The obligation behind every program name
Strip away the program acronyms and the underlying obligation is the same across the federal market: protect Controlled Unclassified Information on your systems, implement NIST SP 800-171, document it in an SSP, and be able to prove it. CMMC is how DoD verifies that. GSA verifies it through an authorization process. NASA and DOE impose it through their own directives. The verification differs; the engineering doesn't.
That's why we sell the engineering, not the acronym. Programs pause, phase in, and change names. The contractual duty to protect CUI — and the False Claims Act exposure attached to misrepresenting it — does not.
What the program covers, end to end
- Federal CUI applicability — which of your contracts, agreements, and flow-downs actually impose CUI obligations, and which version of 800-171 each one incorporates.
- Contract and agreement review — clause-level analysis: DFARS 252.204-7012/7019/7020, agency CUI clauses, prime flow-downs, and assessment or authorization conditions.
- CUI categories and data-flow discovery — what categories you hold, where they enter, travel, and rest. Discovery identifies the defensible boundary; the result depends on data flows and security dependencies.
- System boundary definition — the scope document every architecture, budget, and assessment decision hangs on.
- SSP and POA&M development — written from the live environment against the revision your contracts require, structured so it can be converted or dual-tracked as baselines evolve.
- Microsoft architecture — the six security planes (Entra ID, Intune, Purview, Defender, WDAC, audit and logging) engineered as one system in GCC High and Azure Government. See GCC High Migration and Azure Government.
- Evidence collection — artifacts gathered at the assessment-objective level using SP 800-171A, the unit every assessor and authorizing official actually tests.
- Assessment readiness — mock assessment against the applicable methodology before any C3PAO, government reviewer, or authorizing official sees the package.
- Continuous monitoring and sustainment — evidence refresh, control validation, and POA&M management under managed compliance.
Where the proof comes from: this delivery model was proven inside our own CMMC Level 2 assessed environment — with objective-level evidence for the assessed boundary — and on Allyon's June 2026 certification. We now apply the same engineering and evidence discipline wherever federal CUI travels: DoD, GSA, NASA, DOE, and beyond. See agency CUI programs.
Questions contractors ask us
Does NIST SP 800-171 only apply to DoD contractors?
No. NIST SP 800-171 is the government-wide standard for protecting CUI on nonfederal systems. DoD imposes it through DFARS 252.204-7012, but GSA, NASA, DOE, and other agencies apply it through their own clauses, policies, and authorization processes. If your contracts touch CUI, some form of 800-171 obligation is almost certainly attached — the question is which version, imposed how.
Which revision of 800-171 applies to us — Rev. 2 or Rev. 3?
Your contracts and agreements decide, not the publication date. NIST finalized Rev. 3 in May 2024, but contractors must follow the version incorporated into each contract, agreement, or agency policy — DoD work generally still points at Rev. 2, while some civilian processes are moving to Rev. 3. We inventory your contractual baselines before touching anything. See the Rev. 2 vs. Rev. 3 guide.
Is this the same thing as CMMC?
No — CMMC is one assurance mechanism layered on top of 800-171 for DoD work. The underlying obligation is protecting CUI and implementing the standard; CMMC, agency authorization, government review, and independent assessment are different ways different customers verify it. We build the operational program once, then aim it at whichever assurance outcome your contracts require. For the DoD lane, see CMMC Readiness.
What if different customers impose different requirements?
That is the normal case, not the exception. One customer wants a Rev. 2 SPRS score, another references Rev. 3 with agency-defined parameters, a third has bespoke CUI clauses. A single well-engineered control implementation with objective-level evidence can satisfy all of them — that is the entire premise of the Factory model.
Map your CUI obligations across every contract.
Send us where you are — agencies, clauses, current posture — and a practitioner will map your applicability, baseline versions, and the shortest path to a defensible program. Or email rj@indirectit.com directly.