What the assessment is
NIST SP 800-171 sets the security requirements for protecting controlled unclassified information in systems that a contractor or other nonfederal organization operates. We assess whether each requirement is met in the systems that store, process, or transmit that information, using the assessment procedures in NIST SP 800-171A.
Each requirement is assessed with the methods the procedure calls for: examining your system security plan, policies, records, and configurations; interviewing the people responsible; and testing the mechanisms themselves.
How an assessment runs
- Assessment plan. We agree which systems and locations are in scope, which revision applies, any requirements met by an external service provider, and the schedule.
- Fieldwork. We examine, interview, and test, remotely or on site. Evidence requests are batched so your team can plan around them.
- Findings. Each requirement is recorded as met or not met, with the evidence behind the result, and discussed with you as fieldwork progresses.
- Report. A draft goes to you for a factual accuracy review, then the final report is issued. How and when to close the gaps is your decision, recorded in your plan of action.
What we need from you
- The system security plan, with the boundary of the systems that handle controlled unclassified information
- Policies, procedures, and the evidence that the requirements are met
- Details of any cloud or managed service providers that meet requirements on your behalf
- Access to the people who run the systems and, for testing, to the systems themselves
- Your current plan of action, if you have one
Who assesses
Nobody who designed, implemented, or documented the controls takes part in assessing them.