Department of Defense Manufacturing – JN White is now NIST SP 800-171 Compliant

NIST Special Publication (SP) 800-171 is the cybersecurity standard that the Department of Defense (DoD) relies on to protect Controlled Unclassified Information (CUI) in non-federal systems. It defines 110 security requirements across 14 control families, along with 320+ assessment objectives that organizations must meet to demonstrate compliance.

Over the past few years, DoD has been building a formal program around these requirements, culminating in the CMMC (Cybersecurity Maturity Model Certification) Final Rule under 48 CFR. That rule was published in the Federal Register on September 10, 2025 and took effect on November 10, 2025, officially launching Phase 1 of the CMMC rollout across the Defense Industrial Base (DIB).

What Phase 1 means for Manufacturers

With Phase 1 in effect, cybersecurity is no longer a “nice to have” for defense manufacturers—it is a contractual condition of doing business with the DoD and its primes.

Manufacturers that handle CUI are now required to:

• Perform structured NIST SP 800-171–based self-assessments aligned with CMMC Level 2
• Maintain an accurate, current System Security Plan (SSP)
• Use a Plan of Action & Milestones (POA&M) to track and remediate any remaining gaps
• Maintain supporting cybersecurity policies and procedures as formal documentation

These elements are the foundation you must have in place to implement and sustain the 110 security requirements.

Many manufacturers are still working to stand up just these starting pieces. As Phase 1 progresses—and additional phases introduce more third-party CMMC certifications—organizations that have not already invested in this work will face increasing pressure and complexity.

Where JN White stands today

JN White has been preparing for this moment for the last two years.

Not only did we move quickly to implement the required CMMC “starting elements” (SSP, POA&M, and formal cybersecurity policies), we also committed to implementing all 110 NIST SP 800-171 requirements across our relevant systems and processes.

As of November 17, 2025, JN White has:

• Implemented all 110 NIST SP 800-171 security requirements
• Completed the associated assessment objectives to validate that implementation
• Established the documentation, monitoring, and remediation processes needed to maintain that posture over time

In other words, we are now fully NIST SP 800-171 compliant for the scope of our DoD-related operations.

Looking ahead to CMMC Level 2 (Phase 2)

This milestone positions JN White strongly for the next stage of the CMMC rollout.

• CMMC Level 2 is built directly on those same 110 NIST SP 800-171 practices.
• In Phase 1, most contractors will perform self-assessments at Level 2 as a condition of award, with a smaller number of contracts requiring third-party C3PAO certification.
• In Phase 2 (beginning November 10, 2026), DoD intends to make CMMC Level 2 certification assessments by an accredited C3PAO the norm for applicable contracts.

Because JN White has already implemented and validated all 110 NIST SP 800-171 security requirements, we are entering this next phase from a position of strength. The remaining work is primarily about undergoing the formal CMMC Level 2 assessment process, rather than scrambling to close major technical and process gaps.

For our DoD prime and subcontractor customers, this means you can have confidence that JN White is aligned with the same cybersecurity standards and compliance expectations that are now embedded in your contracts—and that we are committed to staying ahead of those requirements as they continue to evolve.