Implementing NIST SP 800-171 in Five Phases: The SENTRE Method
SENTRE implementation takes you from kickoff to an operating, documented CUI enclave in five phases. ITG installs and configures the enclave, trains your team and manages the enclave from go-live.
How does SENTRE implementation work?
SENTRE implementation runs in five phases: workflow configuration; users, roles and governance; system configuration and CUI workstations; training and monitoring; and documentation and evidence. ITG installs and configures the enclave, trains your team and manages the enclave after go-live.
We did the long build once. ITG’s own environment took more than 10 months, with 4 dedicated IT and business consultants and 5 part-time staff, to implement all 110 NIST SP 800-171 requirements, update ITG’s SPRS record and pass a C3PAO assessment. Your implementation starts from that working environment and its documentation, not from a blank page.
Implementation runs alongside your existing operations. Discovery sets the scope and a project timeline before you commit, and each phase ends with deliverables your team signs off. The Shared Responsibility Matrix shows which requirements ITG, your team or both are responsible for.
| Phase | ITG | Your team | Both |
|---|---|---|---|
| 1. Workflow Configuration | Configures contract, order and inventory workflows | Describes your contract lifecycle, approves workflows | Document CUI data flows, test and sign off |
| 2. Users, Roles & Governance | Configures roles and least-privilege access | Names users, forms the Compliance Management Review Board | Set approval chains and segregation of duties |
| 3. System Configuration & CUI Workstations | Installs the stack, hardens CUI workstations, integrates Active Directory | Provides site access and identity data | Test CUI access permissions end to end |
| 4. Training, Utilization & Monitoring | Trains your team, activates monitoring and alert rules | Completes training, starts using SENTRE as the system of record | Validate incident response procedures |
| 5. Documentation & Evidence | Adapts the SSP, policies and procedures to your enclave | Reviews and takes ownership of the documentation | Validate the SSP against the enclave as built |
| After go-live (managed service) | Maintenance, change management, service desk support, annual control audits | Does its CUI work inside the enclave, keeps records current in CENTRE | Keep the SSP matched to the live enclave |
What are the five phases?
1
Workflow Configuration
Tailor SENTRE workflows to your contract lifecycle
2
Users, Roles & Governance
Define users, roles and responsibilities on least-privilege principles
3
System Configuration & CUI Workstations
Configure the environment and deploy hardened CUI (Controlled Unclassified Information) workstations
4
Training, Utilization & Monitoring
Train your team and activate SENTRE as the system of record
5
Documentation & Evidence
Finalize the SSP and organize evidence for a DCMA or voluntary C3PAO assessment
Phase 1: Workflow Configuration
Tailor SENTRE workflows to your contract lifecycle: recording awards, approving orders and delivery orders, and tracking logistics and inventory. Your business practices stay in place while evidence collection is built into every step.
Phase 1 Deliverables
- Contract award workflow configured
- Delivery order and purchase order workflows configured
- CLIN/SLIN structures mapped
- Logistics and inventory workflows established
- CUI data flows documented
- Workflow validation and testing completed
- User acceptance sign-off on workflows
- Workflow configuration documentation finalized
Phase 2: Users, Roles & Governance
Define users, roles and responsibilities using least-privilege and segregation-of-duties principles. Map job functions to SENTRE roles, establish approval chains, and form a Compliance Management Review Board to govern decisions, risks and continuous monitoring.
Phase 2 Deliverables
- User accounts created and roles assigned
- Least-privilege access controls configured
- Segregation of duties enforced
- Approval chains established
- Compliance Management Review Board formed
- Governance charter documented
- Role-based access control validation completed
- User provisioning procedures documented
Phase 3: System Configuration & CUI Workstations
ITG configures the SENTRE environment, integrates it with Active Directory, tests end-to-end permissions for CUI access, and deploys hardened CUI laptops and workstations with endpoint protection, encryption and secure enclave connectivity.
Phase 3 Deliverables
- SENTRE environment configured
- Active Directory integration completed
- End-to-end CUI access permissions tested
- CUI workstations deployed and hardened
- Endpoint protection activated
- Full-disk encryption enabled on all endpoints
- Secure enclave connectivity validated
- Baseline security configuration documented
Phase 4: Training, Utilization & Monitoring
ITG trains your team for daily operations in the enclave, using the work instructions for CUI contracts, orders, supply chain, invoicing and delivery. SENTRE becomes the system of record for contracts, orders, incidents and changes.
Monitoring goes live: logs, alerts and dashboards, threat detection that notifies your administrator, and regular Compliance Management Review Board reviews.
Phase 4 Deliverables
- User training delivered to all staff
- Training materials created and documented
- SENTRE live as system of record
- System monitoring activated
- Alert rules configured
- Executive dashboards created
- Compliance Management Review Board reviews running
- Incident response procedures validated
Phase 5: Documentation & Evidence
Finalize your System Security Plan (SSP) to match the live enclave and organize evidence by requirement, ready for a DCMA assessment, your CMMC Level 2 (Self) affirmation or a voluntary C3PAO assessment. CMMC documentation →
Phase 5 Deliverables
- System Security Plan (SSP) finalized
- Policies and procedures updated
- Control narratives written
- Evidence package organized
- Audit logs extracted and labeled
- Change records compiled
- Incident records prepared
- Training records organized
- Vulnerability scan results compiled
- Configuration baselines documented
- Evidence review completed
- Assessment briefing package prepared
What changes after go-live?
After go-live ITG manages the enclave: maintenance, change management, hardware and software troubleshooting and service desk support, with annual control audits. Your team runs its CUI work inside the enclave with the work instructions ITG trained it on, and keeps records current in CENTRE.
ITG personnel have no access to your CUI. Managing the hardware and software does not require ITG to open, read or move the CUI your team handles for the Department of War (DoW, also DoD).
Monitoring, logging and evidence collection run inside the enclave, so documentation and daily practice stay matched. When the enclave changes, the change is approved and recorded in CENTRE, and your SSP is updated with it. That is what keeps an affirmation, or a DCMA assessment, resting on the enclave you actually run, not on a document written once for an assessment.
CMMC implementation FAQs
How long does implementation take?
It depends on your contracts, sites and team size. Discovery produces a project timeline before you commit, and the schedule is set around your operational priorities. ITG’s own build took more than 10 months because it started from nothing; yours starts from the environment that build produced.
What does our team do day to day?
Your team runs CUI work inside the enclave with the work instructions ITG trained it on and keeps records current in CENTRE. ITG manages the enclave: maintenance, change management, hardware and software troubleshooting and service desk support, with the SSP kept matched to the live environment.
What evidence exists at the end?
A System Security Plan matched to the live enclave, policies and procedures, control narratives, and records produced by operations: logs, changes, incidents, training and vulnerability scans. The evidence is organized by requirement, so it supports a self-assessment, a DCMA assessment or a voluntary C3PAO assessment.
Does implementation make us compliant?
It delivers an enclave that implements the NIST SP 800-171 requirements, with responsibilities set out in the Shared Responsibility Matrix. Your CMMC status comes from your own affirmation or assessment, and it holds only while daily operations keep matching the documentation. CMMC Level 2 →
Will implementation disrupt operations?
Implementation runs in parallel to your existing operations and rolls out in phases, so no single cutover carries all the risk. The timeline follows your schedule, and staff who do not handle CUI keep working on their current systems throughout the project.
Who sits on the Compliance Management Review Board?
Your organization forms it in Phase 2 to govern decisions, risks and continuous monitoring for the enclave. It usually brings together leadership, contracts, IT and the operations staff who handle CUI. ITG helps set up its charter and review cadence during implementation.
Every implementation starts with Discovery: a no-obligation review of how SENTRE fits your contracts, systems and processes.