Which of the fourteen control families does my AS9100 QMS already cover?

The Question

"We just finished our AS9100 recertification audit with zero minors. Our consultant wants us to buy a completely separate 'CMMC policy pack' for the 14 NIST 800-171 families. How much of our existing quality system actually maps over to these families? Do we really need to start from scratch?"

The Discipline

You do not need to start from scratch, and you should resist buying a parallel policy universe. If you run a mature AS9100 system, you already possess the operating discipline required for the majority of the NIST 800-171 control families.

NIST SP 800-171 Rev. 2 contains 110 security requirements organized across 14 families. Assessment happens requirement-by-requirement, not family-by-family, using the assessment objectives in NIST SP 800-171A. The family-level map below is the starting pattern; your SSP documents implementation requirement-by-requirement.

The clock is running. SPRS has already become the system of record for DoD’s NIST SP 800-171 and CMMC status evidence. For contracts subject to DFARS 252.204-7019 and 252.204-7020, contractors required to implement NIST SP 800-171 must have a current DoD assessment score posted in SPRS. Under the CMMC acquisition rule effective 10 November 2025, applicable solicitations and contracts may also require current CMMC status, CMMC unique identifiers, and annual affirmations of continuous compliance in SPRS. Phase 1 began 10 November 2025 and includes Level 1 Self and Level 2 Self for applicable contracts. Phase 2 begins one year later and adds Level 2 C3PAO requirements for applicable contracts. Phase 3 begins one year after Phase 2 and expands Level 2 C3PAO requirements to all applicable DoD solicitations and contracts, with Level 3 DIBCAC requirements for applicable higher-risk procurements.

When you map a mature quality system against the 14 families, a consistent pattern emerges:

4 Greens: strong QMS operating leverage. These are families where a mature AS9100 QMS typically provides substantial operating discipline, but still requires CUI-specific language and evidence: Awareness & Training, Personnel Security, Physical Protection, and Incident Response, via CAPA extension.

7 Ambers: QMS discipline exists, but cyber implementation must be added. These are families where AS9100 gives you useful management-system muscle, but not enough control implementation by itself: Access Control, Audit & Accountability, Configuration Management, Maintenance, Media Protection, Risk Assessment, and Security Assessment.

3 Reds: genuinely new or mostly technical capabilities. These are families where the shop should expect new technical tools, managed services, or formal IT/security implementation: Identification & Authentication, System & Communications Protection, and System & Information Integrity. This is where you actually need to spend money on technical capabilities — tools or managed services.

Do not let a consultant convince you that information protection is entirely novel. Map what you have. Extend where necessary. Build only what is missing. The map becomes the outline of your System Security Plan — the document a C3PAO works from, structured by the NIST SP 800-171A assessment objectives with cross-references to your quality manual where the discipline is already in place. Building from your existing QMS strengthens the truthfulness of your SPRS affirmation: the requirements you affirm are the requirements you actually implement and evidence.