NIST SP 800-171 & CMMC Levels 1-3 "Easy Button" Solution - Editable & Affordable Cybersecurity Documentation
If you are looking for straightforward documentation templates to just address CMMC L1-L3 and NIST SP 800-171, then the NCP is the best solution. The NCP is a bundle of editable compliance documentation that is specifically-tailored for NIST SP 800-171 R2 & the Cybersecurity Maturity Model Certification (CMMC) Levels 1, 2 & 3. The NCP documentation addresses Cybersecurity Maturity Model Certification (CMMC) Levels 1-3 and also covers the CUI and NFO controls of NIST SP 800-171. The NCP contains the following editable templates:
- NIST SP 800-171 / CMMC Policies
- NIST SP 800-171 / CMMC Standards
- NIST SP 800-171 / CMMC Procedures (these procedures map directly to NIST SP 800-171A assessment criteria)
- System Security Plan (SSP) Template To Document Your CUI Environment
- Plan of Action & Milestones (POA&M) Template To Document Any Control Deficiencies
- Many useful supplemental documentation templates:
- Incident Response Plan (IRP) template
- Business Impact Analysis (BIA) template
- Business Continuity / Disaster Recovery (BC/DR) template
- Data classification & handling guidelines
- Data retention guidelines
- Rules of behavior (acceptable use)
- Mobile device usage guidelines
- Risk management guidelines
- System hardening guidelines
- and more templates
We listened to our customers and created the NIST SP 800-171 Compliance Program (NCP), based on the growing demand from small and medium businesses that want a simplified approach to NIST SP 800-171 & CMMC compliance. The NCP is a streamlined product that is made up of other tailored ComplianceForge products to specifically address NIST SP 800-171 & CMMC compliance needs.
NIST SP 800-171 & CMMC Levels 1-3 Policies, Standards, Procedures, SSP & POA&M Templates and More!
In simple terms, the NCP gives you everything you need to comply with NIST SP 800-171 & CMMC v1.02 - cybersecurity policies, standards, procedures, a System Security Plan (SSP) and a Plan of Action & Milestones (POA&M). As depicted in the graphic below, the NCP is its own bundle of products that makes up the documentation you need to demonstrate compliance with NIST SP 800-171 and CMMC:
Frequently Asked Questions (FAQ) On The NCP
Below are some common questions that we receive about the NCP so we decided to help provide further transparency to help with your purchasing decision:
- How does the NCP address CMMC Level 3?
- The NCP was specifically written to address all NFO & CUI controls in NIST SP 800-171 R2, as well as CMMC v1.02 L1-3 practices and processes. The NCP is our "easy button" solution for CMMC L3.
- The NCP contains editable policies, standards, procedures, SSP & POA&M templates, and much more. Continue reading to the "What Does The NIST SP 800-171 Compliance Program (NCP) Contain?" section about all that the NCP contains.
- How is the NCP different from CMMC Bundle #2?
- CMMC Bundle #2 is similar to the NIST SP 800-171 Compliance Program (NCP), in that both products cover CMMC levels 1-3. Both equally cover CMMC 1-3 and NIST SP 800-171 requirements. However, the main differences are in coverage and framework alignment.
- The NCP is a pared-down version of the Digital Security Program (DSP), our flagship product. The NCP is tailored to be a "square peg for a square hole" to address only CMMC L1-3 and NIST SP 800-171 requirements in the most efficient manner we can provide.
- CMMC Bundle #2 is based on the NIST SP 800-53 R5 framework, so it is great if you need to "speak NIST SP 800-53" or have other US government-based requirements (e.g., FISMA, RMF, HIPAA, etc.) that are based on NIST SP 800-53. This bundle is aligned with NIST SP 800-53 (low & moderate baseline coverage) so that is ideal for an organization that wants to align its policies and standards directly with NIST SP 800-53.
- If you are just looking for CMMC & NIST SP 800-171 coverage, then the NCP is a better fit.
- How does the NCP apply to ISO 27001/27002?
- The NCP provides mapping to applicable ISO 27002 controls, as well as NIST CSF & NIST SP 800-53.
- If you look at mapping out requirements, ISO 27002 provides about 2/3 coverage for NIST SP 800-171/CMMC, so it is not enough to get you to CMMC L3.
- The Excel spreadsheet that is included in the NCP includes mapping to ISO 27002 controls.
- Can you provide us with examples of the documentation & templates that are part of the NCP?
- Yes! If you scroll about 1/3 down the NCP product page, you will see the “Product Example - NIST SP 800-171 Compliance Criteria (NCP)” that contains examples of policies, standards, procedures, etc.
- What are the gaps in the NCP for CMMC Level 3 once we purchase this?
- The NCP provides fully-mapped requirements within the policies, standards, procedures, etc. Therefore, any "gaps" in coverage are specific to your implementation of the requirements to become compliant with NIST SP 800-171 & CMMC.
- We are "tool makers" that provide you with templates that identify the Minimum Security Requirements (MSR) in an editable, efficient template format. You have to implement those requirements to be considered compliant with NIST SP 800-171 & CMMC.
- There are no professional service hours included in the purchase of the NCP, but we do have consultants that are available for customization/consulting via a separate Statement of Work (SOW).
- How often is the NCP updated?
- As NIST SP 800-171 & CMMC change, we update the NCP. There is no set schedule for updates, since we update products based on new guidance from the DoD, NIST and CMMC-AB.
- The NCP comes with one-year of updates, so as long as you have an active subscription you will receive updated versions of the documentation, along with errata that identifies what changed.
- After the first year, you can purchase updates for $750/yr, as described on our updates page.
- Is the NCP a subscription? How long does a license last?
- The NCP is perpetual and a single-site license. However, if you want to keep getting updates, you just have to pay for updates after the first year.
- NIST SP 800-171 & CMMC evolve, so that is why we offer updates. It takes considerable effort for us to develop and maintain this documentation, so that is why we charge for updates.
- Can I upgrade to a different bundle if my needs change?
- Yes! We can credit your purchase towards an upgraded bundle if your business needs change and you have to address CMMC L4-5 requirements.
CMMC Maturity Level Processes
CMMC Level 3 is made up of 130 practices, but it is also made up processes (ML.2.999, ML.2.998 & ML.3.997) that are applicable to each domain. We often receive questions on how to address those processes from a documentation perspective, so here is that approach for how the NCP addresses processes:
- ML.2.999 requires policies (based on CERT RMM v1.2 section GG2.GP1 subpractice 2)
- The Cybersecurity & Data Protection Program (CDPP) component of the NCP addresses ML.2.999 requirements by containing policies to address each CMMC domain, in addition to NIST SP 800-171 CUI and NFO controls.
- ML.2.998 requires procedures (based on CERT RMM v1.2 section GG2.GP1 subpractice 2)
- The Cybersecurity Standardized Operating Procedures (CSOP) component of the NCP addresses ML.2.998 requirements by containing procedures to address each CMMC domain, in addition to NIST SP 800-171 CUI and NFO controls.
- The CSOP’s procedures are mapped directly to the standards in the CDPP, which support the policies of the CDPP.
- ML.3.997 requires a "resource plan" (based on CERT RMM v1.2 sections GG2.GP2 and GG2.GP3)
- The Management Direction for Cybersecurity & Concept of Operations (CONOPS) sections of the NCP address how your company resources its security program via the NCP.
- It is impossible to implement ML.2.999 or ML.2.998 processes without first resourcing People, Processes and Technology (PPT) that is provided through addressing ML.3.997.
- Fun fact on ML.3.997 - buying the NCP from ComplianceForge can serve as evidence of ML.3.997, since it shows your company is resourcing the plan to become compliant.
Our customers choose the NIST SP 800-171 Compliance Program (NCP) because they:
Don't take our word for it - take a look at the examples below to see for yourself the level of professionalism and detail that went into making these products:
Cost Savings Estimate - NIST SP 800-171 Compliance Program (NCP)
When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the NCP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:
- For your internal staff to generate comparable documentation, it would take them an estimated 800 internal staff work hours, which equates to a cost of approximately $60,000 in staff-related expenses. This is about 6-12 months of development time where your staff would be diverted from other work.
- If you hire a consultant to generate this documentation, it would take them an 600 consultant work hours, which equates to a cost of approximately $180,000. This is about 4-9 months of development time for a contractor to provide you with the deliverable.
- The NCP is approximately 2% of the cost for a consultant or 7% of the cost of your internal staff to generate equivalent documentation.
- We process most orders the same business day so you can potentially start working with the NCP the same day you place your order.
The process of writing cybersecurity documentation can take an internal team many months and it involves pulling your most senior and experienced cybersecurity experts away from operational duties to assist in the process, which is generally not the most efficient use of their time. In addition to the immense cost of hiring a cybersecurity consultant at $300/hr+ to write this documentation for you, the time to schedule a consultant, provide guidance and get the deliverable product can take months. Even when you bring in a consultant, this also requires involvement from your internal team for quality control and answering questions, so the impact is not limited to just the consultant's time being consumed.
The NIST SP 800-171 Compliance Program (NCP) is a compilation of editable Microsoft Word, Excel and PowerPoint templates. There is no software to install and it is a one-time purchase. You get the following material as part of the NCP:
- Cybersecurity Policies (20 policies specific to NIST SP 800-171 and CMMC)
- Cybersecurity Standards (197 standards that are specific to NIST SP 800-171 and CMMC)
- Cybersecurity Standardized Operating Procedures (SOP) (197 procedures that are specific to NIST SP 800-171 and CMMC)
- System Security Plan (SSP) Template
- Plan of Action & Milestones (POA&M) Template
- Several Reference Documents
Included Policy Sections:
These are the policy sections that address the 14 sections of CUI from NIST SP 800-171 (as well as Non-Federal Organization (NFO) controls from Appendix E) and the 17 sections of CMMC that overlap what is in NIST SP 800-171. Most people forget or ignore the NFO controls component, which is a basic expectation of being compliant with NIST SP 800-171 but we include NFO, CUI and CMMC requirements in the NCP. Each of these policies are supported by standards that directly map to NIST SP 800-171 & CMMC requirements:
- Access Control (AC) Policy
- Asset Management (AM) Policy
- Audit & Accountability (AU) Policy
- Awareness & Training (AT) Policy
- Configuration Management (CM) Policy
- Cybersecurity Governance (CG) Policy
- Identification & Authentication (IA) Policy
- Incident Response (IR) Policy
- Maintenance (MA) Policy
- Media Protection (MP) Policy
- Personnel Security (PS) Policy
- Physical Protection (PE) Policy
- Recovery (RE) Policy
- Risk Management (RM) Policy
- Security Assessment (CA) Policy
- Service Provider (SP) Policy
- Situational Awareness (SA) Policy
- System & Communications Protection (SC) Policy
- System & Information Integrity (SI) Policy
- System Development (SD) Policy
Supplemental Documentation - Annexes, Templates & References
The NCP also contains the following in the “supplemental documentation” attachment that we provide as part of the NCP:
- Annex 1: Data Classification & Handling Guidelines
- Annex 2: Data Classification Examples
- Annex 3: Data Retention Periods
- Annex 4: Baseline Security Categorization Guidelines
- Annex 5: Rules of Behavior (Acceptable & Unacceptable Use)
- Annex 6: Guidelines for Personal Use of Organizational IT Resources
- Annex 7: Risk Management Framework (RMF)
- Annex 8: System Hardening
- Annex 9: Safety Considerations With Embedded Technology
- Annex 10: Indicators of Compromise (IoC)
- Template 1: Management Directive (Policy Authorization)
- Template 2: User Acknowledgement Form
- Template 3: User Equipment Receipt of Issue
- Template 4: Service Provider Non-Disclosure Agreement (NDA)
- Template 5: Incident Response Plan (IRP)
- Template 6: Incident Response Form
- Template 7: Appointment Orders (Information Security Officer)
- Template 8: Privileged User Account Request Form
- Template 9: Change Management Request Form
- Template 10: Change Control Board (CCB) Meeting Minutes
- Template 11: Plan of Action & Milestones (POA&M) / Risk Register
- Template 12: Ports, Protocols & Services (PPS)
- Template 13: Business Impact Analysis (BIA)
- Template 14: Disaster Recovery Plan (DRP) & Business Continuity Plan (BCP)
- Template 15: Privacy Impact Assessment (PIA)
- Reference 1: CDPP Exception Request Process
- Reference 2: Electronic Discovery (eDiscovery) Guidelines
- Reference 3: Types of Security Controls
- Reference 4: Information Security Management System (ISMS)
In addition to that, we include the following documentation to aide in your implementation of the NCP:
- NIST NICE Cybersecurity Workforce-based Cybersecurity Roles & Responsibilities
- Cybersecurity Awareness Training (PowerPoint slideshow template)
- Data Classification Icons (PowerPoint template)
- Example - Memorandum for Record (MFR) to Define CUI
- Guide to Writing Procedures
- NIST SP 800-171 Scoping Guide
- Educational Posters - How To GRC (Governance, Risk & Compliance)
What Is The NIST 800-171 & CMMC Compliance Criteria (NC3)?
What do you get if you buy the NIST 800-171 & CMMC Compliance Criteria (NC3) product?
- The NC3 is a “consultant in a box” solution that is essentially a NIST 800-171 checklist in an editable Microsoft Excel format.
- The NC3 covers all controls in Appendix D of NIST 800-171.
- It also covers Appendix E Non-Federal Organization (NFO) controls, which are required by contractors.
- Each of the NIST 800-171 controls is mapped to its corresponding NIST 800-53 control.
- Each of the NIST 800-53 controls are broken down to identify:
- Reasonably-expected criteria to address the control.
- Applicable compliance guidance;
- Methods to address the requirement; and
- Status of compliance for each control so you can use it for a self-assessment.
Affordable NIST SP 800-171 Compliance Documentation
The NCP is comparable to the NIST SP 800-171 Compliance Bundle #1 that provides the NIST SP 800-53 based version of these products, but offers a price break of over $700!
ComplianceForge took existing documentation and pared it down for smaller organizations that do not need or want the complexity of NIST SP 800-53 when complying with NIST SP 800-171. The NCP includes the following documents as part of its own unique bundle:
- NIST SP 800-171 Compliance Program - Microsoft Word document that addresses NIST SP 800-171 policies and standards.
- Cybersecurity Standardized Operating Procedures (CSOP) - Microsoft Word document that contains cybersecurity procedures that correspond to the policies and standards.
- System Security Plan (SSP) - Microsoft Word document that is a simplified version of our SSP product.
- NIST SP 800-171 Cybersecurity Program Mapping - Microsoft Excel document that contains several components:
- Plan of Action & Milestones (POA&M) template.
- Mapping from the NCP to NIST SP 800-171, NIST SP 800-53, NIST SP 800-160, ISO 27002 and NIST CSF.
- Methods to comply with NIST SP 800-171 (essentially a pared down NIST SP 800-171 Compliance Criteria (NCC) spreadsheet)
- Roles and responsibilities (corresponds to the Cybersecurity Standardized Operating Procedures)
- Cybersecurity Awareness Training - Microsoft PowerPoint template to provide cybersecurity awareness training.
Passing A CMMC Audit By Itself Does Not Mean NIST SP 800-171 Compliance
The Cybersecurity Maturity Model Certification (CMMC) does not address all requirements of NIST SP 800-171. While there are an additional 20 controls on top of the 110 CUI controls required by NIST SP 800-171, CMMC neglects the Non-Federal Organization (NFO) controls required in Appendix E of NIST SP 800-171. The good news is the NCP provides documentation to cover CUI, NFO and CMMC requirements for CMMC Level 1, CMMC Level 2 and CMMC Level 3 organizations.
The NCP is designed for companies that do not need or want to use the NIST SP 800-53 framework to manage NIST SP 800-171 compliance needs. This can significantly reduce complexity for companies that need to comply with NIST SP 800-171.
What Problem Does The NCP Solve?
- Lack of In House Security Experience - Most smaller contractors lack expertise in NIST SP 800-171. Tasking your managers, IT personnel or security staff to research and write comprehensive documentation is not a wise use of their time. The NCP is an efficient method to obtain comprehensive compliance documentation that can be implemented by either your in-house staff or outsourced IT vendor. Most small contractors cannot afford tens of thousands of dollars in consultant fees to help become compliant with NIST SP 800-171, so the NCP is designed with affordable compliance in mind to give your business the NIST SP 800-171 compliance documentation it needs.
- Compliance Requirements - NIST SP 800-171 is a reality for companies in scope for DFARS and FAR. The NCP is designed with compliance in mind, since it focuses on reasonably-expected security requirements to address the NIST SP 800-171 controls. The documentation contained in the NCP gives you everything you need to comply with NIST SP 800-171 from policies to standards to procedures to templates for your System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
- Audit Failures - Without being able to demonstrate compliance with NIST SP 800-171, your organization will likely lose government contracts - it is as simple as that. The NCP is a tool that can jump start your organization towards being compliant with NIST SP 800-171 requirements.
- Vendor Requirements - It is very common for clients and partners to request evidence of a security program and this includes policies and standards. The NCP can provide this evidence!
How Does The NCP Solve It?
- Clear Documentation - The NCP comes in editable Microsoft Office format (e.g., Word, Excel and PowerPoint), so it is customizable for your needs.
- Time Savings - The time savings are immense, as compared to writing something equivalent of the NCP yourself or hiring a consultant to write it for you!
- Alignment With Leading Practices - The NCP has direct mapping to several leading cybersecurity frameworks, including:
- NIST SP 800-53
- ISO 27002
- NIST Cybersecurity Framework (CSF)
- NIST SP 800-160
- Secure Controls Framework (SCF)
There is no getting around the necessity to read and be familiar with NIST 800-171 and CMMC - that can’t be avoided. One of the best things you can to start off is make yourself a pot of coffee and familiarize yourself with the CMMC Kill Chain since you really need to have a prioritized plan to address NIST 800-171 / CMMC requirements. This is the process we recommend for using the NCP:
- Familiarize yourself with all the documents that come as part of the NCP. At least read through the table of contents and appendices to see what is contained so you understand where to find things.
- Start with the policies & standards – that is a relatively easy win and establishes requirements that other practices will be expected to meet.
- Understand the scope of your CUI environment:
- Make a network diagram and data flow diagram
- Leverage the scoping guide to identify what is in scope: https://www.unified-scoping-guide.com/
FAR vs DFARS Implications for NIST SP 800-171
NIST SP 800-171 isn’t just for Department of Defense (DoD) contractors.
In addition to DoD contractors that had to comply with NIST SP 800-171 by the end of 2017, US Federal contractors are increasingly being required to comply with NIST SP 800-171. We often hear from DoD and US Government contractors that they do not know where to start, but they just know that NIST SP 800-171 is a requirement they cannot run from. Both DFARS and FAR point to NIST SP 800-171 as the expectation for contractors to implement a minimum set of cybersecurity capabilities.
The NCP addresses both Controlled Unclassified Information (CUI) and Non-Federal Organization (NFO) requirements. Many people overlook the NFO requirements that are listed in Appendix E of NIST SP 800-171, but the NCP includes both CUI and NFO controls so that you have complete coverage for NIST SP 800-171 compliance documentation.
Work Smarter and Not Harder - NIST SP 800-171 Scoping Considerations
NIST SP 800-171 allows contractors to limit the scope of the CUI security requirements to those particular systems or components that store, process or transmit CUI. Isolating CUI into its own security domain by applying architectural design principles or concepts (e.g., implementing subnetworks with firewalls or other boundary protection devices) may be the most cost-effective and efficient approach for non-federal organizations to satisfy the requirements and protect the confidentiality of CUI. Security domains may employ physical separation, logical separation, or a combination of both.
Click here for a FREE GUIDE
We put together a guide to help companies scope their computing environment to help identify what is in scope for NIST SP 800-171 and was falls outside of scope.
When you look at NIST SP 800-171 compliance, it has some similarities to the Payment Card Industry Data Security Standard (PCI DSS). If scoping is done poorly, a company's Cardholder Data Environment (CDE) can encompass the enterprise's entire network, which means PCI DSS requirements would apply uniformly throughout the entire organization. In these scenarios, PCI DSS compliance can be prohibitively expensive or even technically impossible. However, when the network is intelligently designed with security in mind, the CDE can be a small fraction of the company's network, which makes compliance much more achievable and affordable. NIST SP 800-171 should be viewed in the very same manner.
We feel that NIST SP 800-171 should be viewed in the very same manner. This guide is meant to help companies identify assets within scope for NIST SP 800-171 and potentially find ways to minimize scope through isolation or controlled access.
Consulting Services Are Available
If you need consulting services, ComplianceForge does have experts available to consult with you on your specific NIST SP 800-171 compliance needs.