CMMC vs NIST 800-171 vs DFARS: How They Fit Together

Current rollout policy

Current policy, checked November 2, 2026: The Department’s CMMC policy suspends Phase II; Phase I self-assessment requirements remain. References to later rollout phases describe the original design, not a current deadline. Verify the applicable solicitation, amendments, and contract before scheduling an assessment.

This guide explains the relationship between all three, provides a side-by-side comparison, helps you determine which requirements apply to your organization, outlines the migration path for organizations already compliant with one framework, and offers guidance on which to prioritize.

For the next operating decision, compare vCISO support for government contractors with CMMC certification timing. Confirm the work included, the evidence you need, and who will own implementation before committing to a provider.

How do CMMC, NIST SP 800-171, and DFARS fit together?

How We Got Here

The story begins with DFARS clause 252.204-7012, introduced in 2017 as a contractual requirement for defense contractors handling CUI.

The problem was enforcement. Under DFARS, contractors self-attested to NIST 800-171 compliance with no independent verification. A DoD Inspector General report found widespread non-compliance despite self-attestation — contractors were claiming compliance without actually implementing the required controls.

CMMC was the DoD's response. Rather than trusting self-attestation, CMMC requires independent assessment by accredited third parties (C3PAOs) for organizations handling CUI. The framework adds verification teeth to the existing DFARS/NIST 800-171 requirements.

The Layered Model

Think of it as three layers:

1. DFARS (Contract Layer) — The legal/contractual obligation. Your DoD contract contains DFARS clause 252.204-7012, which obligates you to protect CUI
2. NIST 800-171 (Control Layer) — The technical standard. Defines the 110 specific security controls you must implement to meet the DFARS obligation
3. CMMC (Verification Layer) — The assessment mechanism. Verifies through independent assessment that you have actually implemented the NIST 800-171 controls

Each layer depends on the one below it. You cannot be CMMC certified without implementing NIST 800-171 controls. You cannot satisfy DFARS without either CMMC certification or NIST 800-171 self-assessment (depending on contract requirements).

Side-by-Side Comparison Table

Do You Need All Three?

The short answer: if you handle CUI as a defense contractor or subcontractor, yes.

Scenario-Based Guidance

You are a prime contractor handling CUI: All three apply. Your contract contains DFARS 252.204-7012. You must implement NIST 800-171 controls. You will need CMMC Level 2 certification (C3PAO assessment) once CMMC requirements appear in your contracts.

You are a subcontractor and CUI flows to your systems: Same as above. The prime contractor is obligated to flow down DFARS requirements to subcontractors who handle CUI.

You are a subcontractor handling only FCI (not CUI): DFARS applies, NIST 800-171 does not (those controls are specifically for CUI), and CMMC Level 1 (17 basic practices, self-assessment) is required.

You provide commercial-off-the-shelf (COTS) products: Generally exempt from DFARS cybersecurity requirements, unless the COTS product is modified or CUI flows through your systems during delivery.

You are an MSP serving defense contractors: If CUI resides in or transits your systems, all three apply to you as well. See our MSP compliance guide for MSP-specific considerations.

Migration Path

If you are already compliant with one of these frameworks, here is what additional work each combination requires:

Already NIST 800-171 Compliant → Adding CMMC Level 2

If your SPRS score is 110 (all controls implemented), the incremental work for CMMC Level 2 is primarily:

• Formalizing documentation to meet C3PAO expectations
• Engaging a C3PAO for the assessment
• Preparing evidence packages for each control
• Addressing any gaps between self-assessed implementation and assessor-verified implementation

Starting from Scratch

If you have no formal compliance program, the recommended sequence is:

1. Build your security program aligned to NIST 800-171 controls (this satisfies DFARS)
2. Calculate and submit your SPRS score
3. Prepare for and undergo CMMC assessment

This consolidated approach is more efficient than treating each framework separately. See our CMMC requirements guide for the full implementation roadmap.

Already SOC 2 or ISO 27001 Certified

Organizations with existing SOC 2 or ISO 27001 certifications have a head start. For a broader perspective on managing multiple frameworks, see our multi-framework compliance strategy.

Which Framework First?

For organizations new to defense contracting, the practical sequence is:

1. DFARS compliance awareness — Understand your contractual obligations
2. NIST 800-171 implementation — Build the technical control foundation
3. SPRS score submission — Report your self-assessed compliance
4. CMMC certification — Engage a C3PAO when contract requirements mandate it

Do not wait for CMMC contract requirements to begin NIST 800-171 implementation. Starting now means you are ready when CMMC clauses appear in your contracts.

This decision framework mirrors the approach we recommend for organizations choosing between SOC 2 and ISO 27001 — start with the framework that addresses your most immediate business need and build from there.

Need help navigating CMMC, NIST 800-171, and DFARS requirements? Contact Agency for a compliance assessment that addresses all three frameworks.

DFARS 252.204-7012 governs safeguarding and incident reporting when it is included in the contract. Read the actual clauses and scope rather than assuming that a certification label replaces contractual duties.