CMMC vs NIST 800-171: what's the difference?
These two terms get used as if they are interchangeable. They are not. The short version: NIST 800-171 is the set of security requirements. CMMC is the program that checks whether you actually meet them. One is the rulebook, the other is the referee.
NIST SP 800-171: the requirements
NIST Special Publication 800-171 is a catalog of security requirements for protecting Controlled Unclassified Information (CUI) on non-federal systems. Revision 2, the one CMMC Level 2 uses today (32 CFR 170.14(c)(3)), has 110 security requirements. If your company handles CUI for a DoD contract, you have been contractually obligated to implement these 110 controls for years, under DFARS clause 252.204-7012. NIST 800-171 does not certify anything. It is the standard you are measured against.
CMMC: the verification
The Cybersecurity Maturity Model Certification (CMMC) is the DoD program that verifies a contractor has implemented the required controls. The shift CMMC was built to add is third-party certification on top of self-attestation. For years, contractors scored themselves against NIST 800-171 and posted the number to SPRS on the honor system. Under the CMMC rule, a contract can designate Level 2 (Self), a self-assessment, or Level 2 (C3PAO), an assessment by an authorized C3PAO (32 CFR 170.16 and 170.17). Since July 13, 2026, while Phase 2 is suspended, DoW solicitations may designate only Level 1 (Self) or Level 2 (Self) (DoW CIO memorandum 26-P-1023).
| CMMC Level | Based on | How it's verified |
|---|---|---|
| Level 1 | 15 basic safeguards (FCI) | Annual self-assessment |
| Level 2 | All 110 NIST 800-171 controls (CUI) | Self-assessment or C3PAO certification assessment, as the contract designates (only self-assessment while Phase 2 is suspended) |
| Level 3 | NIST 800-171 plus enhanced NIST 800-172 controls | Government-led assessment |
So CMMC Level 2 is, in substance, the 110 NIST 800-171 controls, the same requirements you already owed, now assessed and affirmed through CMMC, and confirmed by an independent assessor wherever the contract designates Level 2 (C3PAO).
What changes for you
If you have been self-attesting, CMMC assessment tests the gap between what you reported and what is actually configured. That gap is where a surprise at assessment comes from. A control you claimed but cannot evidence is a control an assessor will not accept. The work ahead is making your real posture match the number on file.
- Same controls, higher bar of proof. A Level 2 (C3PAO) assessment asks for the evidence, not just the assertion, and your Affirming Official must affirm continuing compliance after every CMMC assessment and annually after that (32 CFR 170.22).
- SPRS still matters. Your self-assessment score stays on file in SPRS, where contracting officers check it before award, and the distance between it and a measured result becomes the issue.
- Lead time is the advantage. Closing gaps and assembling evidence takes time, so starting early helps.
Find out where your real posture stands
The free gap check gives you a directional read from your answers to 10 questions on high-weight NIST 800-171 controls. The CMMC Level 2 Readiness Snapshot checks your intake, and the read-only configuration of any cloud you connect, against the 110-control baseline; it measures only the controls a connected source can show, and returns a PDF of your top control gaps within minutes of intake, for $999 one time. Your framework target is your choice: NIST SP 800-171 Rev. 2 (110 requirements, 320 assessment objectives; required and scored) by default, or NIST SP 800-171 Rev. 3 (97 requirements, 422 assessment objectives; emerging, no DoD score exists), selected at intake or from your workspace.
Enclave AI™ is AI-native Agent-as-a-Service (AaaS) for CMMC Level 1 and Level 2 readiness and compliance operations. We are not a C3PAO and we will not seek C3PAO authorization, that separation is permanent. The free gap check is a directional self-assessment and is not an official SPRS score. Patent Pending. ElasticD3M, LLC, Texas.