110 requirements, 14 families
From Access Control to System and Information Integrity. DFARS 252.204-7012 makes implementing them a contract obligation.
NIST SP 800-171 Evidence Tracking
NIST 800-171 evidence,
kept current.
DFARS 252.204-7012 asks you to implement the 110 requirements of NIST SP 800-171. An assessor asks you to prove it, objective by objective. Fettle keeps the evidence behind each requirement on file and on schedule, so the proof exists before anyone asks for it.
110 requirements14 families, Rev 2
800-171A objectivesCoverage per objective
Any past dateWhat was on file
How 800-171 is assessed
Implemented is not the same as provable.
The requirements say what to do. The assessment asks for the record that you did it, and keep doing it.
Assessment objectives
NIST SP 800-171A breaks each requirement into objectives, 3.1.1[a], [b], and so on. An assessor looks for evidence against each one, not just the requirement.
A score on file with DoD
DFARS 252.204-7019 and 7020 require a current assessment score in SPRS. The score is only as good as the evidence behind it.
Where Fettle fits
Evidence for the requirements that recur.
Most 800-171 evidence goes stale on a schedule. Fettle tracks it on that schedule, maps it to the objectives it supports, and keeps a dated history.
Awareness and Training (3.2)
Training records per person, with expiration dates and alerts to them and their manager before anything lapses.
“Periodically” requirements
Assess risk (3.11.1), assess security controls (3.12.1), update the SSP (3.12.4), review logged events (3.3.3): each a recurring review with an owner, a due date, and its evidence on file.
Defined and documented
Many objectives ask whether something is defined or documented. Controlled documents are approved and signed in Fettle, and every approved version is kept exactly as signed.
Coverage by objective
Map reviews and documents to objectives, not just requirements. Coverage shows, family by family, which objectives have an artifact behind them and which don’t.
Shared responsibility
Mark objectives as inherited, shared, or not applicable and name the responsible party, so your own worklist only counts what you own.
Status on any past date
Report on a contract award date, an SPRS submission, or an assessment, from the record as it stood, with an immutable audit log of who changed what.
Rev 2 and Rev 3
Which revision Fettle maps.
NIST published SP 800-171 Rev 3 in May 2024, but DoD has kept DFARS 252.204-7012 and CMMC on Rev 2 through a class deviation. Fettle maps Rev 2, the revision your contracts and assessors use today.
If you need to track something Rev 2 doesn’t cover, a customer requirement or an internal standard, you can define it as a custom framework alongside it.
What Fettle doesn’t do
Fettle is the evidence and personnel layer underneath your other compliance tools, not a replacement for them.
- Fettle does not write your System Security Plan, manage your POA&M, or calculate or submit a SPRS score.
- It does not scan your systems or test technical controls.
- It is not FedRAMP authorized and does not accept CUI. Your CUI stays in the enclave you built for it.
- It never says a requirement is met. It shows whether an artifact is on file; whether that satisfies the requirement is your assessor’s call.
FAQ
Common questions
What Fettle does for NIST 800-171, and where it stops.
Still have a question? Get in touch or book a demo.
Does Fettle calculate our SPRS score?
No. Fettle does not calculate or submit a SPRS score, author your System Security Plan, or manage a POA&M. It keeps the evidence those depend on current and on file, so the score you submit has a record behind it.
Does Fettle cover the 800-171A assessment objectives?
Yes. Every Rev 2 requirement is broken into its 800-171A objectives, using NIST’s own determination-statement text. You map reviews and documents to objectives, and coverage shows which objectives have an artifact on file. Fettle never marks an objective as met; that judgement belongs to your assessor.
Which revision of NIST SP 800-171 does Fettle use?
Revision 2, which is the revision DFARS 252.204-7012 and CMMC Level 2 currently reference. Anything outside Rev 2 can be tracked as a custom framework.
What counts as evidence in Fettle?
A completed recurring review with its evidence files, or a signed controlled document. Each is dated and mapped to the requirements and objectives it supports. Training and certification records are tracked per person, with their own expiration alerts.
Our MSP handles some requirements. How does that work?
Mark the objectives they carry as inherited or shared and name them as the responsible party. Those objectives are shown separately, so your coverage counts only what your organization owns.
Can Fettle store CUI?
No. Fettle is not FedRAMP authorized and does not accept Controlled Unclassified Information. The compliance record it holds, training completions, review cycles, signed procedures, and coverage, is almost never CUI.
Working toward CMMC Level 2?
Level 2 is these same 110 requirements, assessed every three years and affirmed every year. See how Fettle keeps them current between assessments.