Most of the points that sink an SPRS score sit in a small number of technical controls. DCMA DIBCAC's published list of the ten requirements most often found "other than satisfied", drawn from 117 assessments and presented in 2023, is dominated by cryptography, authentication, logging, patching and scanning. These are the controls this service implements.
We design and configure the mechanisms inside your CUI boundary, document them for the SSP, and leave you with evidence an assessor can examine and test.
The DIBCAC top ten, and what we do about each
| Rank | Requirement | Typical cause of failure | Implementation focus |
|---|---|---|---|
| 1 | 3.13.11 FIPS-validated cryptography | Algorithm validated rather than module; FIPS mode not enabled | Select modules with current CMVP certificates and enforce FIPS mode |
| 2 | 3.5.3 Multifactor authentication | Not applied at every required layer or account type | MFA for privileged local and network access and non-privileged network access |
| 3 | 3.14.1 Flaw remediation | No scanner, no patch strategy, no remediation timelines | Patch tooling with defined remediation windows by severity |
| 4 | 3.11.1 Risk assessment | Confused with vulnerability scanning | Documented, periodic risk assessment |
| 5 | 3.11.2 Vulnerability scanning | No scanning program | Authenticated scanning on a defined cadence and on new advisories |
| 6 | 3.3.3 Review logged events | Logged events never defined or reviewed | Defined event list with periodic review |
| 7 | 3.3.4 Alert on logging failure | No notification process | Alerting when log collection stops |
| 8 | 3.3.5 Correlate and report | No SIEM or correlation | Central log platform with correlation rules |
| 9 | 3.6.3 Test incident response | Plan never exercised | Tabletop exercise with recorded results |
| 10 | 3.4.1 Baseline and inventory | Software and firmware missing from inventory | Automated inventory and documented baselines |
Source: DCMA DIBCAC, "Top 10 Other Than Satisfied Requirements", 2023.
FIPS-validated cryptography done properly
Requirement 3.13.11 calls for FIPS-validated cryptography when it is used to protect the confidentiality of CUI. "Validated" refers to the cryptographic module, which must hold a certificate from NIST's Cryptographic Module Validation Program (CMVP) under FIPS 140-2 or FIPS 140-3. An AES-256 algorithm is not enough on its own, and a product that is FIPS-capable but not running in FIPS mode does not satisfy the requirement.
We inventory every place CUI is encrypted — endpoints, servers, VPN, email, backups, cloud services — identify the module in use, record its certificate number, and enable or replace as needed. 3.13.11 is also the only requirement above one point that may sit on a POA&M, and only when encryption exists but is not validated.
MFA at every layer
Requirement 3.5.3 requires multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. The failures we see are almost always about coverage: cloud administrators enrolled but local administrator accounts on servers ignored, VPN protected but the remote desktop gateway behind it not, or service accounts with interactive rights never enumerated.
We build a list of every privileged identity and every network access path, apply MFA to each, and use replay-resistant methods consistent with 3.5.4. See the Identification and Authentication family for the scoring detail.
Logging that someone actually reviews
Three of the ten most-failed requirements are in the Audit and Accountability family, even though it carries only 19 points. Collecting logs is rarely the problem. Defining which events matter, being alerted when collection fails, and correlating events to find suspicious behavior are where programs stop. We define the event list, centralize collection, configure failure alerts and correlation, and set a review cadence that produces records. Detail is on the Audit and Accountability page.
Boundary, cloud and enclave decisions
Technical implementation is cheaper inside a small boundary. Where it makes sense we implement an enclave rather than hardening the whole network, and we confirm that cloud services holding CUI meet the DFARS 252.204-7012 requirement of FedRAMP Moderate or equivalent. The trade-offs, including Microsoft GCC High, are covered in CMMC enclave vs GCC High.
Frequently asked questions
Does BitLocker satisfy 3.13.11?
It can, provided the Windows cryptographic modules in use hold current CMVP certificates and the system is configured to use FIPS-compliant algorithms. Record the certificate numbers as evidence.
Do service accounts need MFA?
Service accounts that cannot log on interactively are usually handled through other controls, but any account with interactive privileged access falls under 3.5.3. Enumerate them before deciding.
How quickly must vulnerabilities be patched?
NIST SP 800-171 requires timely remediation but leaves the timeline to you. Define windows by severity in policy, then show that you meet them.
Can our MSP do the technical implementation instead?
Yes, and many do. What matters is that the MSP understands objective-level requirements and leaves you with documentation and evidence. If your MSP will touch CUI or security tools for in-scope systems, it is also in scope — see the guidance for IT providers and MSPs.