Readiness before certification: how a small firm approaches NIST SP 800-171

Federal work that touches Controlled Unclassified Information comes with security requirements. The baseline is NIST SP 800-171, a set of controls for protecting CUI on contractor systems. The Department of War's CMMC program builds certification levels on top of it.

We want to be precise about where we stand. Our practices are aligned with NIST SP 800-171. We are preparing for CMMC Level 1. We do not currently hold a CMMC certification. We use those exact words on our site because a contracting officer should be able to rely on them.

Here is what alignment means for us today.

Access control. Every account gets the least access it needs. Multi-factor authentication is on for every system we use. Accounts are removed when they are no longer needed.

Data handling. Data is encrypted in transit and at rest. CUI is not stored on personal devices. We keep track of where sensitive data lives so we can answer that question quickly.

Secure development. All code is in version control. Changes are reviewed before they ship. Dependencies are scanned for known vulnerabilities, and we act on what the scans find.

Incident response. We have a written process for handling a security incident, including who does what and how the government is notified within required timelines.

Why start before a contract requires it? Because these controls are cheaper to build into a small company than to retrofit into a larger one. A team of a few people can adopt MFA, encryption and code review in days. The same change across a large organization takes months.

Readiness also changes how we design software. When least privilege and encryption are defaults, the applications we build for clients inherit them. Security becomes a property of the system rather than a document.

The path from here is straightforward. We document our practices against the Level 1 requirements, complete the self-assessment, and keep the evidence current. When we reach a milestone, we will update our Security & Compliance page with the exact status, and not before.