Terms / Assessment
NIST SP 800-171A
The companion publication holding the assessment objectives. It is the document an assessor actually works from, so it is the one to read.
Also called 800-171A, SP 800-171A, NIST 800-171A.
Official Source Material
Assessment objective means a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement. Successful implementation of the corresponding CMMC security requirement requires meeting all applicable assessment objectives defined in NIST SP 800-171A Jun2018 (incorporated by reference, see § 170.2) or NIST SP 800-172A Mar2022 (incorporated by reference, see § 170.2).
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
This is the publication your assessment is actually run from.
NIST SP 800-171 states the requirements. NIST SP 800-171A breaks each one into assessment objectives, lettered determination statements that must each be satisfied. An assessor works objective by objective. Reading the requirement alone tells you what to build. Reading the objectives tells you what you will be asked to show.
Every objective must be met, and one missed objective fails the requirement.
This is the detail that changes how you prepare. A requirement with five objectives is five separate things to evidence. AU.L2-3.3.1 is a good one to read that way. Read only the requirement and you will satisfy most of it and miss one objective, which scores the whole requirement as not met. Work from the objectives and the surprise goes away.
The publication also names the methods and the things examined.
Assessors examine documents and configurations, interview people, and test that mechanisms work. Knowing the method tells you what evidence to hold. An objective that will be tested needs a demonstration, not a policy statement. An objective examined needs the document in final form.
Name the objective letter when you argue about a requirement.
Most disagreements between a company and an assessor are really about one objective. Saying that objective [c] of a requirement is met by a specific record moves the conversation faster than discussing the requirement as a whole. Write your plan the same way.
What falls short
- Evidence mapped to requirements but not to objectives. The assessment works at objective level, so the mapping should too.
- A policy that addresses the requirement's title without addressing each determination statement. The statements are the test.
- A demonstration prepared for a requirement that will be examined instead. Match the evidence to the method.
Edge cases
- An objective does not apply to your environment. That is recorded as not applicable, and it is treated as met.
- Your environment satisfies an objective through a provider. Record the inheritance and hold the provider's evidence for that objective.
- A requirement has an organization-defined parameter. You define the value, and the objective then tests against the value you defined.
Over-engineering
- A separate evidence file for every objective. Group evidence naturally and index it by objective instead.
- Recreating the objectives in a spreadsheet by hand. The publication is free, and the identifiers are stable.