NIST 800-171 Compliance Program (NCP)

• Editable NIST 800-171 & CMMC compliance documentation that is "DIBCAC battle tested".
• Compliance-focused policies, standards, procedures, SSP / POA&M templates and more!
• Affordable solution that is designed to be efficient and scalable. Written to be business friendly.
• Includes one year of product updates to keep you current on evolving compliance requirements.

Don't Write It From Scratch.

If you handle Controlled Unclassified Information (CUI) for a US Government contract, NIST 800-171 and CMMC 2.0 are not optional, and a thin or improvised System Security Plan (SSP) is exactly what gets flagged in an assessment. Could you hand a CMMC Third-Party Assessment Organization (C3PAO) a complete, mapped documentation set today, or would you be scrambling? Building it from a blank page is a slow and risky process when an assessment is on the line. The NIST 800-171 Compliance Program (NCP) gives you a running start: editable, policies, standards, procedures, and SSP / POA&M templates aligned to NIST 800-171 and CMMC 2.0 that have survived actual DIBCAC and C3PAO assessments. The NCP is designed to get you roughly 80 to 90 percent of the way there, where we did the heavy lifting - you just tailor the documentation for your environment with the information that only you know (e.g., resources you have, people to assign procedures to, technologies in place, etc.).

There is a right way and a wrong way to write cybersecurity documentation. While we recognize there are other options on the Internet for "NIST 800-171 & CMMC documentation," we strive to make the highest-quality products on the market. Our obsession with making quality documentation can be demonstrated in the architecture we use to create our documentation. As shown in the swimlane diagram below, the Hierarchical Cybersecurity Governance Framework (HCGF) is the "ComplianceForge Reference Model" that sets the standard for cybersecurity and data privacy documentation structure. ComplianceForge builds its documentation to align with industry-recognized terminology that logically arranges documentation components into their rightful structure. This model creates an approach to architecting documentation that is concise, scalable and comprehensive. When that is all laid out properly, an organization's cybersecurity and data protection documentation should be hierarchical and linked from policies all the way through metrics.

The NCP is "battle tested" - our clients have successfully passed DIBCAC and C3PAO assessments with this documentation. You receive a lifetime license to use the NCP at your company and the purchase price includes one year of updates. After the first year, you can choose to subscribe to updates or not. As NIST 800-171 versions change or DoD/DoW guidance is released, the subscription allows you to keep current on the latest changes.

The NCP is the affordable, editable batletested documentation bundle to address NIST 800-171 Rev 2, NIST 800-171 Rev 3, and CMMC 2.0 Levels 1-2 compliance needs. The NCP is a single purchase that includes the policies, standards, procedures, SSP, POA&M, TPRM, SCRM Plan, and supporting templates that defense industrial base contractors need to demonstrate compliance.

The NCP comes with three versions included with purchase:

• An R2-only version for organizations focused entirely on NIST SP 800-171 R2;
• An R3-only version for organizations focused on NIST SP 800-171 R3; and
• A Combined R2 & R3 version for organizations addressing both revisions during the DoD transition period.

No Software To Install

The NCP is a one-time purchase of editable Microsoft Office-based documentation templates. There is no software to install, no agent to deploy, no account to provision, and no cloud environment to configure. If the organization can open and edit Microsoft Office files, the NCP is ready to use.

This deployment model is intentional. NIST 800-171 compliance documentation benefits from being in the organization's own hands, inside its own document management systems, rather than locked inside a vendor's SaaS tool. Once delivered, the NCP belongs to the buyer.

How Does the NCP Solve These Problems?

The NCP is a bundle of editable documentation templates that is designed to save your organization hundreds of hours in labor. These are the policy sections that address the 14 sections of CUI from NIST 800-171 R2 (as well as Non-Federal Organization (NFO) controls from Appendix E) and the 17 sections of CMMC 2.0 that overlap what is in NIST 800-171 R2. Most people forget or ignore the NFO controls component, which is a basic expectation of being compliant with NIST 800-171 but we include NFO, CUI and CMMC requirements in the NCP

There is no getting around the necessity to read and be familiar with NIST 800-171 and CMMC - that can’t be avoided. One of the best things you can to start off is make yourself a pot of coffee and familiarize yourself with the CMMC Kill Chain since you really need to have a prioritized plan to address NIST 800-171 / CMMC requirements. This is the process we recommend for using the NCP:

Cost Savings Estimate

When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the NCP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:

How Much Customization Remains?

There are no blanks to fill in! Given the difficult nature of writing templated cybersecurity documentation, ComplianceForge aims for approximately an 80% solution because it is impossible to write a 100% cookie-cutter document that can be equally applied across every organization. ComplianceForge did the heavy lifting, and the remaining work is fine-tuning the policies, standards, and procedures with the specific information that only the organization knows.

In practice, customization is filling in the blanks and following the guidance provided to identify the who, what, when, where, why, and how for the specific environment. Typical customization tasks include adding the company name and logo, tailoring parameters such as system inventory references and named owner roles, populating the SSP with the CUI environment specifics, and removing sections that do not apply to the organization.

Backwards Compatible: NIST 800-171 R2 & R3 Coverage

The NCP includes complete coverage for both NIST 800-171 Rev 2 and NIST 800-171 Rev 3 in a single purchase. NIST 800-171 R3 was released on 14 May 2024 with significant changes from R2, and OMB requires organizations to adopt the most current version of NIST one year after its release. The NCP saves organizations from rewriting documentation during the transition by providing the controls for both revisions side-by-side.

Organizations can ensure coverage for both R3 and R2 by implementing what is in the NCP, focus only on R2 and CMMC 2.0 by deleting R3-specific controls, or focus only on R3 by deleting R2-specific controls. The NCP also provides coverage for the DoD-provided Organization-Defined Parameters (ODP) criteria that apply to NIST 800-171 R3. The latest version of the NCP also addresses changes associated with 32 CFR Part 170 and updated CMMC 2.0 L2 scoping guidance.

CMMC 2.0 Level 2 (Advanced) Alignment

The NCP was specifically written to address all NFO and CUI controls in NIST 800-171 R2, as well as CMMC 2.0 Level 2 (Advanced) controls. The NCP is ComplianceForge's targeted solution for organizations preparing for CMMC 2.0 L2 assessments under the new 32 CFR Part 170 final rule.

The NCP contains editable policies, standards, procedures, SSP, and POA&M templates plus the supporting documentation needed for a CMMC C3PAO assessment. Coverage also extends to related compliance requirements in DFARS 252.204-7008/7012/7019/7020/7021, FAR 52.204-21/27 and Section 889, and ITAR, so a single documentation investment satisfies the most common defense industrial base flow-down clauses.

ComplianceForge took existing documentation and pared it down for smaller organizations that do not need or want the complexity of NIST 800-53 when complying with NIST 800-171.

The official overview of CMMC 2.0 can be read at https://dodcio.defense.gov/CMMC/. As you can see from the infographic show below, CMMC evolved from 5 levels to 3 levels. If you store, transmit or process Controlled Unclassified Information (CUI) then you are CMMC v2.0 Level 2 (Advanced). ComplianceForge's NIST 800-171 Compliance Program (NCP) is specifically designed as the "easy button" for CMMC v2.0 Level 2 (Advanced). CMMC v2.0 Level 2 (Advanced) removes the CMMC v1.02 practices and processes. The focus is on NIST 800-171 R2 CUI and NFO controls.

What Are Some Of Our Testimonials?