SOC 2 + NIST 800-171 Attestation
A SOC 2 examination with an added section testing your controls against NIST SP 800-171 Rev 2, the 110 requirements DoD currently requires under DFARS 252.204-7012 and CMMC Level 2, giving defense and government subcontractors independent evidence behind their SPRS self-assessment.
- Criteria
- Public NIST SP 800-171 Rev 2 text
- Report
- SOC 2 Type I or II with 800-171 section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + NIST 800-171?
Subcontractors under DFARS 252.204-7012
Your prime flows down the clause and wants more than your word that the 110 requirements are met.
SaaS handling CUI for federal contractors
Your platform sits inside a contractor’s CUI boundary, and their assessor will ask what you have.
Companies posting a SPRS score
You have affirmed a score in SPRS. Independent testing behind it matters when a prime or DCMA asks how you got there.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing each control against the 110 requirements across the 14 families of NIST SP 800-171 Rev 2, based on the mapping management prepares
- Test results that reconcile to your System Security Plan and Plan of Action and Milestones, with any open items reported factually
- A summary you can hand to a prime’s supply chain team alongside your SPRS affirmation
What it is not
Not a CMMC certification and not a C3PAO assessment. Only a CMMC Third-Party Assessment Organization authorized by the Cyber AB can assess for a Level 2 certification, and Tang Advisory is not one. This is an independent CPA attestation that provides evidence behind your own 800-171 self-assessment and the affirmation you post in SPRS.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm the CUI boundary, your System Security Plan and the revision your contract names.
- 2
Mapping
You map your controls to the 800-171 Rev 2 requirement families. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
800-171-mapped controls are tested in the same fieldwork as your SOC 2, reconciled to your SSP.
- 4
One report
Signed SOC 2+ report with the 800-171 section.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Prime asking about 800-171?
Schedule a free 30-minute preliminary scope discussion. We will tell you whether a SOC 2 + NIST 800-171 report answers the flow-down or whether a C3PAO assessment is what the contract actually requires.