NIST CSF 2.0 and SP 800-171 gap assessments

The NIST Cybersecurity Framework is voluntary and suits organizations of any size or sector that want a structured way to manage cyber risk and report on it to leadership. Many companies adopt it as the backbone of their security program.

NIST SP 800-171 is different: it is a set of security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems, and contracts can make it mandatory. NIST SP 800-53 is the larger control catalog used for federal information systems and by organizations that build or operate systems for federal agencies.

NIST released CSF 2.0 in February 2024. It broadened the framework's audience beyond critical infrastructure and added a sixth function, Govern, alongside Identify, Protect, Detect, Respond and Recover.

Govern covers cybersecurity strategy, roles and responsibilities, policy, oversight and supply chain risk management. If your program was built on CSF 1.1, governance and supplier risk are the areas most likely to need work.

Defense contractors and subcontractors that handle CUI are generally required by their contracts to implement SP 800-171 and to report a self-assessment score to the Department of Defense. The Cybersecurity Maturity Model Certification (CMMC) program, which is being phased into DoD contracts, builds on these requirements.

Our role is readiness: assessing your implementation, helping with your SP 800-171 self-assessment and documentation, and closing gaps. Third-party CMMC certification assessments are performed by authorized assessment organizations, which CyberAccord is not.

We compare your policies, procedures and technical controls with the framework you need, then give you a report that scores each area, explains the risk of each gap and ranks fixes by urgency. After the assessment we can help you remediate and keep your documentation current.