CMMC Gap Analysis
- Home
- CMMC Gap Analysis
"Know where you stand before your assessor does"
All 110 NIST 800-171 Controls — Evaluated on Evidence
A CMMC gap analysis from VIS LLC evaluates all 110 NIST SP 800-171 controls against the actual evidence in your environment — not what your SSP says, but what your systems can demonstrate. We assess Active Directory, MFA configuration, logging infrastructure, CUI handling, and access controls to determine your true compliance posture.
We assess your environment as a C3PAO assessor would — looking for technical evidence that each control is actually implemented, not just documented. Most DoD contractors are surprised by the gap between their SSP and their actual control implementation.
Key Features
Evidence-based control evaluation
We evaluate controls against technical evidence — configuration exports, logs, and access control reports — not just SSP documentation.
All 110 NIST 800-171 controls assessed
Every control across all 14 control families is evaluated, not just the high-risk subset.
Risk-ranked gap findings with SPRS impact scores
Each gap is ranked by its impact on your SPRS score so you can prioritize remediation strategically.
Written findings aligned to C3PAO assessment format
Our report mirrors the format a C3PAO assessor will use, so your team knows exactly what to prepare.
Prioritized remediation roadmap
Gaps are sequenced by SPRS impact and implementation effort for the most efficient path to compliance.
SPRS score projection after remediation
We project your post-remediation SPRS score so you can set realistic timelines and contract eligibility expectations.
Ready to get started?
Schedule a free consultation with our CMMC experts.
Frequently Asked Questions
Primary sources
- 32 CFR Part 170: CMMC Program (eCFR)
- NIST SP 800-171 Rev. 2: Protecting CUI in Nonfederal Systems
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
- DoD CIO: Cybersecurity Maturity Model Certification
- NIST SP 800-171A: Assessing Security Requirements for CUI
- NIST SP 800-171 DoD Assessment Methodology, v1.2.1 (PDF)
What is a CMMC gap analysis?
A CMMC gap analysis is a structured assessment that compares your current cybersecurity controls against CMMC Level 2 requirements (aligned to NIST SP 800-171 rev 2). Each of the 110 controls is evaluated against documented evidence — policies, configurations, and screenshots — to identify gaps and quantify the impact on your SPRS score.
What does a CMMC gap analysis deliverable include?
A CMMC gap analysis deliverable typically includes a control-by-control assessment matrix, a risk-ranked list of gaps by SPRS point value, a prioritized remediation roadmap, and a POA&M template for items that cannot be immediately remediated. VIS LLC's gap analysis also includes an SPRS score projection showing before and after scores.
How long does a CMMC gap analysis take?
A CMMC gap analysis for a small-to-midsize DoD contractor typically takes 2–4 weeks from kickoff to final deliverable. The timeline depends on how quickly your team can provide evidence for each control domain. Organizations with documented policies and configurations ready move faster than those building documentation from scratch.
What happens after a CMMC gap analysis?
After a CMMC gap analysis, you receive a prioritized remediation roadmap. VIS LLC can then help with remediation: implementing missing controls as infrastructure as code, developing SSP documentation, and preparing evidence packages for your CMMC assessment, whether you self-assess or use a C3PAO. Many clients move directly into a CMMC readiness consulting engagement.