Three Frameworks, One Goal: Protecting Federal Data
Federal contractors face three overlapping cybersecurity frameworks: NIST SP 800-171, CMMC (Cybersecurity Maturity Model Certification), and DFARS (Defense Federal Acquisition Regulation Supplement). Each serves a different purpose, but they work together as a unified compliance system.
The simplest way to understand them:
- DFARS is the contract clause that requires compliance
- NIST 800-171 defines the security controls you must implement
- CMMC certifies or validates that you actually implemented them
This guide breaks down exactly what each framework requires, how they connect, what they cost, and what the government considers compliant. For deep dives on individual frameworks, see our NIST 800-171 Guide and DFARS 7012 Guide.
Framework Comparison Table
This table provides a high-level comparison of all four compliance levels federal contractors encounter:
| Framework | Purpose | Controls | Assessment Type | Data Type | Cost Estimate |
|---|---|---|---|---|---|
| NIST 800-171 | Define security controls | 110 | Self-assessment + SPRS | CUI | $15K-$60K+ |
| CMMC Level 1 | Basic cyber hygiene | 17 | Annual self-assessment | FCI only | $5K-$15K |
| CMMC Level 2 | Advanced security | 110 | C3PAO or self-assessment | CUI | $30K-$120K+ |
| DFARS 7012 | Contract enforcement | N/A (references NIST) | Contractual obligation | CDI/CUI | Included in above |
How the Frameworks Connect
These frameworks are not independent choices — they form a chain of requirements:
The Compliance Chain:
1. Your DoD contract includes DFARS 252.204-7012 (the legal requirement)
2. DFARS 7012 requires you to implement NIST 800-171 (the security controls)
3. DFARS 7021 requires you to achieve a CMMC level (the certification)
4. CMMC Level 2 maps directly to NIST 800-171 (same 110 controls, validated by a third party)
The key distinction between CMMC Level 1 and Level 2 depends on the type of data you handle:
| Data Type | Definition | Required Level |
|---|---|---|
| FCI (Federal Contract Information) | Information provided by or generated for the government under contract, not intended for public release | CMMC Level 1 |
| CUI (Controlled Unclassified Information) | Information that requires safeguarding per law, regulation, or government policy | CMMC Level 2 + NIST 800-171 |
What Contract Language Actually Means
When you read a solicitation or contract, the compliance requirements are specified through DFARS clause numbers. Here is what each one means for your business:
| Contract Language | What You Must Do |
|---|---|
| "DFARS 252.204-7012 applies" | Implement all 110 NIST 800-171 controls, report incidents within 72 hours, flow down to subs |
| "CMMC Level 1 required" | Implement 17 basic cybersecurity practices and complete an annual self-assessment |
| "CMMC Level 2 required" | Implement all 110 NIST 800-171 controls and either self-assess or undergo a C3PAO audit |
| "CMMC Level 2 with C3PAO" | All of the above plus a mandatory third-party assessment by a certified C3PAO |
| "NIST 800-171 compliance required" | Implement all 110 controls, maintain SSP/POA&M, submit SPRS score |
| "DFARS 7019/7020 applies" | Submit SPRS score and be prepared for a DIBCAC (DoD) assessment of your systems |
What the Government Considers "Compliant"
Compliance is not a binary state — the government evaluates it through multiple indicators:
For NIST 800-171 / DFARS
- A current SPRS score has been submitted to the SPRS portal (required by DFARS 7019)
- A System Security Plan (SSP) exists and accurately describes your environment
- A Plan of Action and Milestones (POA&M) documents any gaps with remediation timelines
- The contractor can demonstrate progress on POA&M items
- Incident response capability exists with 72-hour reporting readiness
For CMMC
- Level 1: Annual self-assessment completed and affirmation submitted to SPRS
- Level 2 (self): Triennial self-assessment completed by internal or contracted assessors
- Level 2 (C3PAO): Third-party assessment by a CMMC Accreditation Body-authorized C3PAO, certification valid for 3 years
Important: POA&Ms Are Allowed (With Limits)
Having open POA&M items does not automatically disqualify you. However, certain controls are considered critical and cannot have open POA&Ms during a CMMC assessment. The DoD has published a list of these "non-POA&M-able" controls. Your SSP must clearly identify which controls are fully implemented vs. planned.
Cost Comparison
Costs vary significantly based on your organization's size, current security maturity, and the complexity of your CUI environment:
| Cost Category | CMMC Level 1 | NIST 800-171 / CMMC Level 2 |
|---|---|---|
| Gap Assessment | $3K-$8K | $8K-$25K |
| Remediation | $2K-$10K | $15K-$60K+ |
| Documentation (SSP/POA&M) | Included above | $5K-$15K |
| C3PAO Assessment | N/A (self-assessment) | $20K-$50K |
| Ongoing Monitoring | $1K-$3K/yr | $5K-$20K/yr |
| Total Estimated Range | $5K-$15K | $30K-$120K+ |
Timeline to Compliance
| Phase | CMMC Level 1 | NIST 800-171 / CMMC Level 2 |
|---|---|---|
| Gap Assessment | 1-2 weeks | 2-4 weeks |
| Remediation | 2-4 weeks | 1-6 months |
| Documentation | 1 week | 2-6 weeks |
| Assessment/Certification | Self (1 day) | C3PAO: 1-3 months to schedule |
| Total | 4-8 weeks | 3-10 months |
Why Businesses Fail Compliance
The most common reasons contractors lose contract eligibility or fail assessments:
- No System Security Plan — the single most common deficiency
- No SPRS score submitted — contracting officers check before award
- Misunderstanding which framework applies to their contract
- Assuming CMMC Level 1 is sufficient when the contract requires Level 2
- Not flowing down requirements to subcontractors
- Treating compliance as a one-time project instead of a continuous program
Get Contract-Ready with Hatty AI
Hatty AI delivers turnkey compliance systems that get defense contractors contract-ready fast. Whether you need CMMC Level 1 basics or full NIST 800-171 implementation with C3PAO readiness, we handle the entire process — gap assessment, remediation, documentation, and SPRS submission.
Which Compliance Level Do You Need?
We will assess your contracts, identify your requirements, and build a compliance plan that gets you awarded. Financing available for all compliance programs.
Get a Free Compliance Assessment(210) 227-3444 — Talk to a compliance specialist today
Related: NIST 800-171 Guide · DFARS 7012 Guide · CMMC Services · CMMC vs NIST 800-171 · Win Federal Contracts Fast