NIST SP 800-171 & CMMC Control Mapping
Last updated: September 9, 2026
1. Overview
To maintain CMMC Level 2 and NIST SP 800-171r2 compliance, Defense Industrial Base contractors must validate third-party applications before introducing them to environments processing Controlled Unclassified Information (CUI). Our audit-ready reports provide the exact evidentiary artifacts a Certified Third-Party Assessor Organization (C3PAO) needs to verify compliance for the controls below.
2. NIST SP 800-171r2 Control Mapping
| Control Family | Control ID | Description | How DigVel Satisfies It |
|---|---|---|---|
| Access Control | AC.L2-3.1.5 | Employ the principle of least privilege. | Dynamic analysis verifies whether the software runs natively in standard User Mode (Ring 3) or demands unnecessary administrative elevation. |
| Configuration Management | CM.L2-3.4.8 | Apply deny-by-default / allow-by-exception (allowlisting). | We provide the technical justification and cryptographic hashes required to safely add an application to your corporate allowlist (WDAC/AppLocker). |
| Configuration Management | CM.L2-3.4.1 | Establish and maintain baseline configurations. | We supply the exact application footprint — file paths, registry keys, child processes — for your System Security Plan (SSP) baseline. |
| Configuration Management | CM.L2-3.4.2 | Establish and enforce security configuration settings. | We cryptographically analyze the digital signatures, certificates, and PKI trust chains of the installer and its dependencies. |
| Configuration Management | CM.L2-3.4.9 | Control and monitor user-installed software. | Outsourcing vetting to us establishes a formal, documented workflow for evaluating user software requests. |
| System & Communications Protection | SC.L2-3.13.1 | Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems. | Sandbox network telemetry maps all outbound/inbound connections, giving you the exact IP/port data to configure host-based firewall rules. |
| System & Information Integrity | SI.L2-3.14.1 | Identify, report, and correct information and system flaws. | Phase 1 (OSINT) evaluates the vendor's Vulnerability Disclosure Program, historical CVEs, and patch velocity. |
| System & Information Integrity | SI.L2-3.14.2 | Provide protection from malicious code at appropriate locations. | Phase 2 (dynamic analysis) detonates the software in an isolated sandbox to hunt for embedded malware, C2 callbacks, and trojanized dependencies. |
| Risk Assessment | RA.L2-3.11.1 | Periodically assess the risk to organizational operations. | Our FOCI (Foreign Ownership, Control, or Influence) and sanctions checks address supply-chain risk from the software developer's geopolitical origin. |
3. FAR 52.204-21 (CMMC Level 1)
Our vetting process also inherently supports FAR 52.204-21 requirements for basic malicious-code protection, since Phase 2 sandbox analysis screens for embedded malware regardless of the CMMC level you're preparing for.
Our reports do not themselves constitute an official CMMC certification — see our Disclaimer and Terms of Service for details.