Blackstone Advanced Technologies is proud to announce that we are now NIST SP 800-171 compliant. This fall, our team completed a NIST SP 800-171 Rev. 2 self-assessment in accordance with Department of Defense (DoD) requirements, and we maintain compliance with all 110 security controls required to protect Controlled Unclassified Information (CUI).

Our self-assessment has been submitted through the Supplier Performance Risk System (SPRS). For the defense primes, subcontractors and government agencies we serve, it is a clear, verifiable signal of our commitment to protecting customer and government information.

As a woman-owned, ISO 9001:2015 certified custom sheet metal fabricator in Jamestown, New York, we have always held our parts to tight tolerances. Now our cybersecurity is held to the same standard.

Why Being NIST SP 800-171 Compliant Matters for DoD Manufacturers

NIST Special Publication 800-171 is the cybersecurity standard the DoD relies on to protect CUI in non-federal systems. It defines 110 security requirements across 14 control families, from access control and incident response to system and communications protection.

For manufacturers, CUI is part of everyday work: technical drawings, specifications, part models and contract details that flow from customers to the shop floor. DFARS 252.204-7012 requires contractors that handle this information to implement NIST SP 800-171. The DoD's Cybersecurity Maturity Model Certification (CMMC 2.0) program builds directly on those same 110 requirements.

Since Phase 1 of CMMC took effect on November 10, 2025, cybersecurity is no longer a nice-to-have in the defense supply chain. It is a condition of doing business with the DoD and its primes.

Our Path to NIST SP 800-171 and CMMC 2.0 Compliance

At the start of 2026, Blackstone set a clear goal: work toward full NIST SP 800-171 compliance within the year. Getting there took the right partners and a team member willing to own the effort.

• July 2026 – Exostar. We began working with Exostar, a long-standing provider of secure collaboration and compliance solutions for the aerospace and defense supply chain, to structure our compliance effort.
• August 2026 – ZenSecure. As we built out our formal cybersecurity policies and procedures, we partnered with ZenSecure to help develop documentation that reflects how we actually operate.
• Late October / early November 2026 – Assessment complete. We completed our NIST SP 800-171 Rev. 2 self-assessment and submitted our score to SPRS.

Throughout the project, our Systems Administrator took the initiative to lead it from start to finish. That meant coordinating with our partners, implementing technical controls, documenting our environment and keeping every one of the 110 requirements on track. Compliance projects like this succeed when someone inside the company owns them, and we are grateful for that leadership.

What Our NIST SP 800-171 Self-Assessment Covers

Our self-assessment followed the DoD Assessment Methodology and evaluated every one of the 110 NIST SP 800-171 Rev. 2 security requirements across our in-scope systems and processes. As part of that work, Blackstone now maintains:

• A current System Security Plan (SSP) that documents how each requirement is met in our environment
• Formal cybersecurity policies and procedures covering access control, incident response, configuration management, media protection and more
• Continuous security monitoring and documented processes to identify, track and remediate issues
• Employee awareness training so everyone who handles customer information knows their role in protecting it

Our resulting score is posted in the Supplier Performance Risk System (SPRS), where DoD contracting officers and primes can verify it. Compliance is not a one-time event, so we will keep our SSP current and our controls in place as our systems change.

What This Means for Our Customers and Partners

For DoD prime contractors, subcontractors and government buyers, working with a NIST SP 800-171 compliant fabricator reduces risk across your supply chain. When you send us drawings, models or specifications marked as CUI, you can be confident they are handled under the same requirements already written into your contracts.

It also makes us easier to qualify. Our SPRS submission gives your supplier management and compliance teams a verifiable record to review, so you can spend less time on supplier questionnaires and more time moving work forward.

Our industrial and commercial customers benefit too. The same controls that protect defense information also protect your proprietary designs, pricing and production data.

Looking Ahead to CMMC 2.0 Level 2 Certification

CMMC Level 2 is built on the same 110 NIST SP 800-171 requirements we have already implemented and assessed. That puts Blackstone in a strong position for the next stage of the program.

The DoD had planned Phase 2 of the CMMC rollout for November 10, 2026, when third-party Level 2 certification by a C3PAO would become a condition of award for many contracts. In July 2026, the DoD suspended Phase 2 while a reform task force reviews the program. Phase 1 self-assessments, SPRS scores, annual affirmations and DFARS 252.204-7012 all remain in effect.

We see the pause as time to strengthen our program, not slow it down. Whenever third-party certification returns, in its current form or a revised one, our remaining work will be the formal assessment itself rather than closing major gaps. In the meantime, we will keep monitoring our systems, updating our documentation and affirming our compliance every year.

Frequently Asked Questions

What does it mean that Blackstone is NIST SP 800-171 compliant? We have implemented the 110 security requirements in NIST SP 800-171 Rev. 2, completed a self-assessment using the DoD Assessment Methodology and submitted our score to SPRS.

Is Blackstone CMMC certified? CMMC Level 2 certification requires an assessment by an accredited C3PAO. We have completed the NIST SP 800-171 self-assessment that Level 2 is based on and are preparing for formal certification.

What is SPRS? The Supplier Performance Risk System is the DoD application where contractors post their NIST SP 800-171 assessment scores. Contracting officers and primes use it to verify a supplier's cybersecurity posture.

Can Blackstone handle CUI for my project? Yes. Our systems and processes are built to protect Controlled Unclassified Information, including technical drawings and specifications for DoD programs. Contact us to discuss your project's requirements.

Partner With a Secure, Compliant Fabricator

Blackstone Advanced Technologies combines precision custom sheet metal fabrication with the cybersecurity standards today's defense supply chain demands. Whether you are a DoD prime, a subcontractor or an industrial manufacturer, we are ready to protect your information as carefully as we build your parts.

Ready to start your next project? [Request a quote] or [contact our team] to learn how our NIST SP 800-171 compliant processes support your program.