NIST SP 800-171 Gap Analysis
Focused delta assessment between your current control state and the 110 NIST SP 800-171 Rev. 2 requirements.
What this engagement is
A Gap Analysis is sharper and lighter than a full Readiness Assessment. We don't walk every control end-to-end; we focus on the delta — what's in place, what's missing, and what needs uplift to reach a posted SPRS score that survives prime contractor scrutiny.
This is the right engagement when you've already done a self-assessment but want an external expert to confirm or correct your scoring before you post to SPRS. It's also the right engagement when a prime is asking for an updated score on a tight timeline and you don't have the runway for a full Readiness.
The output is a compact deliverable: an SPRS scoring worksheet, a gap inventory, and a remediation roadmap with effort estimates. Built to drop directly into your existing program.
What you get
Deliverables included in the engagement
- Evaluation of all 110 NIST SP 800-171 Rev. 2 requirements
- SPRS scoring worksheet aligned to DoD AM v1.2.1
- Gap inventory with severity and remediation effort estimates
- Remediation roadmap (12-month and accelerated variants)
- Evidence inventory for existing control implementations
How we work
The phases of this engagement
Inventory current controls
Catalog what's in place, what's partial, and what's missing — informed by your existing documentation and self-assessment.
Identify gaps
Pinpoint the specific control objectives that don't meet the bar. Document the why, not just the what.
Prioritize remediation
Rank gaps by SPRS impact, contract risk, and implementation effort. Surface the quick wins.
Deliver report
Compact written report plus 60-minute walk-through with your team. Ready to act on the next day.
Right fit signals
When this engagement is the right call
- You've completed a self-assessment but want it externally verified before you post your SPRS score
- A prime contractor is asking for an updated SPRS score on a 4-6 week timeline
- You implemented controls a year ago and want to confirm they still hold up to scoring
- You need a lighter-weight starting point than a Full Readiness Assessment
Engagement specs
Typical duration
4 – 8 weeks
Engagement model
Fixed-fee
Best precursor to
SSP & POA&M Authoring, Readiness Assessment
— Ready to scope this