Understanding CMMC and NIST 800-171 for CUI
summary
Explains how CMMC maps NIST SP 800-171 into a certifiable ecosystem: 110 controls (about 320 sub-requirements), a level 1 self‑assessment of 17 practices, and level 2 mandatory third‑party validation by C3PAO / CCP / CCA roles. Describes the SPRS registry, POA&Ms, ongoing monitoring, and likely cost and timeline pressures for small businesses. Gives concrete scoring math (starts around -203 to 110, with ~88 often cited as a practical pass threshold) and mentions automated assessment tools and spreadsheets used to prepare evidence.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 3:10Federal Acquisition Regulation overview
- 10:15CMMC ecosystem and certification process
- 21:14NIST 800-171 and CUI protection
- 26:34CMMC levels and compliance requirements
- 31:53Assessment process and documentation
- 39:00SPR system and scoring explained
- 42:02Q&A on compliance and service providers
related talks
29mMeasuring Cybersecurity Maturity with the NIST CSF
50mIntegrating Privacy Protections into National Security Systems
51mHow Sworn Enemies Found a Truce (Sort of) to Achieve NIST Compliance
40mCompliance Made Easy—Simplify Your Approach to Privacy
40mProtecting What Matters Most – Tools for Managing Risk
46mThe Perfect Storm, What NIS2 and CRA Mean for Your IT Security Strategy
35mRevolutionizing Cyber Defense: The NIST CSF 2.0 Advantage
48mApplying Cybersecurity Regulations and Industry Standards to Open Source Projects