NIST 800-171 gap assessment
Every requirement reviewed against how your business actually works.
MAXX COMPLIANCE · CMMC
CMMC and NIST 800-171 compliance for defense contractors near Robins AFB
ITVantix helps defense contractors near Robins AFB and across Georgia prepare for CMMC and NIST SP 800-171. Protect your contracts. We assess you against NIST SP 800-171, support your SPRS score, fix the gaps with our own technical team and keep the documentation primes and assessors ask for.
- NIST SP 800-171 gap assessment
- SPRS score support
- SSP & POA&M kept current
- Gaps fixed by our own technicians
What MAXX Compliance includes
From gap assessment to assessment-ready
MAXX Compliance is built on MAXX Care managed IT, so the same team that finds the gaps fixes them.
SPRS score support
Help calculating, documenting and improving your score.
System Security Plan (SSP)
Written, maintained and updated as your environment changes.
POA&M & remediation
Gaps become tickets for our technical team, tracked to completion.
Compliance platform & evidence
Policies, evidence and documents organized in one online repository.
Security awareness training
Training your staff completes and assessors can verify.
Managed security
Endpoint detection and response, monitoring and backup through MAXX Care.
Microsoft 365 guidance
Advice on Microsoft 365 commercial, GCC and GCC High for CUI.
Microsoft 365 consultingMAXX Compliance is available to MAXX Care clients. CMMC certification assessments are performed by an authorized C3PAO; we prepare you for it.
CMMC status
CMMC Phase 2 is paused. Your contract isn't.
The Department of Defense paused CMMC Phase 2 on July 13, 2026. CMMC Phase 1 self-assessments, DFARS 252.204-7012 and NIST SP 800-171 obligations in your contracts still apply, and primes can still ask for your SPRS score.
- Still required: NIST SP 800-171 controls and DFARS 7012 safeguarding.
- Still required: A current SPRS score and self-assessment.
- Use the time: Phase 2 was suspended, not cancelled. Contractors who are ready will be ahead.
What CMMC asks of you
What CMMC level does my business need?
It depends on what you handle. Level 1 covers Federal Contract Information and 15 basic safeguarding requirements. Level 2 covers Controlled Unclassified Information and the 110 requirements in NIST SP 800-171. A free readiness review confirms which applies.
Level 1: Federal Contract Information
For contractors handling Federal Contract Information (FCI) only.
- 15 basic safeguarding requirements
- Annual self-assessment
- Affirmation in SPRS
Level 2: Controlled Unclassified Information
For contractors handling Controlled Unclassified Information (CUI). Most of our defense clients are here.
- 110 NIST SP 800-171 requirements
- System Security Plan (SSP) and POA&M
- SPRS score; self-assessment now, third-party assessment when Phase 2 resumes
Your path to CMMC readiness
How do you get ready for CMMC?
Start with a readiness review of what you handle and which level applies. ITVantix then scores every requirement with an SPRS estimate, our technicians close the gaps while a POA&M tracks progress, and we keep your SSP, evidence and score current year-round.
- 01
Readiness review
What you handle, which level applies and where you stand.
- 02
Gap assessment
All requirements scored, with an SPRS estimate.
- 03
Remediate
Our technicians close the gaps; the POA&M tracks progress.
- 04
Stay ready
SSP, evidence and score kept current year-round.
Buyer's checklist
Questions your prime may ask
Have answers ready before the next questionnaire arrives.
- What is your current SPRS score, and when was it last updated?
- Do you have a System Security Plan covering where CUI lives?
- Is multi-factor authentication enforced for all users?
- Can you show security awareness training records?
- Do you have an incident response plan and a way to report incidents within 72 hours?
- Is your email and file storage appropriate for CUI?
Built for Georgia businesses
Who we help with CMMC
Robins AFB suppliers
Small and mid-sized defense contractors across Middle Georgia.
Aviation and MRO companies
Maintenance, parts and engineering firms handling CUI.
Manufacturers and machine shops
Drawings and specs that fall under CUI rules.
Engineering and professional services
Firms subcontracting on DoD programs.
Better together
CMMC is built on
MAXX CAREFully managed IT: helpdesk, monitoring, security and backup for one predictable monthly cost.MAXX COMPLIANCECMMC, HIPAA, FTC Safeguards and cyber-insurance readiness, built on MAXX Care.MAXX SECURITYCameras, access control and monitored alarms, installed by our own low-voltage team.MAXX AICopilot readiness, AI policies and a free two-hour AI assessment.
Free · One email a week
Get the weekly cybersecurity tip
Not ready for a CMMC readiness review? Get one short, practical tip every week, written for your whole team, not IT people.
- Ransomware
- Stolen laptops
- Remote logins
- Safe file sharing
You're in!
Your first tip is on its way to . If you don't see it soon, check your spam or promotions folder.
Need help before then? Call 478-257-4373
FAQs
CMMC questions, answered
Yes, in part. The Department of Defense paused CMMC Phase 2 on July 13, 2026, which delays the third-party assessment requirement. Phase 1 self-assessments, SPRS scores, DFARS 252.204-7012 and NIST SP 800-171 still apply to contractors handling CUI.
NIST SP 800-171 is the set of security requirements for protecting CUI. CMMC is the program that verifies contractors meet those requirements, through self-assessments and third-party assessments.
The Supplier Performance Risk System (SPRS) score summarizes your NIST SP 800-171 self-assessment, from 110 down to as low as -203. Contracting officers and primes can see it.
No. Certification assessments are performed by an authorized C3PAO. We prepare you: we assess, remediate, document and keep you ready.
It depends on the CUI you handle and your contract requirements. We'll review your situation and explain the options for commercial, GCC and GCC High. More on Microsoft 365 consulting
Yes. MAXX Compliance is built on MAXX Care managed IT, because the same team that finds the gaps needs to be able to fix and monitor them.
Serving the defense industrial base
CMMC help near Robins AFB and across Georgia
Middle Georgia
Office: Warner Robins (HQ)
Warner Robins · Macon · Perry · Byron · Bonaire · Kathleen · Fort Valley · Forsyth · Cordele · Hawkinsville · Milledgeville
Metro Atlanta
Office: Peachtree City & Conyers
Atlanta · Peachtree City · Fayetteville · Newnan · Griffin · Tyrone · Conyers · Covington · McDonough · Stockbridge · Locust Grove · Social Circle · Eatonton
South Georgia
Office: Waycross
Waycross · Douglas · Blackshear · Valdosta · Brunswick · Tifton
Warner Robins is home to our headquarters, minutes from Robins Air Force Base.
Last reviewed by Jerry Bryan, CEO & Visionary
Reviewed against current CMMC and NIST SP 800-171 requirements.
Protect your contracts.
Get a free CMMC readiness review and a clear picture of what applies to you and what to do first.