NIST 800-171 & CMMC Editable & Affordable Cybersecurity Documentation

This short product walkthrough video is designed to give a brief overview about what the NCP is to help answer common questions we receive.

Includes NIST 800-171 Rev 3 Changes (In Addition To NIST 800-171 R2 & CMMC 2.0)

NIST 800 171 Rev 3 was released on 14 May 2024 and it contains significant changes from the NIST 800-171 Rev 2. As stated by Ron Ross from NIST, the official government requirements from the Office of Management and Budget (OMB) requires organizations to adopt the most current version of NIST one year after its release. From a NIST 800-171 perspective, this means NIST 800-171 Rev3 will be expected to be used for contracts going forward and at that time NIST 800-171 Rev 2 will be deprecated (outdated). Therefore, it is essential for businesses to start now to implement required controls to comply with NIST 800-171 Rev 3. 

Seeing is believing when you look at the differences between NIST 800-171 R2 and R3. The new content in R3 is expected to be a heavy lift by many in the Defense Industrial Base (DIB), but ComplianceForge's NIST 800-171 Compliance Program (NCP) is an affordable and editable collection documentation templates that can help ease the transition to R3.

The latest version of the NCP has "backwards compatibility” for NIST 800-171 R2 & CMMC 2.0. The current version of the NCP covers both NIST 800-171 R3 and NIST 800-171 R2 (including CMMC 2.0) and this means you have the ability to:

• Ensure coverage for both NIST 800-171 R3 and NIST 800-171 R2 by implementing what is in the NCP; or
• Focus only on NIST 800-171 R2 & CMMC 2.0 requirements by deleting NIST 800-171 R3 specific controls from the NCP; or
• Focus only on NIST 800-171 R3 requirements by deleting NIST 800-171 R2 specific controls from the NCP.
  

The following graphic is a summarized version of the differences between NIST 800-171 Rev 2, NIST 800-171A, NIST 800-171 Rev 3 and CMMC 2.0. Please click the graphic to view an extended version of all the differences that the NCP covers:

NIST provided the following information on what changed between NIST 800-171 R2 and R3:

What makes the NCP great is that it saves you time and money! The NCP was designed to make it less painful to upgrade to the latest version of NIST 800-171. One of its key features of the NCP is that it is backwards compatible with NIST 800-171 Rev 2, in addition to providing coverage for NIST 800-171 Rev 3. This is beneficial, since you can demonstrate coverage for the current version of NIST 800-171 (Rev 2), while you implement the new controls from NIST 800-171 Rev 3.

What Is The NIST 800-171 Compliance Program (NCP)?

The NCP is a compilation of editable Microsoft Word, Excel and PowerPoint templates. There is no software to install and it is a one-time purchase. You get the following material as part of the NCP:

• Updated Coverage For Both NIST 800-171 R2 & R3 (mapped to the Assessment Objective level of NIST 800-171A)
• Cybersecurity Policies (policies specific to NIST 800-171 and CMMC 2.0 L2)
• Cybersecurity Standards (standards that are specific to NIST 800-171 and CMMC 2.0 L2)
• Cybersecurity Standardized Operating Procedures (SOP) (procedures that are specific to NIST 800-171 and CMMC 2.0 L2)
• - NEW ADDITION -   Supply Chain Risk Management (SCRM) Plan
• Risk Assessment Worksheet & Report Template (perform a risk & threat assessment using Microsoft Word and Excel)
• System Security Plan (SSP) Template  
• Plan of Action & Milestones (POA&M) Template
• Provides coverage for related compliance requirements found in:
  • Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7008, 252.204-7012, 252.204-7019, 252.204-7020 and 252.204-7021
    
  • Federal Acquisition Regulation (FAR) 52.204-21, 52.204-27 and Section 889
    
  • International Traffic in Arms Regulation (ITAR)
• A Considerable Number of Reference Documents and Other Templates:
  • Risk catalog
  • Threat catalog
  • Evidence Request List (ERL)
  • Incident Response Plan (IRP) template
  • Business Impact Analysis (BIA) template
  • Business Continuity / Disaster Recovery (BC/DR) template
  • Data classification & handling guidelines
  • Data retention guidelines
  • Rules of behavior (acceptable use)
  • Mobile device usage guidelines
  • Risk management guidelines
  • System hardening guidelines
  • and more!

The NCP is "battle tested" - our clients have successfully passed DIBCAC assessments with this documentation, including a CMMC Third-Party Assessment Organization (C3PAO). You receive a lifetime license to use the NCP at your company and the purchase price includes one year of updates. After the first year, you can choose to subscribe to updates or not. NIST 800-171 R3 was released mid-2024, and we are assuming "CMMC 3.0" will be released sometime in the next year, so clients who buy the NCP in 2024 will receive updated documentation to address those changes. 

The NCP is designed to fit the needs of small to medium businesses in need of a “square peg for a square hole” to singularly address NIST 800-171 and CMMC compliance requirements. The NCP provides coverage for all Controlled Unclassified Information (CUI) and Non-Federal Organization (NFO) controls found in Appendix E of NIST 800-171, as well as the Assessment Objectives (AOs) from NIST 800-171A (note - if you are unclear what NFO controls are, ComplianceForge has a page on its website that is dedicated to the topic that is worth reading). Given the coverage of NIST 800-171 and 800-171A, the NCP also provides necessary coverage for CMMC Level 1 and Level 2 controls.

The core NCP documents include:

• Cybersecurity & Data Protection Program (CDPP) – cybersecurity policies & standards tailored for NIST 800-171 & CMMC 2.0
• Cybersecurity Standardized Operating Procedures (CSOP) – cybersecurity procedures tailored for NIST 800-171 & CMMC 2.0
• System Security Plan (SSP)
• Plan of Action & Milestones (POA&M)
• Third-Party Security Management (TPSM) - third-party Cybersecurity Supply Chain Risk Management (C-SCRM) guidance

What Problems Does The NCP Solve?

• Lack of In House Security Experience - Most smaller contractors lack expertise in NIST 800-171. Tasking your managers, IT personnel or security staff to research and write comprehensive documentation is not a wise use of their time. The NCP is an efficient method to obtain comprehensive compliance documentation that can be implemented by either your in-house staff or outsourced IT vendor. Most small contractors cannot afford tens of thousands of dollars in consultant fees to help become compliant with NIST 800-171, so the NCP is designed with affordable compliance in mind to give your business the NIST 800-171 compliance documentation it needs. 
• Compliance Requirements - NIST 800-171 is a reality for companies in scope for DFARS and FAR. The NCP is designed with compliance in mind, since it focuses on reasonably-expected security requirements to address the NIST 800-171 controls. The documentation contained in the NCP gives you everything you need to comply with NIST 800-171 from policies to standards to procedures to templates for your System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
• Audit Failures - Without being able to demonstrate compliance with NIST 800-171, your organization will likely lose government contracts - it is as simple as that. The NCP is a tool that can jump start your organization towards being compliant with NIST 800-171 requirements.  
• Vendor Requirements - It is very common for clients and partners to request evidence of a security program and this includes policies and standards. The NCP can provide this evidence!

We listened to our customers and created the NIST 800-171 Compliance Program (NCP), based on the growing demand from small and medium businesses that want a simplified approach to NIST 800-171 & Cybersecurity Maturity Model Certification (CMMC) compliance. The NCP is a set of editable cybersecurity documentation templates that are tailored for small and medium businesses to address NIST 800-171 / CMMC 2.0 compliance. The NCP is streamlined to singularly focus on what is required to comply with NIST 800-171 R2 and CMMC 2.0. Both the policies & standards document (CDPP) and procedures document (CSOP) have footnotes to clearly identify which NIST 800-171, NIST 800-171A and/or CMMC requirement is addressed. The NCP is meant to provide coverage for the “who, what, when, how & why” considerations for your cybersecurity program that address scoping from your strategic, operational and tactical needs. We've performed the heavy lifting to build these documentation templates and you (or your IT consultants) just need to fill in the details that only you will know. We do have consulting services available, if you need assistance.

How Does The NCP Solve These Problems?

• Clear Documentation - The NCP comes in editable Microsoft Office format (e.g., Word, Excel and PowerPoint), so it is customizable for your needs. 
• Time Savings - The time savings are immense, as compared to writing something equivalent of the NCP yourself or hiring a consultant to write it for you!
• Alignment With Leading Practices - The NCP has direct mapping to several leading cybersecurity frameworks, including:
• NIST 800-53
• ISO 27002
• NIST Cybersecurity Framework (CSF)
• NIST 800-160
• Secure Controls Framework (SCF)  

The NCP is a bundle of editable documentation templates that is designed to save your organization hundreds of hours in labor. These are the policy sections that address the 14 sections of CUI from NIST 800-171 (as well as Non-Federal Organization (NFO) controls from Appendix E) and the 17 sections of CMMC that overlap what is in NIST 800-171. Most people forget or ignore the NFO controls component, which is a basic expectation of being compliant with NIST 800-171 but we include NFO, CUI and CMMC requirements in the NCP

There is no getting around the necessity to read and be familiar with NIST 800-171 and CMMC - that can’t be avoided. One of the best things you can to start off is make yourself a pot of coffee and familiarize yourself with the CMMC Kill Chain since you really need to have a prioritized plan to address NIST 800-171 / CMMC requirements. This is the process we recommend for using the NCP:

The NIST 800-171 Compliance Program (NCP) Is Built On Industry-Leading Practices & Definitions

We recognize there are other options on the market for "NIST 800-171 & CMMC documentation" and we strive to make the highest-quality products on the market. Our obsession with making quality documentation can be demonstrated in the architecture we use to create our documentation. As shown in the swimlane diagram below, the Hierarchical Cybersecurity Governance Framework (HCGF) is the "ComplianceForge Reference Model" of cybersecurity and privacy documentation. The HCGF is a documentation model that leverages industry-recognized terminology to logically arrange these documentation components into their rightful order. This model creates an approach to architecting documentation that is concise, scalable and comprehensive. When that is all laid out properly, an organization's cybersecurity and data protection documentation should be hierarchical and linked from policies all the way through metrics.

“DIBCAC Battle Tested” Policies, Standards & Procedures - NIST 800-171, NIST 800-171A & CMMC 2.0 Compliance

ComplianceForge’s NIST 800-171 / CMMC documentation has been used successfully by multiple companies during DIBCAC assessments to efficiently and effectively generate the necessary artifact documentation to demonstrate compliance with NIST 800-171 controls and NIST 800-171A control objectives. This battle tested documentation includes the necessary policies, standards, procedures, SSP, POA&M, Incident Response Plan (IRP) and other documentation that are expected to exist to successfully pass a third-party assessment, be it DIBCAC or a C3PAO.

The Excel crosswalk spreadsheet that comes with the NCP maps the standards to the controls and Assessment Objectives (AOs), so it is straightforward to understand why a requirement in the NCP exists. 

NIST 800-171 R2 / R3 & CMMC 2.0 Level 2 (Advanced) Policies, Standards, Procedures, SSP & POA&M Templates and More!

In simple terms, the NCP gives you everything you need to comply with NIST 800-171 & CMMC v2.0 - cybersecurity policies, standards, procedures, a System Security Plan (SSP) and a Plan of Action & Milestones (POA&M). As depicted in the graphic below, the NCP is its own bundle of products that makes up the documentation you need to demonstrate compliance with NIST 800-171 and CMMC:

Frequently Asked Questions (FAQs) On The NCP

Below are some common questions that we receive about the NCP so we decided to help provide further transparency to help with your purchasing decision:

• How does the NCP address CMMC v2.0 Level 2 (Advanced)?
• The NCP was specifically written to address all NFO & CUI controls in NIST 800-171 R2, as well as CMMC v2.0 Level 2 (Advanced) controls. The NCP is our "easy button" solution for CMMC 2.0 L2.
• The NCP contains editable policies, standards, procedures, SSP & POA&M templates, and much more. Continue reading to the "What Does The NIST 800-171 Compliance Program (NCP) Contain?" section about all that the NCP contains.
• How is the NCP different from CMMC Bundle #2? 
• CMMC Bundle #2 is similar to the NIST 800-171 Compliance Program (NCP), in that both products cover CMMC 2.0 levels 1-2. Both equally cover CMMC 2.0 1-2 and NIST 800-171 requirements. However, the main differences are in coverage and framework alignment.
• The NCP is a pared-down version of the Digital Security Program (DSP), our flagship product. The NCP is tailored to be a "square peg for a square hole" to address only CMMC 2.0 L1-2 and NIST 800-171 requirements in the most efficient manner we can provide.
• CMMC Bundle #2 is based on the NIST 800-53 R5 framework, so it is great if you need to "speak NIST 800-53" or have other US government-based requirements (e.g., FISMA, RMF, HIPAA, etc.) that are based on NIST 800-53. This bundle is aligned with NIST 800-53 (low & moderate baseline coverage) so that is ideal for an organization that wants to align its policies and standards directly with NIST 800-53. 
• If you are just looking for CMMC & NIST 800-171 coverage, then the NCP is a better fit.
• Why does the NCP leverage Secure Controls Framework (SCF) controls? 
• The hierarchical and scalable structure of the Secure Controls Framework (SCF) makes it an ideal choice to address NIST 800-171 / CMMC compliance, so that is why the NCP leverages this structure.
• The SCF is a “metaframework” that maps to over 100 cybersecurity and privacy-related laws, regulations and frameworks, including NIST CSF, ISO 27001/2, NIST 800-53, NIST 800-171 and CMMC. The SCF is logically organized into thirty-three (33) domains. ComplianceForge’s Digital Security Program (DSP) has 1-1 mapping to the SCF and the NCP is merely a pared-down version of the DSP to focus specifically on the CUI and NFO controls from NIST 800-171, AOs from NIST 800-171 and CMMC 2.0 controls.
• The NIST OLIR Program will has SCF to NIST 800-171 R2 mappings, so that is another benefit to leveraging the SCF to structure the NCP’s policies, standards and procedures. You can read more about that here - https://csrc.nist.gov/projects/olir/informative-reference-catalog/details?frameworkVersionId=87 
• Can you provide us with examples of the documentation & templates that are part of the NCP?
• Yes! If you scroll about 1/3 down the NCP product page, you will see the “Product Example - NIST 800-171 Compliance Criteria (NCP)” that contains examples of policies, standards, procedures, etc.
• What are the gaps in the NCP for CMMC 2.0 Level 2 once we purchase this?
• The NCP provides fully-mapped requirements within the policies, standards, procedures, etc. Therefore, any "gaps" in coverage are specific to your implementation of the requirements to become compliant with NIST 800-171 & CMMC.
• We are "tool makers" that provide you with templates that identify the Minimum Security Requirements (MSR) in an editable, efficient template format. You have to implement those requirements to be considered compliant with NIST 800-171 & CMMC.
• There are no professional service hours included in the purchase of the NCP, but we do have consultants that are available for customization/consulting via a separate Statement of Work (SOW).
• How often is the NCP updated?
• As NIST 800-171 & CMMC change, we update the NCP. There is no set schedule for updates, since we update products based on new guidance from the DoD, NIST and CMMC-AB.
• The NCP comes with one-year of updates, so as long as you have an active subscription you will receive updated versions of the documentation, along with errata that identifies what changed.
• After the first year, you can purchase updates for $900/yr, as described on our updates page. 
• Is the NCP a subscription? How long does a license last?
• The NCP is perpetual and a single-site license. However, if you want to keep getting updates, you just have to pay for updates after the first year.
• NIST 800-171 & CMMC evolve, so that is why we offer updates. It takes considerable effort for us to develop and maintain this documentation, so that is why we charge for updates.
• Can I upgrade to a different bundle if my needs change?
• Yes! We can credit your purchase towards an upgraded bundle if your business needs change and you have to address CMMC 2.0 L3 requirements.

Product Example - NIST 800-171 Compliance Program (NCP)

Our customers choose the NIST 800-171 Compliance Program (NCP) because they:

• Need an efficient way to comply with NIST 800-171 / CMMC and make the process as simple as possible
• Need to be able to edit the document to their specific needs
• Need an affordable solution

Don't take our word for it - take a look at the examples below to see for yourself the level of professionalism and detail that went into making these products:

Cost Savings Estimate - NIST 800-171 Compliance Program (NCP)

When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the NCP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:

• For your internal staff to generate comparable documentation, it would take them an estimated 1,000 internal staff work hours, which equates to a cost of approximately $76,000 in staff-related expenses. This is about 9-18 months of development time where your staff would be diverted from other work.
• If you hire a consultant to generate this documentation, it would take them an estimated 700 consultant work hours, which equates to a cost of approximately $210,000. This is about 4-12 months of development time for a contractor to provide you with the deliverable.
• The NCP is approximately 2% of the cost for a consultant or 7% of the cost of your internal staff to generate equivalent documentation.
• We process most orders the same business day so you can potentially start working with the NCP the same day you place your order.

The process of writing cybersecurity documentation can take an internal team many months and it involves pulling your most senior and experienced cybersecurity experts away from operational duties to assist in the process, which is generally not the most efficient use of their time. In addition to the immense cost of hiring a cybersecurity consultant at $300/hr+ to write this documentation for you, the time to schedule a consultant, provide guidance and get the deliverable product can take months. Even when you bring in a consultant, this also requires involvement from your internal team for quality control and answering questions, so the impact is not limited to just the consultant's time being consumed. 

What Is Included With The NCP?

What Does The NIST 800-171 Compliance Program (NCP) Contain?

The NCP is architected so that each of the policies shown below are supported by granular standards that directly map to NIST 800-171 R2 & R3, as well as CMMC 2.0 requirements:

1. Cybersecurity & Data Privacy Governance (GOV) Policy
2. Asset Management (AST) Policy
3. Business Continuity & Disaster Recovery (BCD) Policy
4. Change Management (CHG) Policy
5. Cloud Security (CLD) Policy
6. Compliance (CPL) Policy
7. Configuration Management (CFG) Policy
8. Continuous Monitoring (MON) Policy
9. Cryptographic Protections (CRY) Policy
10. Data Classification & Handling (DCH) Policy
11. Endpoint Security (END) Policy
12. Human Resources Security (HRS) Policy
13. Identification & Authentication (IAC) Policy
14. Incident Response (IRO) Policy
15. Information Assurance (IAO) Policy
16. Maintenance (MNT) Policy
17. Mobile Device Management (MDM) Policy
18. Network Security (NET) Policy
19. Physical & Environmental Security (PES) Policy
20. Project & Resource Management (PRM) Policy
21. Risk Management (RSK) Policy
22. Secure Engineering & Architecture (SEA) Policy
23. Security Operations (OPS) Policy
24. Security Awareness & Training (SAT) Policy
25. Technology Development & Acquisition (TDA) Policy
26. Third-Party Management (TPM) Policy
27. Threat Management (THR) Policy
28. Vulnerability & Patch Management (VPM) Policy

The NIST 800-171 R2/R3 version of the NCP comes with the following policies, standards and procedures that map directly to the NIST 800-171 R2 & R3 controls and Assessment Objectives (AOs), as well as CMMC 2.0 controls. You can download this crosswalk mapping spreadsheet here.