I'm just trying to get a state of the industry feel here. I have two significant clients who we do a lot of work on 800-171. We work together to develop requirements and come up with solutions. They handle the paperwork.

Now, we've got a prospect that wants us to help out. I had a meeting with them and reviewed their documents. The documents consist of the old-school compliance template provided by the gov't (I believe) that has each section numbered and three check boxes "Implemented", "planned" and "not applicable". Many of them are simply checked as implemented. Some refer to a ISO compliance document.

I was wondering if those with more experience with this kind of compliance - is this going to get them anywhere with the gov't / Prime if someone starts asking questions? My thought and limited experience is that you need to document how you're compliant and I'm guessing CMMC will require it....

Any thoughts?