Safeguarding and reporting
Adequate security for covered defense information, reporting of cyber incidents to the DoD within 72 hours, and flow-down to subcontractors that handle CUI.
NIST SP 800-171 · DFARS
Protect CUI, score it accurately, and report it with confidence.
Contractors that handle Controlled Unclassified Information must protect it under DFARS 252.204-7012 using the 110 security requirements of NIST SP 800-171. HARDAC helps you implement those requirements and stand behind the score you submit.
01 — Your obligations
What DFARS requires.
Three sources define what a DoD contractor handling CUI must do, report, and be able to prove.
Assessment and SPRS
A current NIST SP 800-171 DoD Assessment score in SPRS, and government access to verify it.
The 110 requirements
The requirements across 14 families that DoD contractors are assessed against. Revision 2 remains the DoD standard under a class deviation until Revision 3 is adopted through rulemaking.
02 — Services
Our NIST SP 800-171 services.
From finding your CUI to the number you submit in SPRS, each step builds the evidence behind your score.
01
CUI identification and scoping
We help you identify where CUI enters, moves through, and leaves your organization, and define the boundary that the requirements apply to.
02
Gap assessment
We evaluate each of the 110 requirements using the assessment procedures in NIST SP 800-171A and document what is met, partially met, or not met.
03
DoD Assessment scoring
We calculate your score under the DoD Assessment Methodology, which starts at 110 and subtracts weighted points for each unmet requirement, so the number you submit is accurate and defensible.
04
Remediation and documentation
We help implement missing controls and develop the system security plan and plans of action your score depends on.
05
Cloud and service provider review
Cloud services that store, process, or transmit CUI must meet FedRAMP Moderate baseline equivalency. We help you evaluate providers and document shared responsibility.
06
Incident reporting readiness
We help you build an incident response process that meets the 72-hour reporting requirement and preserves the images and data the DoD may request.
03 — Relation to CMMC
One set of requirements, two obligations.
CMMC Level 2 is built on the same 110 NIST SP 800-171 requirements. Work you do to meet DFARS 252.204-7012 carries directly into CMMC readiness, and a single engagement can address both.
- The same system security plan supports your SPRS score and your CMMC assessment
- The same evidence answers a prime, a contracting officer, and an assessor
- The same scope boundary applies to both
Get started
Get an accurate SPRS score.
Tell us about your contracts, the CUI you handle, and your current score if you have one.