Aerospace & Defense: CMMC & NIST 800-171 Advisory

The challenge

Paper compliance isn't the same as real compliance.

Pause confusion

Some contractors deprioritized work, though obligations didn't change.

Floor-level gaps

Legacy engineering systems and CUI in unmanaged file-sharing tools.

Affirming official risk

A senior official attests annually to what they may not be able to verify.

Flow-down failures

Subcontractor requirements treated as contract clauses, not verified reality.

Our approach

Separate what changed from what didn't.

01
Benchmark
Assess against all 110 NIST SP 800-171 controls.
02
Map CUI
Trace CUI across engineering, program and subcontractor systems.
03
Review SPRS
Check score methodology and affirmation readiness.
04
Verify Subs
Build a verification process for subcontractors.
05
Prioritize
Sequence remediation by contract risk exposure.

How MALA helps

A roadmap tied to NIST 800-171 control families.

Reality Assessment

Benchmarked against all 110 NIST SP 800-171 controls.

CUI flow mapping

How CUI actually moves, not how the SSP says it does.

SPRS review

Score methodology checked for defensibility.

Affirmation readiness

Monitoring and documentation behind the annual attestation.

Subcontractor verification

Flow-down confirmed as technical reality.

Remediation roadmap

By control family, sequenced by contract risk.

A prime can be compliant on paper and still carry significant risk through unverified subcontractors.

By the numbers

Why this matters now.

110NIST SP 800-171 Rev. 2 controls still in forceDFARS 252.204-7012

Annualaffirmation of continuous compliance by a senior officialDFARS 252.204-7021

July 2026third-party CMMC certification paused; obligations unchangedDoD

$0for your initial assessment. No obligation to move forwardNo-Fee Initial Assessment

Who it's for

Built for the people who own the decision.

Affirming OfficialsEvidence to support what you personally attest to.
Prime ContractorsVerified flow-down across your subcontractor network.
CIO / CISOGaps in engineering and legacy systems found and ranked.
Program ManagementCUI handled correctly across program systems.
SubcontractorsReadiness for what primes and DoD will ask for.

The MALA model

Independent. Paid by providers, never by you.

Our services are sponsored through strategic referral agreements with 430+ technology solutions providers, never billed to you.

Unbiased recommendationsProviders in each category have similar compensation models, so your requirements drive the answer.
Paid only if you move forwardThe selected vendor compensates MALA, and only when you choose a recommended vendor.
No obligationYou are never required to move forward with any recommended vendor.

Common questions

What clients ask first.

Does the CMMC pause change our obligations?

No. The 110 controls, SPRS submission and annual affirmation remain in force.

What does the affirming official requirement mean?

A senior official attests annually to continuous compliance, and must be able to back it up.

Where does flow-down break down?

When it's handled as a contract clause and never verified technically.

Where do gaps really show up?

On the floor: legacy engineering systems, CUI in unmanaged tools and unverified subs.

Engagement at a glance

Standard: All 110 NIST SP 800-171 Rev. 2 controls
Regulations: DFARS 252.204-7012 and 252.204-7021
Deliverable: Roadmap by control family, sequenced by contract risk
Cost to you: No-fee initial assessment. Paid by providers, no obligation

No-fee initial assessment

Request your no-fee CMMC / NIST 800-171 Readiness Assessment. No obligation.

We separate what changed from what didn't, then prioritize your NIST 800-171, SPRS and affirmation gaps by contract risk.

Book a 30-minute call

No fee to you: MALA is paid by the provider only if you move forward with a provider we recommend. No obligation to do so.

CMMC and NIST 800-171 Advisory for Aerospace and Defense CMMC Certification Is Paused. Obligations Are Not.