CMMC Gap Assessment and Gap Analysis

A gap assessment answers one question precisely: against all 110 requirements of NIST SP 800-171 Revision 2, what is actually in place, what is not, and what would it take to close the difference.

It produces a number — your SPRS score under the DoD Assessment Methodology — and, more usefully, an ordering. With 313 points of available deduction spread unevenly across fourteen families, knowing where your points are is worth more than knowing your total.

What we assess against

The 110 requirements, and specifically the 320 assessment objectives in NIST SP 800-171A beneath them. This is the level at which a C3PAO or DIBCAC assessor makes determinations, so it is the level worth measuring yourself at.

It is also why our scores tend to be lower than internal estimates. “We have MFA” is a requirement-level answer; the objectives ask which account types, which access paths, and how enforcement is verified. A client who scores 62 with us and had 88 on their own spreadsheet has not been given bad news — they have been given the 26 points they were going to lose in front of someone with authority.

What you get

• A scored position for every one of the 110 requirements: met, partially met, or not met, with the reasoning recorded.
• Your SPRS score, calculated with the correct 5/3/1 weighting including partial credit on 3.5.3 and 3.13.11.
• A remediation plan ordered by points per unit of effort, so the first work you do moves the number most.
• Eligibility flags showing which gaps may lawfully be deferred to a POA&M and which must be closed. See POA&M eligibility.

Scope comes first

We do not score an environment whose boundary has not been established, because the result would be meaningless. If your scope is not settled, the assessment starts there — tracing where CUI enters, where it comes to rest, and which systems support those. See finding CUI in your environment.

This is also the step where the largest savings appear. A boundary drawn deliberately around an enclave rather than inherited from the whole network changes the cost of everything downstream.

How the work actually runs

The engagement is interview-and-artefact, not questionnaire. A questionnaire returns what someone believes to be true about the environment; an artefact returns what the environment is doing. Where the two disagree, the artefact wins, and the disagreement itself is usually the most valuable finding — it tells you which of your assumptions about your own systems no longer hold.

In practice that means three passes. The first is documentary: policies, existing plans, network diagrams, prior assessments, and any contract language that defines what you receive. The second is technical: configuration exports, group policy, conditional access rules, logging configuration, encryption module validation certificates. The third is conversational, with the people who administer the systems rather than the people who own the compliance budget, because those are frequently different people with different pictures of the same network.

Expect the second pass to produce surprises in two families in particular. Audit and Accountability requirements fail quietly — logs are generated, nobody has established that they are reviewed, and the requirement is about review, not generation. System and Communications Protection fails on cryptography: a module in use, but not one with a current FIPS validation certificate, which is a different claim entirely and one the objectives ask for directly.

What it does not include

We do not remediate during a gap assessment. Mixing the two compromises the finding — an assessor who fixes a control has assessed their own work — and it also removes your ability to decide the sequence. Several remediation items are mutually exclusive in practice: consolidating into an enclave and hardening the existing network are both reasonable answers, and they are not both worth paying for. The assessment exists so that choice is made with the numbers in front of you.

Nor do we issue a certification, because none exists to issue — third-party assessment is currently suspended, and even before the suspension a gap assessment was never a certifying activity. See program status for what is in force.

Where a gap assessment ends

With a plan, not with documentation. If you need the System Security Plan, the POA&M and an evidence package mapped to objectives, that is a readiness assessment — the same scoring work, carried through to the artefacts you can hand to an assessor.

Which one you need depends on where you are. If you have never been scored, start here. If you have a number you do not trust, start here. If you have a number you trust and need the paperwork, go straight to readiness.