Overview
Knowing your requirements is one thing; meeting them is another. This roadmap walks you through building a compliance program in six phases. It is framework-agnostic but maps cleanly to NIST SP 800-171 and CMMC, which most government contractors must satisfy. Work the phases in order — each builds on the last.
Phase 1 — Scope and Gap Assessment
You can't protect what you haven't mapped.
- Identify your information. Determine whether you handle FCI, CUI, or both, and where it lives — systems, cloud services, email, endpoints, and people.
- Define your boundary. Draw the line around the systems that store, process, or transmit that information. A tight, well-defined boundary is the single biggest lever for reducing cost and effort.
- Assess against the standard. Score your environment against the applicable controls (e.g., the 110 NIST 800-171 Rev 2 requirements). Our **Self-Assessment Checklists** do exactly this.
- Record your score. For DoD work, post an honest summary score in SPRS.
Output: a documented scope, a system boundary, and a gap list.
Phase 2 — Plan of Action and Milestones (POA&M)
Turn your gaps into a plan.
- List each unmet requirement, the planned remediation, the responsible owner, and a target date.
- Prioritize by risk and assessment weight — close the highest-weighted, highest-impact gaps first.
- Treat the POA&M as a living document reviewed on a set cadence.
Output: a prioritized, owned, dated remediation plan.
Phase 3 — Policies and Procedures
Controls need documented intent.
- Write policies that state what you do and why, and procedures that state how.
- Cover the control families: access control, awareness and training, audit and accountability, configuration management, incident response, and the rest.
- Keep them practical — a policy nobody follows is worse than none.
Output: an approved policy and procedure set.
Phase 4 — System Security Plan (SSP)
The SSP is the master document.
- Describe your system boundary and, for each required control, how you implement it (or reference the POA&M if you don't yet).
- Assessors and customers will ask for this first; an accurate, current SSP signals a mature program.
Output: a complete, current SSP.
Phase 5 — Implement, Train, and Test
Make the controls real.
- Deploy the technical controls: MFA, encryption, logging, boundary protection, patch and vulnerability management.
- Train your workforce — most incidents start with people, and training is itself a required control.
- Stand up incident response so you can meet reporting windows (DFARS's 72 hours, plus any agency or CIRCIA obligations). Tabletop-test it.
Output: implemented controls, a trained workforce, a tested IR plan.
Phase 6 — Continuous Monitoring and Assessment
Compliance is a state you maintain, not a project you finish.
- Monitor controls continuously — log review, vulnerability scanning, access reviews.
- Re-assess on a schedule and after major changes; keep your SPRS score current (generally within three years for DoD).
- Prepare for third-party assessment if you handle CUI: plan your CMMC Level 2 C3PAO certification ahead of Phase 2 (November 2026), since assessor capacity is limited.
Output: an evergreen program and assessment readiness.
Putting It Together
Most contractors underestimate Phases 1 and 4 (scoping and the SSP) and overestimate the tooling. Get the boundary tight, document honestly, remediate by risk, and keep certifications truthful — that combination satisfies the requirements and keeps you out of the enforcement crosshairs.
This roadmap is general guidance, not legal advice. Tailor it to your contracts and consult qualified counsel or an assessor for your specific situation.
Related
- Measure your gaps: **Self-Assessment Checklists
- Get the documents: **Templates & Downloads
- Confirm what applies: **Find My Requirements