Defense Cyber & SPRS High-Deduction Screening
Answer 5 high-impact screening questions targeting DoD critical deduction controls. Identify foundational gaps before undergoing a formal 110-control NIST SP 800-171 or CMMC Level 2 assessment.
1. Do you enforce phishing-resistant Multi-Factor Authentication (MFA) on all network and cloud access?
Why this matters: Failing to enforce MFA on privileged and standard access incurs a critical -5 point deduction in DoD SPRS calculations.
2. Is CUI strictly segregated and kept off unencrypted personal devices and commercial cloud tenants?
Why this matters: Commercial cloud tenants (e.g. commercial M365 or Google Workspace) cannot store CUI without DFARS 7012 (c)-(g) incident reporting and FedRAMP Moderate equivalency.
3. Is FIPS 140-2/3 validated cryptography used for all cryptographic protection of CUI in transit and at rest?
Why this matters: Standard commercial SSL/TLS or BitLocker default modes often fail FIPS 140-2 validation requirements.
4. Do you have the forensic capability and DoD DIBNet credentials to submit a cyber incident report within 72 hours?
Why this matters: DFARS 252.204-7012 mandates a 72-hour reporting window directly to DoD DIBNet with 90-day forensic media preservation.
5. Do you possess an active System Security Plan (SSP) that accurately reflects your current operational boundary?
Why this matters: Under DoD Assessment Methodology, an active SSP is the mandatory prerequisite; without it, an assessment cannot be completed or scored.
Evaluate Preliminary Readiness
0 of 5 high-deduction screening factors evaluated.