Security incident? Get immediate help
CompassMSP is a Cyber AB Registered Practitioner Organization. We scope your environment, close the gaps against all 110 NIST SP 800-171 requirements, build the documentation an assessor will ask for, and support you through certification with an independent C3PAO. You walk into the assessment knowing what it will find.
Which of your contracts carry which clauses, whether you hold CUI or only Federal Contract Information, and what level a requiring activity can specify today.
Data identification first, then a boundary you can defend, with the enclave option costed against the full-environment option before any remediation starts.
All 110 NIST SP 800-171 Rev 2 requirements assessed against the 800-171A objectives, with point values, evidence requirements, and POA&M eligibility.
We calculate the score with you and document the basis, because an inflated score carries False Claims Act exposure.
We write it against your assessed environment. It cannot be deferred to a POA&M, so it gets built early and maintained.
Policies tied to the controls they govern and the evidence they produce, rather than a binder nobody operates from.
Sequenced by point value and by what a POA&M will not accept, so the work that qualifies you happens first.
Built within the scoring rules and tracked against the 180-day closeout window so conditional status does not lapse.
Evidence mapped to the objectives it answers, then a full examination rehearsal including interview practice with your team.
We help you shortlist an independent assessor, prepare the in-brief, and stay with you through the examination from your side of the table.
Awareness and role-based training that satisfies the requirement and produces the completion records an assessor will ask for.
Annual affirmation, control monitoring, evidence refresh, and executive reporting, run inside the managed relationship.
Weeks 1-2
Applicability & Scope
We determine which contracts carry which clauses, whether you hold CUI or only Federal Contract Information, and what level applies. Then we draw the boundary and model the enclave option against the full-environment option, so the cost of the program is a decision rather than a surprise.
You receive: a contract and clause register, a CUI data inventory, a scoping decision with cost comparison.
Weeks 3-6
Gap Assessment Against All 110 Requirements
Each requirement is assessed against the NIST SP 800-171A objectives rather than a yes-or-no checklist, because that is how an assessor will examine it. Findings carry the point value, the evidence that would satisfy the objective, and whether the requirement is POA&M eligible.
You receive: a scored gap assessment, your SPRS score with its calculation basis, and a POA&M eligibility map.
Weeks 4-10
Documentation & Remediation
The System Security Plan is authored first, since it cannot be deferred. Policies and procedures follow the controls they govern rather than sitting in a binder. Remediation is sequenced by point value and by the six POA&M exclusions, so the work that qualifies you for a POA&M happens before the work that can sit on one.
You receive: a System Security Plan, the policy and procedure set, a sequenced POA&M, and implemented controls.
Weeks 8-14
Evidence & Assessment Rehearsal
Evidence is organized to the assessment objectives it answers, so an assessor is not hunting through a shared drive. We then run the examination with your team in the room, including interview practice, because most findings come from an answer no one had rehearsed rather than from a missing control.
You receive: a mapped evidence package, a rehearsal findings report, and a remediation list before anyone external sees the environment.
Ongoing
Certification Support + Continuous Evidence
We help you select an independent C3PAO, prepare the in-brief, and support you through the examination. After it, compliance decays quietly as staff and systems change, so annual affirmation sits on a managed calendar, POA&M closeout is tracked against the 180-day window, and control monitoring runs through the same security operations that protect the environment.
You receive: assessor coordination, affirmation management, closeout tracking, refreshed evidence, and executive reporting you can defend.
Registered for readiness and certification support, bound by the Code of Professional Conduct.
Detection, triage, investigation, and containment performed in U.S. facilities by U.S. personnel. No offshore SOC.
Executive-level security leadership for board reporting, policy ownership, and audit defense.
More than 350 professionals supporting regulated organizations nationally.
Cybersecurity Compliance & Risk 4 min read
.gif)
Compliance & Risk Articles 8 min read
Compliance & Risk Events 2 min read
Compliance & Risk Events 2 min read