NIST SP 800-218NIST SP 800-171 Rev 3

NIST SP 800-218 covers 7.2% of NIST SP 800-171 Rev 3

7 of the 97 controls in NIST SP 800-171 Rev 3 are already satisfied by evidence you collected for NIST SP 800-218. 90 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

7.2%
of the target already covered
7
controls evidenced
90
genuine gaps
0
claims rejected in review

What this leaves you to do

NIST SP 800-171 Rev 3 has 97 controls. Holding NIST SP 800-218 already evidences 7 of them, so the work in front of you is 90 controls, not 97, which is 93% of the standard rather than all of it.

That is the whole claim. Every number in that sentence comes from the two counts above it and can be re-derived from the free tools without taking our word for any of it.

In money, using only our numbers. The full report is $299 and names 7 controls of NIST SP 800-171 Rev 3 you do not have to implement again, which is $42.71 per control identified. That arithmetic uses our price and our count and assumes nothing about you.

In your hours, using your assumption. We do not know what a control costs you to implement, so pick the column that looks like your organisation. These are your figures, not our claim.

If a control takes you4 hours8 hours16 hours
the 7 already evidenced are28 hours56 hours112 hours
and the 90 remaining are360 hours720 hours1,440 hours

Multiply by your own rate. We publish no rate because we have not measured yours, and a number built on an invented rate is the kind of claim this platform exists to argue against.

This number is directional. It says how much of NIST SP 800-171 Rev 3 your NIST SP 800-218 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

30 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

03.11 RA (Risk Assessment)2 of 3 evidenced, 1 to do
03.16 SA (System and Services Acquisition)1 of 3 evidenced, 2 to do
03.17 SR (Supply Chain Risk Management)1 of 3 evidenced, 2 to do
03.04 CM (Configuration Management)2 of 10 evidenced, 8 to do
03.14 SI (System and Information Integrity)1 of 5 evidenced, 4 to do
03.01 AC (Access Control)0 of 16 evidenced, 16 to do
03.02 AT (Awareness and Training)0 of 2 evidenced, 2 to do
03.03 AU (Audit and Accountability)0 of 8 evidenced, 8 to do
03.05 IA (Identification and Authentication)0 of 8 evidenced, 8 to do
03.06 IR (Incident Response)0 of 5 evidenced, 5 to do
03.07 MA (Maintenance)0 of 3 evidenced, 3 to do
03.08 MP (Media Protection)0 of 7 evidenced, 7 to do
03.09 PS (Personnel Security)0 of 2 evidenced, 2 to do
03.10 PE (Physical Protection)0 of 5 evidenced, 5 to do
03.12 CA (Security Assessment and Monitoring)0 of 4 evidenced, 4 to do
03.13 SC (System and Communications Protection)0 of 10 evidenced, 10 to do
03.15 PL (Planning)0 of 3 evidenced, 3 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

SP800-218-PW.7.103.04.03argued against and upheld
Configuration Change Control

Reviewing changed source for vulnerabilities is explicit consideration of security when approving a change.

SP800-218-PS.1.103.04.03argued against and upheld
Configuration Change Control

Only authorized contributors changing code, with review and logging, is configuration change control.

SP800-218-PO.4.103.04.03argued against and upheld
Configuration Change Control

Release criteria tied to risk make the approve or disapprove decision explicit.

SP800-218-PW.8.103.04.04argued against and upheld
Impact Analyses

Testing scope tied to feature changes tests changes before they reach deployment.

SP800-218-PW.7.203.04.04argued against and upheld
Impact Analyses

Analysing changed code against secure coding standards is security impact analysis before implementation.

SP800-218-PW.8.203.04.04argued against and upheld
Impact Analyses

Scoped, executed and documented testing validates and documents changes before deployment.

SP800-218-RV.1.103.11.02argued against and upheld
Vulnerability Monitoring and Scanning

Ongoing identification of vulnerabilities in released software with severity confirmed is vulnerability monitoring.

SP800-218-PW.8.103.11.02argued against and upheld
Vulnerability Monitoring and Scanning

Dynamic, fuzz and penetration testing detects vulnerabilities in the software on a defined cadence.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk