Quick answer
OptiTech runs 800-171 the way the standard is actually assessed: CUI-bearing systems tagged in the asset inventory define the boundary, the 110 requirements load as controls with continuous verification where possible, the System Security Plan maintains itself from per-requirement implementation statements, and gaps live as findings that export as POA&M entries with owners and dates. Your self-assessment score computes from recorded state, not optimism.
Boundary first, then depth
Tag where CUI lives and the platform enforces consequences: tagged systems get the stricter check set (MFA, encryption at rest and in transit, session controls, audit logging with retention), their vendors surface in the supplier register for flow-down conversations, and anything new touching those systems triggers scope review. Teams that constrain CUI to an enclave see that decision pay off here: fewer tagged assets, fewer controls in anger, cheaper assessment.
The SSP and POA&M without the document grind
The SSP is 800-171's center of gravity and its biggest staleness risk. In OptiTech each requirement carries its implementation statement next to its live verification status, so the exported SSP reflects current reality, and change previews flag which statements an infrastructure change invalidates. Unimplemented requirements become POA&M entries automatically: finding, owner, milestone dates, and closure evidence, in the format assessors and contracting officers expect.
Scoring and affirmation you can defend
The DoD scoring methodology runs on your recorded control states, so the number you post is the number your evidence supports, and the executive affirmation references a timestamped snapshot from the append-only log. When a C3PAO arrives for CMMC Level 2, the same per-requirement evidence serves the assessment through scoped read-only access, and the 800-171 work you did is the CMMC work, one program, both names.
Get a personalized walkthrough of automated compliance for your team. No commitment required.