5 NIST 800-171 requirements to check before you trust a self-reported SPRS score.

Multifactor Authentication on Privileged Accounts

The self-reported answer to test

"MFA enforced on all administrators."

Where that answer can fall short

• Microsoft 365 admin accounts: MFA enabled (good)
• On-prem Windows domain admin accounts: MFA not enforced
• Linux jump-server root accounts: MFA not enforced
• Network equipment privileged credentials (Cisco, Fortinet, Palo Alto): TACACS+/RADIUS without MFA
• Service accounts that someone occasionally uses interactively: MFA bypassed

NIST SP 800-171 Rev. 2 requirement 3.5.3 covers local and network access to privileged accounts, so every privileged account counts, not only the cloud ones.

Evidence to have ready

• Authoritative inventory of all privileged accounts (with role and last-used date)
• MFA policy configuration screenshots
• MFA enrollment logs for the past 90 days for each privileged account
• Documented procedure for adding/removing privileged accounts (and the MFA enforcement step)

The cleanest fix

Roll Duo, Microsoft Authenticator, or YubiKeys to every privileged account. Use a single MFA platform across cloud + on-prem + network equipment so there's one inventory to maintain. Document it in SSP Section 3.5.

Correlate Audit Review, Analysis and Reporting

The self-reported answer to test

"Logs are reviewed weekly by our IT lead."

Where that answer can fall short

• Logs are being collected, true. Microsoft 365, on-prem firewall, sometimes endpoint EDR.
• There's a phrase in the IT policy that says "reviewed weekly", true.
• No documented review cadence with sign-off
• No record of past reviews (no signed checklist, no Jira/ticket trail)
• No evidence of action taken on log findings, nothing showing the IT lead investigated an anomaly, escalated, and resolved

A policy that says "reviewed weekly" with no record behind it does not show the review, analysis and reporting processes working together, which is what 3.3.5 asks for.

Evidence to have ready

• Log review SOP (named procedure, named role, defined cadence)
• Signed weekly log review records for the past 90 days
• At least one log-driven action artifact (an investigation ticket, a Slack thread, an after-action note)
• The list of log sources covered by the review (and acknowledged gaps)

The cleanest fix

SIEM or log-aggregation tool (Wazuh, Microsoft Sentinel, Datadog, or Sumo Logic) with a documented weekly review cadence. Build a one-page review template with sign-off, and keep every completed review.

Monitor and Control Remote Access

The self-reported answer to test

"VPN required for all remote work."

Where that answer can fall short

• VPN is deployed and required, true
• No logging of remote sessions (or logs are being collected but not retained beyond 30 days)
• No session-timeout enforcement, workers can leave a VPN session open overnight
• No MFA on the VPN itself, username/password gets you in
• Remote sessions are not reviewed for anomalies (geo-impossible logins, off-hours access)

Evidence to have ready

• Remote-access policy
• VPN session logs for the past 90 days
• MFA enforcement evidence on VPN (configuration + enrollment)
• Session-termination configuration (idle timeout, max session length)
• Documented remote-access review cadence (folds into Killer #2's SIEM)

The cleanest fix

Enable VPN session logging. Add MFA to the VPN with the same provider used for Killer #1. Configure 30-minute idle timeout, 12-hour absolute max session. Review cadence folds into the SIEM weekly review from Killer #2.

Enforce Security Configuration Settings

The self-reported answer to test

"Standard build images deployed; group policy enforces baseline."

Where that answer can fall short

• Active Directory group policy is in place, true
• Windows endpoints are running multiple OS builds, for example legacy CAD workstations and machine controllers that cannot take the current baseline
• CIS benchmarks are not applied to endpoints
• Linux servers have no equivalent baseline (no CIS, no STIG)
• Deviation from policy is not detected or alerted, drift accumulates silently

Evidence to have ready

• Baseline configuration documentation (which CIS benchmark version, scope of systems covered)
• Evidence of regular configuration scanning (CIS-CAT, Nessus, Defender for Endpoint, Tenable)
• Deviation reports for the past 90 days
• Remediation evidence on flagged deviations

The cleanest fix

Adopt CIS Level 1 benchmarks for Windows + Linux. Deploy Microsoft Defender for Endpoint configuration drift detection (or Tenable, or Rapid7, your choice). Document baseline and scan cadence in SSP Section 3.4.

FIPS-Validated Cryptography

The self-reported answer to test

"AES-256 encryption used throughout."

Where that answer can fall short

• AES-256 is in use, true
• The cryptographic modules implementing AES-256 are not FIPS 140-2 (or 140-3) validated for the on-prem file shares, the OpenVPN deployment, or the database encryption
• Windows endpoints have FIPS mode disabled
• The product documentation says "AES-256" but the module's CMVP certificate number is missing or expired

NIST SP 800-171 Rev. 2 requirement 3.13.11 calls for FIPS-validated cryptography when it protects the confidentiality of CUI, not merely a strong algorithm.

Evidence to have ready

• Documented inventory of cryptographic modules in your environment
• Each module's FIPS validation certificate number from the NIST Cryptographic Module Validation Program (CMVP)
• Configuration evidence showing FIPS mode enabled where applicable (Windows group policy, OpenSSL provider settings, database FIPS mode)

The cleanest fix

Inventory cryptographic modules. Enable FIPS mode on Windows endpoints (group policy: "System cryptography: Use FIPS compliant algorithms..."). Check the VPN's cryptographic module against the CMVP list and confirm its certificate number; if it has no current certificate, change the module or the product. Switch file-share encryption to a FIPS-validated implementation. Replacing a module can take longer than a configuration change, so start the inventory early.