Information (FCI), information provided by or generated for the government under a contract that is not intended for public release, must meet the 15 basic safeguarding requirements in FAR 52.204-21. Under CMMC these are Level 1, with an annual self-assessment and affirmation. Plans of action (POA&Ms) are not allowed at Level 1.

Controlled Unclassified Information: DFARS 252.204-7012

Required DoD contractors that handle Controlled Unclassified Information (CUI) must comply with DFARS 252.204-7012, which requires:

• Implementing NIST SP 800-171 on systems that handle CUI.
• Reporting cyber incidents to DoD within 72 hours through the DIBNet portal, which requires a DoD-approved medium assurance certificate. Get the certificate before you need it.
• Preserving images of affected systems for 90 days.
• Using cloud services that meet security requirements equivalent to the FedRAMP Moderate baseline when they store or process CUI.
• Flowing the clause down to subcontractors that handle CUI.

The CMMC program

Required The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and the DFARS rule that puts CMMC into contracts took effect November 10, 2025, which started Phase 1. Level 2 covers the 110 requirements of NIST SP 800-171 Revision 2, with a minimum score of 88 of 110 to use a plan of action, and open items closed within 180 days. Level 3 adds 24 requirements from NIST SP 800-172. At every level, a senior "Affirming Official" affirms compliance in the Supplier Performance Risk System (SPRS).

Why this does not mean "relax": the Department of Justice continues to settle False Claims Act cases over NIST 800-171 gaps. In 2026, Honeywell Aerospace agreed to pay $2,042,518 (September) and LOGZONE agreed to pay $507,144 (June). Prime contractors also keep their own supplier security requirements.

Proposed, not yet required

• Proposed NIST published Revision 3 of SP 800-171 in May 2024 and withdrew Revision 2, but DoD has kept Revision 2 as its requirement for now. A pending DoD rule would move CMMC to Revision 3; until it is final, build to Revision 2.
• Proposed A civilian-agency FAR CUI rule was re-proposed on June 23, 2026, with Revision 3, 72-hour incident reporting and FedRAMP Moderate-equivalent cloud requirements. It is not final.

Our advice: build to Revision 2 today, and keep a simple map of how your controls line up with Revision 3 so a future change is a paperwork exercise, not a rebuild.

Step 1: Find your CUI and draw the boundary

Required CMMC Level 2 applies to the systems that process, store or transmit CUI, plus the security tools that protect them. So the first job is knowing where CUI actually lives: which contracts carry it, which people touch it, and which email, file shares, laptops and cloud services hold it.

• Recommended Consider an enclave. If only a few people work with CUI, keeping it in a separate, locked-down environment for those users can shrink what must meet all 110 requirements, while the rest of the company runs on a simpler setup.
• Required Write it down. NIST SP 800-171 requires a System Security Plan describing the boundary and how each requirement is met.
• Required Cloud services that hold CUI must meet FedRAMP Moderate or DoD's equivalency requirements (DoD CIO memo, December 21, 2023). Cloud productivity suites offer different tiers: commercial tiers are generally suited to FCI only, government community tiers to some CUI, and high-assurance government tiers to export-controlled data. Confirm with your provider and contracting officer which tier fits your contracts.

Step 2: Accounts, passwords and multi-factor sign-in

• Recommended Multi-factor sign-in (MFA) on email, remote access, cloud apps and every admin account. CISA's ransomware guide asks for phishing-resistant MFA on all services, starting with email and remote access. Prefer an authenticator app, passkey or security key over text messages.
• Recommended Long passphrases and a password manager. Current NIST guidance (SP 800-63B, Revision 4) says passwords used alone should be at least 15 characters, should be checked against lists of leaked passwords, and should not be forced to change on a schedule unless there is a sign they were stolen.
• Recommended One login per person and separate admin accounts. Day-to-day work happens on standard accounts. Only a few people hold administrator rights, on separate logins.
• Recommended Access ends on the last day. When someone leaves, turn off email, remote access, shared passwords and building access the same day.

Required NIST SP 800-171 requires MFA for privileged accounts and for network access to non-privileged accounts in the CUI environment, plus limits on unsuccessful logins and session locks.

Step 3: Computers, phones and updates

• Recommended Encrypt every laptop and phone that holds work data, so a lost device is a hardware problem, not a data breach. NIST's small-business guide calls for full-disk encryption on laptops and tablets.
• Recommended Turn on automatic updates, and patch internet-facing systems and anything on CISA's Known Exploited Vulnerabilities list first.
• Recommended Replace unsupported systems. Windows 10 support ended October 14, 2025. Machines that cannot upgrade yet need Microsoft's paid Extended Security Updates, which are only available for a limited time, and should be replaced.
• Recommended Endpoint protection that someone actually watches, on every computer. Alerts that nobody reviews do not stop an attack.

Required In the CUI environment, NIST SP 800-171 requires protecting CUI on portable devices with encryption, controlling removable media, and fixing flaws in a timely way.

Step 4: Network, Wi-Fi and remote access

• Recommended Separate networks for staff computers, guest Wi-Fi, and printers, cameras and other smart devices. CISA calls for network segmentation and a current diagram of how data moves.
• Recommended WPA3 Wi-Fi where your equipment supports it, with a long passphrase that changes when staff leave. Guests get internet access only.
• Recommended No remote desktop open to the internet. CISA says remote desktop should never be exposed directly. Use a VPN or secure remote-access service with MFA.
• Recommended A supported business firewall, kept updated and replaced when the manufacturer stops supporting it.

Required NIST SP 800-171 also requires monitoring and controlling communications at the boundary of the CUI environment, protecting wireless access, and controlling remote access sessions.

Step 5: Logging, backups and your IT provider

• Required Audit logs in the CUI environment that let you trace actions to individual users, reviewed regularly. CISA recommends keeping critical system logs for at least a year.
• Recommended Offline, encrypted, tested backups, following CISA's ransomware guidance. DFARS 7012's 90-day image preservation rule makes good backups and logs doubly important.
• Required Your IT provider is in scope. Under the CMMC rule, a provider that manages your security tools is assessed as part of your environment even if it never touches CUI. Ask for its practices in writing.

Recommended In 2022, CISA, the NSA, the FBI and allied agencies published joint guidance for organizations that use a managed service provider (MSP). It says your contract should require MFA on every account the provider uses, least-privilege access, defined incident reporting, backup and incident-response duties, and prompt removal of the provider's access when the contract ends. Ask any IT provider, including us, to show you those terms in writing.

Step 6: Incidents and the 72-hour clock

• Required Report to DoD within 72 hours of discovering a cyber incident affecting covered defense information, through DIBNet. Have the required medium assurance certificate in hand before an incident.
• Required Preserve images of affected systems for 90 days.
• Required Have an incident response capability with preparation, detection, containment, recovery and testing, as NIST SP 800-171 requires. NIST SP 800-61, Revision 3 (April 2025) is the current federal reference.
• Required If personal information of Virginia residents is exposed, Virginia's breach law (Va. Code 18.2-186.6) may also require notice.

Step 7: Score honestly and affirm carefully

• Required Post an accurate SPRS score for each NIST 800-171 assessment, and keep it current.
• Required Affirm only what is true. The annual affirmation is signed by a senior official. Inaccurate affirmations are what False Claims Act cases are built on.
• Recommended Track open items in a plan of action with owners and dates, and close them.

One-page setup checklist

How JPert can help

JPert is a managed IT and cybersecurity company in Vienna, Virginia, near Tysons. We help small contractors scope CUI, build enclaves, and keep the evidence that backs an SPRS score, and we document our own practices because a managed provider is part of your assessment. Read about IT for government contractors, or book a free IT assessment.

Related reading from our Chronicles: CMMC compliance checklist.

Sources

Every recommendation above comes from these official sources, checked on November 1, 2026:

• FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems
• DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
• CMMC Program rule, 32 CFR Part 170 (Federal Register, October 15, 2024)
• DFARS CMMC acquisition rule (Federal Register, September 10, 2025)
• DoD CIO: Implementing the suspension of CMMC Phase II (July 2026)
• Cyber AB: Statement on the suspension of CMMC Phase II requirements
• NIST SP 800-171 Rev. 2: Protecting CUI in Nonfederal Systems (still required by DoD)
• DoD CIO: FedRAMP Moderate Equivalency memo (December 21, 2023)
• Federal Register: Re-proposed FAR CUI rule (June 23, 2026)
• DOJ: Honeywell Aerospace False Claims Act settlement (September 2026)
• DOJ: LOGZONE False Claims Act settlement (June 2026)
• CISA: #StopRansomware Guide
• CISA, NSA, FBI and allied agencies: Protecting against cyber threats to MSPs and their customers (AA22-131A)
• NIST SP 800-61 Rev. 3: Incident response recommendations (April 2025)
• NIST SP 800-63B Rev. 4: Authentication and passwords
• Va. Code 18.2-186.6 (breach of personal information notification)

This white paper is general information about IT and security practices, not legal advice. CMMC policy is changing; we review this paper when DoD announces changes. See our editorial policy.