01
Understand the objective
Each of the 320 assessment objectives is broken into the specific questions an assessor will need answered: the mechanism in place, the evidence that shows it, and the result it produces.
How it works
From control language to the work in front of you.
Start with existing client documents, rough notes, or net-new descriptions—a little or a lot. CUiGuide works backward from each assessment objective to organize what is known, identify what is still needed, and draft the work for the lead to review.
Reverse-engineer the requirement
Three moves, repeated across every objective.
NIST SP 800-171 Rev 2 holds 110 requirements. NIST SP 800-171A holds the 320 assessment objectives that prove them. CUiGuide starts at the objective level, because that is the level an assessor works at.
02
Map systems and evidence
Draw the network the way it actually runs. CUI flows, technical safeguards, documents, tickets, logs, and operating records connect to the objectives they support.
03
Prioritize the work
Every objective settles as supported, partial, or an open gap—with the next action, an owner, and the evidence pointer attached. Blocking gaps surface first.
Objective by objective
Every conclusion rests on evidence.
An objective is never marked supported on a hunch. It needs a mechanism that exists, evidence that shows it, and a result the assessor can verify. When one of those is missing, CUiGuide says which one—and turns the missing piece into the next action.
- 320 official assessment objectives
- 110 requirements with draft SPRS points
- Supported, partial, or open—nothing in between
- Blocking gaps flagged before the assessor finds them
110
requirements, each carrying its Annex A point value
320
assessment objectives, word for word from NIST
6
phases from first inventory to mock assessment
1
workspace from scope to SSP package
The client path
Six phases, one workspace.
A client does not need a finished documentation set to begin. Existing files become evidence where they support an objective; descriptions establish the starting point; missing proof becomes visible work. Each phase keeps the next action clear.
- 1
Discovery
Scope the enclave, name the systems, and find where Controlled Unclassified Information enters, lives, and leaves.
- 2
Gap assessment
Work the objectives against real uploads. What is supported and what is missing becomes a prioritized worklist.
- 3
Remediation
Close the gaps that matter first—each worklist item carries its own do-this-next, owner, and evidence pointer.
- 4
Documentation
Draft the SSP section by section, tied to the systems and objectives it describes.
- 5
Evidence
Attach the documents, screenshots, tickets, and records that support each conclusion.
- 6
Mock assessment
Run the objectives one more time before a self-attestation, a mock assessment, or a C3PAO engagement.
See it on your project