NIST SP 800-171 Self-Assessment — for DoD contractors handling CUI

1. 1.1
   Are CUI accounts limited to authorised users, processes, and devices (3.1.1)? Provide the access-control policy and inventory.
   Critical
2. 1.2
   Is MFA enforced for all local and network access to CUI (3.1.20 → 3.5.3)? Phishing-resistant factor?
   Critical

1. 2.1
   Is role-based security training delivered to CUI users at hire and annually (3.2.1, 3.2.2)? Completion records?
   High

1. 3.1
   Are audit events created and retained per organisational policy (3.3.1, 3.3.2)? Retention period?
   Critical
2. 3.2
   Are audit logs reviewed and analysed for indicators of unauthorised activity (3.3.5)? SIEM in use?
   High

1. 4.1
   Established and maintained baseline configurations for CUI systems (3.4.1)? Hardening framework used (CIS, DISA STIG)?
   High
2. 4.2
   Is software execution restricted via allowlisting (3.4.8)?
   High

1. 5.1
   Are passwords replaced with cryptographic mechanisms or phishing-resistant MFA where required (3.5.3, 3.5.7)?
   Critical

1. 6.1
   Is there a documented IR capability that includes preparation, detection, analysis, containment, recovery (3.6.1)?
   Critical
2. 6.2
   Cyber incidents reported to DoD via DIBNet within 72 hours per DFARS 7012(c)? Provide the most recent test or actual report.
   Critical

1. 7.1
   Are maintenance tools, techniques, and personnel controlled (3.7.1, 3.7.6)? Sanitisation before removal?
   High

1. 8.1
   Is CUI on digital and non-digital media protected at rest and in transit (3.8.1, 3.8.6)?
   Critical
2. 8.2
   Sanitisation of media before disposal or reuse per NIST SP 800-88 (3.8.3)?
   High

1. 9.1
   Are individuals screened before granting access to CUI (3.9.1)? Access revoked promptly on termination/transfer (3.9.2)?
   High

1. 10.1
   Are physical access to CUI facilities and devices monitored, logged, and limited (3.10.1, 3.10.2)?
   High

1. 11.1
   Are risk assessments performed periodically (3.11.1)? Vulnerability scanning frequency (3.11.2)?
   High

1. 12.1
   Has a NIST 800-171 self-assessment been completed and SPRS score posted (3.12.4, DFARS 7019)?
   Critical
2. 12.2
   Is a Plan of Action & Milestones (POA&M) maintained for any unimplemented requirements (3.12.2)?
   High

1. 13.1
   Is cryptography FIPS-validated for protecting CUI confidentiality (3.13.11)? Which modules?
   Critical
2. 13.2
   Are network boundaries defined, monitored, and managed (3.13.1)? Deny-by-default rules in place?
   High

1. 14.1
   Maximum window from vendor patch release to deployed fix for critical vulns (3.14.1)?
   Critical
2. 14.2
   Are systems monitored for malicious code (3.14.2) and unauthorised network traffic (3.14.6)?
   High

Run a free NIST 800-171 r3 / CMMC 2.0 audit. ComplianceIQ uses your audit responses and generated policies to populate an answer pack you can paste into any SIG, CAIQ, or custom enterprise questionnaire — in minutes, not days.