What is a cybersecurity risk assessment?

A cybersecurity risk assessment is a structured evaluation of your organization's security environment. It identifies vulnerabilities, threats, and risks, then provides clear recommendations to close the gaps. Our assessments are aligned to frameworks like NIST CSF 2.0.

What does a vCISO do?

A virtual CISO (vCISO) provides executive-level cybersecurity leadership without requiring a full-time hire. This includes security strategy, executive-ready reporting, risk oversight, vendor evaluation, and program development — tailored to your organization's size and maturity.

How is Seven Vector different from an MSSP?

MSSPs focus on security operations and tooling. Seven Vector runs the security program — assessment against the framework, readiness, risk and remediation planning, policy and documentation, evidence organization, and executive reporting. Client teams and providers retain responsibility for technical operations and system changes.

What compliance frameworks do you support?

We support readiness across federal, regulated-industry, enterprise, and privacy frameworks. Each engagement is scoped to the client’s applicable requirements.

What industries do you serve?

We work with organizations across defense contracting, healthcare, technology, financial services, and critical infrastructure — any organization that requires structured cybersecurity consulting and clear security direction.

NIST 800-171 Self-Assessment Scoring Explained: Points and Evidence

Learn how DoD self-assessment scoring works and how to connect each NIST SP 800-171 requirement to evidence, findings, and corrective action.

A NIST SP 800-171 self-assessment scored under the Department of Defense (DoD) NIST SP 800-171 Assessment Methodology starts at 110 points and subtracts weighted values for unmet requirements. An unmet requirement generally costs 1, 3, or 5 points, and a remediation plan does not restore those points until the requirement is met.

The practical task is to connect every requirement to the assessed system, its implementation, and evidence. Your score should follow those findings—not a policy checklist or a target number.

Confirm the revision and assessment method first

The familiar 110-point DoD scoring method evaluates the 110 requirements in NIST SP 800-171 Revision 2. The point assignments come from the DoD assessment methodology, rather than from NIST SP 800-171 itself.

NIST SP 800-171 Revision 3 changes the requirements and their organization. Its publication does not, by itself, replace the revision specified for your contract. Have the contracts lead confirm the applicable contract clauses, revision, and assessment instructions before the security team builds its assessment worksheet.

For a Revision 2 assessment, use the corresponding NIST SP 800-171A assessment procedures published in June 2018. Avoid mixing Revision 3 assessment objectives with Revision 2 scoring.

How the score is calculated

Start at 110. For each requirement found unmet, subtract the value assigned in the DoD methodology. A requirement worth five points produces one five-point deduction, even if several assessment objectives under that requirement fail.

A fully met requirement produces no deduction.
An unmet requirement receives its assigned deduction. Your team does not choose the weight based on its own risk rating.
An incomplete implementation generally remains unmet. Apply partial-implementation treatment only where the methodology explicitly provides it.
The lowest possible score is -203. Negative scores are valid because the available deductions exceed 110 points.

For example, one unmet five-point requirement, one unmet three-point requirement, and one unmet one-point requirement produce a score of 101: 110 − 5 − 3 − 1. A purchasing approval or scheduled repair leaves that score unchanged.

The methodology includes special scoring treatment for multifactor authentication under 3.5.3 and cryptographic protection under 3.13.11. For 3.13.11, encryption that is used but is not FIPS-validated receives a three-point deduction; absence of the required encryption receives a five-point deduction. Follow the methodology’s exact conditions rather than inventing partial credit.

Keep risk priority separate from scoring weight. A one-point gap can still demand urgent attention because of the affected information, exposure, or business process.

Define the system before reviewing evidence

The system owner and security lead should identify where Controlled Unclassified Information (CUI) enters, moves, is stored, and leaves. Include the people, devices, services, and external connections that affect its protection.

Use that boundary to check the system security plan (SSP). Requirement 3.12.4 calls for plans that describe system boundaries, operating environments, implementation of security requirements, and relationships with other systems. Update the SSP when those descriptions no longer match operations.

Evidence must cover the assessed boundary. A configuration export from headquarters says little about an unreviewed remote location. A service provider’s report may support a finding, but the assessor still needs to identify which requirements the provider performs and which your staff performs.

Build an evidence record for every requirement

NIST SP 800-171A provides assessment objectives and examination, interview, and testing methods. Use those objectives to decide what must be demonstrated. A policy shows the stated rule; configuration records and tests show whether that rule is implemented.

The assessor records the requirement number and each applicable assessment objective.
The system or process owner explains the implementation and identifies affected assets, users, or locations.
The evidence owner supplies dated records, configurations, interviews, or test results tied to those objectives.
The assessor records the finding, supporting evidence references, scope gaps, and any deduction.
The remediation owner receives unresolved findings with corrective actions and a target completion date.

A requirement is met when the evidence supports all applicable objectives across its scope. One screenshot rarely establishes that by itself. Record the source, collection date, tested population, and sampling rationale so another reviewer can follow the finding.

What evidence looks like across all 14 requirement families

The examples below show how to connect specific Revision 2 requirements to evidence. They are starting points, rather than a universal checklist. Repeat this mapping for every requirement and its assessment objectives.

Access Control — 3.1.1 limits access to authorized users, processes acting for authorized users, and devices. The access administrator supplies account and device records, approval records, and access settings. The assessor checks that actual access matches authorization, including service accounts.
Awareness and Training — 3.2.2 requires training for assigned information security duties. The training owner maps duties to training and supplies completion records. Check that administrators and other assigned personnel receive training relevant to their security tasks.
Audit and Accountability — 3.3.1 requires creating and retaining audit records needed to monitor, analyze, investigate, and report unauthorized activity. The logging owner supplies event settings, retention settings, and sample records. Test that relevant activity creates usable records.
Configuration Management — 3.4.1 requires maintaining baseline configurations and system inventories. The system administrator supplies approved baselines, inventory records, and update history. Compare representative deployed systems with those records and investigate missing assets or undocumented changes.
Identification and Authentication — 3.5.3 requires multifactor authentication for local and network access to privileged accounts and network access to non-privileged accounts. The identity administrator supplies enforcement settings and account classifications. Test each required access path, including exceptions and bypasses.
Incident Response — 3.6.3 requires testing incident response. The incident response lead supplies exercise scenarios, participation records, results, and identified issues. A written response plan alone does not demonstrate that a test occurred.
Maintenance — 3.7.5 requires multifactor authentication for nonlocal maintenance sessions through external network connections and termination when maintenance ends. The maintenance owner supplies remote-access settings and session records. Observe authentication and verify session termination.
Media Protection — 3.8.3 requires sanitizing or destroying media containing CUI before disposal or release for reuse. The media custodian supplies procedures and completed sanitization or destruction records linked to media identifiers. Check actual disposal and reuse transactions.
Personnel Security — 3.9.2 requires protecting systems containing CUI during and after personnel transfers and terminations. Personnel staff and access administrators supply transfer notices, termination records, and access-change records. Compare event dates with completed protective actions.
Physical Protection — 3.10.1 limits physical access to systems, equipment, and operating environments to authorized individuals. The facilities owner supplies authorization lists and access-control records. Compare current permissions with approved access and inspect entry controls.
Risk Assessment — 3.11.2 requires periodic vulnerability scans and scans when newly identified vulnerabilities affect systems or applications. The vulnerability lead supplies scan schedules, asset coverage, results, and event-triggered scan records. Check for excluded or unreachable assets.
Security Assessment — 3.12.4 requires developing, documenting, and periodically updating SSPs. The system owner supplies the current SSP and review history. The assessor compares its boundary, implementation descriptions, and connections with actual operations.
System and Communications Protection — 3.13.11 requires FIPS-validated cryptography when used to protect CUI confidentiality. The technical owner supplies module validation details, deployed versions, and operating configurations. Match the implementation to the validation; an encryption setting alone is insufficient.
System and Information Integrity — 3.14.1 requires identifying, reporting, and correcting system flaws in a timely manner. The system administrator supplies flaw reports, correction tickets, and verification results. Check elapsed correction time against the organization’s documented expectations.

Turn findings into corrections, then update the score

Requirement 3.12.2 calls for plans of action to correct deficiencies and reduce or eliminate vulnerabilities. Record each gap, affected scope, corrective action, owner, and target date. Link that record to its requirement and evidence.

Work in this order: the assessor documents the gap; the remediation owner implements the correction; the evidence owner collects updated records; the assessor retests the affected objectives. Restore points only after that review supports a met finding.

Before submission, reconcile the score worksheet, SSP, and open remediation records. Have the contracts lead check reporting instructions under applicable clauses, including DFARS 252.204-7019 and 252.204-7020. The client’s senior official signs and submits the self-assessment through the required process.

How Seven Vector helps

We assess your scope, run the self-assessment, and connect findings to evidence. We then help you build corrections and operate the recurring checks that keep records current. Your senior official signs and submits the assessment. Book a 30-minute initial consultation to discuss your NIST SP 800-171 assessment.

Questions

Does a score of 110 mean we have CMMC certification?

A 110 indicates that all scored requirements were assessed as met within the stated scope. CMMC assessment and certification requirements are separate. Check the contract for the required CMMC level and assessment type.

Can we count a requirement as met if a corrective action is scheduled?

A scheduled correction remains an open finding. Keep the deduction until implementation is complete and evidence supports the requirement. A plan of action tracks the correction; it does not replace implementation.

Does every requirement need a separate policy?

No. One policy can address several requirements. Each requirement still needs its own evidence mapping, including technical settings, operating records, or tests where appropriate.

Can we reuse evidence from our service provider?

Yes, when it covers the assessed service, relevant period, and requirement. Document the provider’s tasks and your team’s tasks. Review configurations and records for the parts your organization performs.

Call (888) 753-6725. Calls answered 24/7, 365 days a year.