CUI boundary and data map
Where CUI arrives, where it's stored, and which people and systems can reach it, drawn on one diagram.
The Problem
Your Prime Wants an SPRS Score and Nobody Has Checked the Controls
It shows up when a prime contractor flows down DFARS clauses, a CMMC requirement appears in a solicitation, or your posted score no longer matches your network.
01 · Boundary
CUI drawings sit on the same drive as everything else.
A defined boundary or enclave keeps controlled files on systems built to protect them.
02 · Score
A perfect score was posted without any assessment.
Each requirement is checked against the SP 800-171A objectives before a score is posted.
03 · MFA
Remote and admin logins work with a password alone.
MFA covers remote, privileged, and network logins, as the requirements expect.
04 · Paperwork
No system security plan exists for the CUI environment.
We write the SSP and POA&M before your score goes into SPRS.
Your prime's supplier portal asks for your SPRS score and the date of your last assessment. Drawings marked CUI arrive by email and sit on a shared drive with everything else. Some engineers log in remotely without MFA, and nobody knows whether the laptops use FIPS-validated encryption. A consultant once posted a perfect score without checking anything. Now CMMC language is showing up in bids, and that old number won't survive an assessor's first interview.
We start by drawing the CUI boundary, so only systems that touch CUI are in scope. Then we score every Revision 2 requirement with the DoD Assessment Methodology and write the system security plan and POA&M. Gaps worth 5 points come first. You post a score you can defend line by line, not one that collapses when someone asks for evidence.
CUI boundary first
Only systems that store, process, or send CUI enter scope, and an enclave can shrink it.
An honest SPRS score
Every requirement scored with the DoD Assessment Methodology, starting from 110 and working down.
SSP and POA&M written
A system security plan and a dated plan of action your prime and assessor can follow.
Our NIST 800-171 Compliance Services Process
From CUI Boundary to a Defensible Score in Five Clear Steps
You approve the CUI boundary, review every scored requirement, and sign off on the SSP and POA&M before anything is posted in SPRS.
We ask which contracts carry DFARS clauses, where CUI arrives, and which systems touch it. You get a written scope and a fixed price. If you only handle Federal Contract Information, not CUI, we'll tell you before we quote.
What's Included
What You Get With a NIST SP 800-171 Assessment
Each engagement covers the CUI boundary, a scored assessment, a requirement checklist, the SSP, a dated POA&M, and the fixes and mock assessment your plan includes.
Compare Options
DeveloperLook vs Managed IT provider vs C3PAO
Your managed IT provider knows your network best, and an authorized C3PAO is the only option for a CMMC certification assessment. Here is where each option fits.
| Feature | DeveloperLookBest fit | Managed IT provider | C3PAO |
|---|---|---|---|
| Scoping | CUI boundary drawn with you | Whole network by default | Reviewed during the assessment |
| Scoring | DoD method, with evidence | Often self-estimated | Formal assessment result |
| SSP and POA&M | Written and dated for you | Rarely written | Reviewed, not written |
| Technical fixes | Highest-weight gaps first | Yes, inside their contract | Not allowed to fix |
| Certification | Prepared for your assessor | Not included | Yes, issues the result |
| Speed to start | Within a week of scoping | Already on site | Booked months ahead |
| Support | 60 days after handover | Ongoing IT support | During the assessment |
| Cost | Fixed price from $1,400 | Monthly IT fee | Separate assessment fee |
DeveloperLook
Managed IT provider
- Scoping
- DeveloperLook: CUI boundary drawn with youManaged IT provider: Whole network by default
- Scoring
- DeveloperLook: DoD method, with evidenceManaged IT provider: Often self-estimated
- SSP and POA&M
- DeveloperLook: Written and dated for youManaged IT provider: Rarely written
- Technical fixes
- DeveloperLook: Highest-weight gaps firstManaged IT provider: Yes, inside their contract
- Certification
- DeveloperLook: Prepared for your assessorManaged IT provider: Not included
- Speed to start
- DeveloperLook: Within a week of scopingManaged IT provider: Already on site
- Support
- DeveloperLook: 60 days after handoverManaged IT provider: Ongoing IT support
- Cost
- DeveloperLook: Fixed price from $1,400Managed IT provider: Monthly IT fee
Projects We've Built
Business Systems and Apps We Have Built
HR, payroll, and IT company platforms we designed and built. Systems like these need the same access, logging, and encryption controls once CUI is involved.
Herile IT Agency Web Design & Development
- Agency
- Website
HR Attendee Attendance App Design & Development
- HR & Staffing
- Dashboard
- Mobile App
Payrole Global Payroll Website Design & Development
- HR & Staffing
- Dashboard
- SaaS Platform
Upsen HR Management App Design & Development
- HR & Staffing
- Dashboard
- Mobile App
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Defense Contractors Trust Us With CUI Work
CUI work carries contract and legal risk if it's done carelessly. These habits keep controlled files protected while we look, and keep your posted score honest.
We avoid touching CUI
Most of our work needs settings and diagrams, not drawings or contracts. When CUI must be seen, we view it on your systems and never keep a copy.
Scores we can defend
We'd rather post a low, honest score than a high one that collapses later. Misstated scores can create False Claims Act risk for your company.
Clear about our role
We're not a C3PAO and never sign assessment results. We prepare you, then support your team while an authorized assessor does its work.
Five-point gaps first
Requirements worth 5 points move your score most and usually close the biggest risks. We fix those before the 1-point paperwork items.
Fixes inside your current IT
We work with the Windows machines, email, and file shares you already run. An enclave is suggested only when it really costs less than securing everything.
Your SSP, your records
The SSP, POA&M, and evidence live in your systems, ready for the next SPRS update. Our accounts are closed at handover, and you get the full list.
Overview
What do NIST 800-171 compliance services include?
DeveloperLook provides NIST 800-171 compliance services for defense contractors that handle CUI. We draw the CUI boundary, score all 110 Revision 2 requirements with the DoD Assessment Methodology, write the SSP and POA&M, and fix the highest-weight gaps. Projects start at $1,400 and take 1 to 12 weeks, and we never act as your C3PAO.
DEVELOPERLOOK
Project facts · NIST 800-171 Compliance Services
- Service
- NIST 800-171 compliance services (CUI boundary, scored assessment, SSP, POA&M, fixes)
- Typical timeline
- 1 to 2 weeks for a scored assessment, 6 to 12 weeks with fixes
- Platforms
- Microsoft 365, Windows networks, and Azure or AWS government clouds
- Built with
- SP 800-171A objectives, DoD Assessment Methodology, Entra ID, and Intune
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 60 days of support after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $1,400 USD, fixed scope after a free scoping call
Reviewed 22 Oct 2026 by Saimul Islam
Good fit
Small DoD subcontractors handling CUI
Your prime flowed down DFARS 252.204-7012 and wants your SPRS score, and nobody has ever assessed your Microsoft 365 tenant or file shares.
Manufacturers and machine shops
Your shop receives drawings marked CUI by email, and you need NIST 800-171 compliance without rebuilding every computer on the floor.
Contractors bidding on CMMC Level 2 work
Your next bid carries CMMC Level 2 language, and you want an independent NIST 800-171 compliance consultant to test your readiness first.
IT managers with an outdated score
You posted a score years ago, the network has changed since, and you need the NIST 800 171 controls fixed in the order that raises it most.
MSPs serving defense contractors
Your defense clients need SSPs and POA&Ms written, and you need a partner who produces them quietly under your brand.
Not a fit
Need a C3PAO assessment
You need a CMMC Level 2 certification assessment itself. Only an authorized C3PAO can perform it, so we prepare you and support your team while it happens.
Data is health records
Your sensitive data is patient health information, not CUI. Our HIPAA compliance services page covers the risk analysis and safeguards that apply instead.
Commercial buyers want SOC 2
Your commercial customers want a SOC 2 report rather than DoD paperwork. Our SOC 2 compliance services page covers that readiness work.
Budget under $1,400
Your budget is under $1,400 and you only handle Federal Contract Information, not CUI. The 15 basic safeguards of FAR 52.204-21 and a Level 1 self-assessment may be enough.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for NIST 800-171 Compliance Services
These are starting points in USD. Your final price depends on your CUI boundary, your user count, and the gaps to fix, and you get a fixed proposal after a free scoping call.
For small contractors that need an honest SPRS score and a ranked gap list.
$1,400one-time, USD
- Free scoping call and CUI boundary sketch
- All 110 Revision 2 requirements assessed
- SPRS score using the DoD Assessment Methodology
- Gap list ranked by point weight and effort
- Guidance for posting your score in SPRS
- 60 days of support after handover
Recommended
For contractors that need the system security plan and plan of action written.
$3,900one-time, USD
- Everything in Gap Assessment and Score
- System security plan for your CUI environment
- POA&M with owners, milestones, and dates
- Policies and procedures for all 14 families
- CUI data flow diagram and asset inventory
For contractors preparing for a CMMC Level 2 self-assessment or C3PAO assessment.
$7,900one-time, USD
- Everything in SSP and POA&M
- MFA, FIPS-validated encryption, and logging fixed
- Enclave design to shrink the CUI boundary
- Incident reporting runbook for the 72-hour rule
- Mock assessment against SP 800-171A objectives
- Support during your assessment
For Agencies
White-Label NIST 800-171 Work for MSPs and IT Partners
You own the client relationship. We supply the boundary work, scored assessment, SSP, and POA&M under your brand, and join client calls only when you ask. Your defense clients get defensible paperwork without you hiring a compliance specialist.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the client's contracts, CUI sources, and the prime's latest request or deadline.
- Client needs
- You share the details
- Details received
We scope and price
You get a written scope, a document request list, and a fixed price per client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Score, write, hand off
We score the controls, write the SSP and POA&M, and hand them over in your template.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Stay client-facing
You present the score and roadmap while we work under your brand.
Your SSP template
Plans and POA&Ms written in your format, ready for your client's portal.
Evidence-backed scores
Every point in the score traced to a setting, a record, or a document.
Across your client list
Assess one subcontractor or keep several clients' SSPs current each year.
The Right Technology for Your Project
Technology Stack
We secure the Microsoft and cloud tools contractors already run, and assess them with the official DoD and NIST methods rather than a private scoring scheme.
- Microsoft 365 GCC High
Azure Government
AWS GovCloud (US)- Microsoft Intune
- Microsoft Entra ID
- Okta
- YubiKey
- Cisco Duo
- Microsoft Sentinel
- Microsoft Defender for Endpoint
- Wazuh
- BitLocker
- NIST SP 800-171A
- DoD Assessment Methodology
- Microsoft Excel
- Jira
FAQ
Frequently Asked Questions
Straight answers on cost, speed, Revision 2 versus Revision 3, SPRS scoring, and how FedRAMP clouds fit in.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Our NIST 800-171 work starts at $1,400 for a full gap assessment and SPRS score. Writing the system security plan and POA&M moves you to $3,900, and fixing the highest-weight gaps with a mock assessment starts at $7,900. A CMMC certification assessment by a C3PAO, if your contract needs one, is a separate cost.
The quickest route is shrinking the CUI scope first, then fixing the highest-weight gaps. Moving CUI into a small enclave can cut the systems in scope sharply, and 5-point requirements such as MFA move your score most. Our assessment takes 1 to 2 weeks, and the full path usually takes 6 to 12 weeks.
NIST 800-171 is a NIST publication that sets security requirements for protecting Controlled Unclassified Information (CUI) on nonfederal systems. Defense contractors meet it through DFARS clause 252.204-7012. Revision 2 has 110 requirements in 14 families, and DoD contracts still point to that version for now.
In DoD contracts, it is the security baseline for any contractor system that stores, processes, or sends CUI. DFARS 252.204-7012 requires it, DoD's assessment clauses ask for a current score in SPRS, and CMMC Level 2 checks the same 110 requirements. Your contract's clauses decide which assessment applies to you.
Revision 3 is NIST's May 2024 update, which reorganizes the requirements into 17 families and adds organization-defined parameters. DoD still holds contractors to Revision 2 through a class deviation, so SPRS scores and CMMC Level 2 use the 110 Revision 2 requirements. We assess against Revision 2 and note where Revision 3 differs.
NIST 800-171 compliance means every requirement is implemented on the systems that handle CUI, described in a system security plan, and scored honestly. Open gaps go into a POA&M with dates. For DoD work you also post the score in SPRS, and CMMC adds a self-assessment or a third-party check.
Manage it as a program with a named owner and a review calendar, not a one-time project. Update the SSP whenever systems change, review accounts and logs on a schedule, and close POA&M items by their dates. Re-score after major changes and keep your SPRS entry current, because primes check it.
Secure what you already run where you can, rather than replacing everything. Turn on MFA, FIPS-validated encryption, and audit logging in your current Microsoft 365 and Windows setup, then segment the network so CUI systems sit apart. When too many systems touch CUI, a separate enclave is often cheaper than securing them all.
No, a FedRAMP Moderate cloud covers only the provider's share of the controls. DFARS 7012 requires clouds holding CUI to meet the FedRAMP Moderate baseline or its equivalent, but DoD holds the contractor responsible, not the provider. Your users, devices, settings, and the customer duties in the provider's responsibility matrix still belong in your SSP.
The SPRS score starts at 110 and subtracts 5, 3, or 1 points for each requirement not met, under the DoD Assessment Methodology. That means the lowest possible score is -203. A missing system security plan means the assessment can't be completed at all, so we write the SSP before any score is posted.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.