Your contract now says “NIST.” Here is what that means.
Grant agreements, state contracts and defense contracts now all carry information-security terms. Since 2024, every State of Tennessee contract and grant template carries one. If your nonprofit runs a program on TDHS, TDMHSAS, Health, or other state money and your grant manager has started asking about a NIST audit, SOC 2, or a System Security Plan, this is the page for you. We get you ready, fix what needs fixing, and run the yearly cycle. The independent audit itself is done by a separate firm. Not on a Tennessee grant? Federal, HUD, IRS, health and justice grants carry their own versions, and defense suppliers answer to NIST SP 800-171 and CMMC. The same work answers all of them.
What the State clause actually requires
The term is called Information Technology Security Requirements (State Data, Audit, and Other Requirements). It is not a certificate you buy. It is a list of things your organization has to do and prove, every year, for as long as the grant runs. The headline item is this: hold one of six third-party assurances and keep it current. Five of them are built for software companies. The sixth, an annual independent audit against the NIST SP 800-53 moderate baseline, is the one that fits a nonprofit.
The yearly assurance
Pick one and keep it current for the whole contract.
- ISO 27001, FedRAMP, GovRAMP, SOC 2 Type II, HITRUST, or
- A NIST 800-53 audit by an independent CPA or cyber firm
- Full report plus corrective action plan on request
- Vendor and subcontractor reports on request
How data is handled
Rules that apply to every laptop, inbox, and vendor that touches grant client data.
- Encrypted at rest and in transit
- Stored and administered in the United States
- Copy to the State on request
- Securely destroyed when the contract ends, in writing
Testing and plans
Documents and tests the State or Comptroller can ask to see.
- Annual penetration test and vulnerability assessment
- A System Security Plan describing your controls
- Disaster recovery plan, tested yearly
- Annual review meeting with the State
When something goes wrong
The clock starts the moment you know.
- 24-hour notice to the State's incident response team
- A third-party forensics report if a breach is confirmed
- Corrective action plan within 30 days of any audit finding
- Comptroller may audit your IT controls at any time
Your signed contract is what counts. The State tailors the clause to the data in each grant, so the first thing we do is read your copy.
Not a State of Tennessee grantee? The same rules, in other words
Tennessee's clause is the strictest we see, because it names an audit and a deadline. Most other grants ask for the same protections in their own terms. If your nonprofit takes any of the money below, you already have security obligations, whether or not anyone has asked about them yet.
Federal grants and pass-through money
Federal awards made on or after October 1, 2024, including federal dollars passed through the State or a United Way.
- The rule: take “reasonable cybersecurity and other measures to safeguard information” (2 CFR 200.303(e))
- No framework is named; NIST Cybersecurity Framework 2.0 is the common choice
- Organizations spending $1 million or more in federal awards a year get a Single Audit, which looks at internal controls
HUD homeless programs (HMIS)
Continuum of Care and Emergency Solutions Grant agencies that enter clients into HMIS.
- HUD HMIS security standards, enforced by your local HMIS Lead
- Antivirus and a firewall on every computer used for HMIS
- Screens that lock when idle; encrypted drives wherever client data is stored
- Breaches reported to the HMIS Lead on the local deadline, often 24 hours
IRS VITA and TCE tax sites
Free tax-preparation sites run by nonprofits, United Ways and libraries.
- IRS Publication 4299 safeguarding rules
- A unique login per volunteer; firewall and antivirus on every tax computer
- Encrypted Wi-Fi only (WPA2 with AES or better), never named after the site
- Multi-factor sign-in where offered; devices wiped after the season
Health, recovery and justice programs
Clinics, counseling, recovery housing and reentry programs.
- HIPAA Security Rule for health information
- 42 CFR Part 2 for substance use treatment records
- FBI CJIS Security Policy, built on the NIST 800-53 controls, for criminal justice information
- Cyber insurance and foundation applications asking the same questions
Same work, different names
- The rule itself
- Tennessee: the Information Technology Security Requirements (State Data, Audit, and Other Requirements) term. Elsewhere: data security requirements, safeguarding requirements, security standards or a data use agreement.
- Proof it is done
- Tennessee: an annual independent audit against the NIST SP 800-53 moderate baseline (or ISO 27001, SOC 2 Type II, HITRUST, FedRAMP, GovRAMP). Elsewhere: a security risk assessment, a NIST Cybersecurity Framework assessment, an HMIS or site monitoring visit, a Single Audit, or for defense work a NIST SP 800-171 score in SPRS and a CMMC assessment.
- The written plan
- Tennessee: a System Security Plan. Elsewhere: a written information security program, security policies and procedures, an HMIS security plan, or the System Security Plan NIST SP 800-171 also requires.
- Fixing what is found
- Tennessee: a corrective action plan within 30 days, tracked as a Plan of Action and Milestones. Elsewhere: a corrective action plan, a monitoring findings response, or the same Plan of Action and Milestones under NIST SP 800-171.
- When something goes wrong
- Tennessee: 24-hour notice to the State's incident response team. Elsewhere: breach notice to the HMIS Lead, the IRS, HHS or your funder, each on its own clock, and a 72-hour cyber incident report to DoD under DFARS 252.204-7012.
One readiness assessment can map your controls to every set of rules you are under, so you build and document once. Your signed agreements are what count; we read each one before we tell you what applies.
NIST SP 800-171, DFARS and CMMC for the defense supply chain
Machine shops, fabricators and manufacturers that build to defense or aerospace contracts face the same kind of clause, from the Department of Defense instead of the State. We work in that supply chain ourselves as a machine shop, and our own security program is aligned with NIST SP 800-171, so we know these rules from the shop floor, not just from the regulation.
What applies now
If you handle Controlled Unclassified Information (CUI) or Federal Contract Information on a defense contract.
- DFARS 252.204-7012: safeguard covered defense information and report cyber incidents to DoD within 72 hours
- The 110 requirements of NIST SP 800-171, with your score posted in SPRS
- CMMC Level 1 and Level 2 self-assessments in solicitations and contracts, with yearly affirmations
What is paused
Third-party certification, not the rules underneath it.
- In July 2026 DoD suspended CMMC Phase 2, which would have required Level 2 certification by an authorized assessor (C3PAO)
- DFARS 7012, NIST SP 800-171 and the self-assessments stay in force
- Voluntary C3PAO assessments are still available if a customer asks for one
How we help
The same readiness work as above, aimed at the 800-171 controls.
- Scope the CUI: which machines, drawings, inboxes and people touch it
- Gap assessment, fixes, System Security Plan and Plan of Action and Milestones
- An honest SPRS score and the evidence behind it
- Network segmentation, cameras and door access on the shop floor, from our network team
We prepare you for assessment; we are not a C3PAO and do not issue CMMC certifications. ITAR and export-controlled technical data also has to stay out of reach of foreign persons, so where it is stored and who can open it is part of the scope. Do not send controlled drawings or data through this website.
How we help
- Readiness
- We read your grant contract, map every place client data goes (software, email, files, laptops, phones, paper, partner agencies), decide what can be pulled out of scope, and assess the rest against the NIST 800-53 moderate baseline. You get a gap list in priority order and a one-page letter you can send your grant manager with a dated plan.
- Remediation
- The usual findings for an organization your size: multi-factor sign-in everywhere, managed and encrypted devices, admin accounts separated, logs kept, written policies, security awareness training, an incident response plan with the State's phone number in it, backups tested, and sharing rules in Microsoft 365 or Google Workspace. We do the technical work and write the policies with you.
- System Security Plan
- The document the State can ask for. It describes your system, its boundary, the data in it, and how each control is met, including the ones you inherit from Microsoft, Google, or your software vendor. Anything still open goes on a Plan of Action and Milestones.
- Your software vendors
- We request the evidence the clause needs from your case management and other vendors: their own audit report or questionnaire, penetration test letter, encryption and hosting details, and a data agreement with breach notice and destruction terms. Where a vendor cannot produce it, we document compensating controls so the gap is on paper, not a surprise.
- The independent audit
- Performed by a separate CPA or cybersecurity firm so it stands up to the State and the Comptroller. We help you choose one, hand over the evidence binder, sit in on the fieldwork, and close the findings.
- The yearly cycle
- Managed service: monitoring, evidence kept current, the annual penetration test and disaster recovery test scheduled, the audit re-run, the State review meeting prepared, and the five-day notice sent if a vendor's certification lapses. Managed service plans cover the network side; the compliance cycle is quoted with it.
- Pricing
- Readiness is a fixed fee quoted after a free scoping call. Remediation is quoted from the gap list. The audit firm quotes the audit. The State does not add money for any of this, so we help you check whether the grant budget has a line for it or needs an amendment. If cost is the barrier, ask us anyway; we are working on funded options for small nonprofits.
From the grant manager's email to a clean audit
Scoping call
Send us the contract and tell us who asked and when. We tell you what the clause means for your organization and what it will take. No charge.
Readiness assessment
Data map, gap list against the moderate baseline, and a dated plan. Fixed fee.
Fix and document
We close the gaps with your staff, write the System Security Plan, and build the evidence binder.
Audit and repeat
An independent firm audits. We manage the yearly cycle so next year is a formality.
Before you call
Is a NIST audit a certification we can buy?
No. It is a contract term. The current State of Tennessee contract and grant templates require the grantee to hold one of six third-party assurances and keep it current every year: ISO 27001, FedRAMP, GovRAMP, SOC 2 Type II, HITRUST, or an annual independent audit against the NIST SP 800-53 moderate baseline. For a nonprofit that is not a software company, the NIST audit is the realistic option. The same clause also requires encryption, US-only hosting, an annual penetration test, 24-hour breach notice to the State, a System Security Plan on request, and secure data destruction when the contract ends.
We are a manufacturer, not a nonprofit. Do you handle NIST SP 800-171 and CMMC?
Yes. If you build to defense or aerospace contracts and handle Controlled Unclassified Information, DFARS 252.204-7012 requires the 110 controls of NIST SP 800-171, a score in SPRS, and 72-hour incident reporting to DoD, and CMMC self-assessments are already in contracts. DoD paused the third-party CMMC Level 2 certification phase in July 2026 while it reviews the program, but the underlying rules did not change. We prepare manufacturers for both, from our own experience as a shop in that supply chain whose security program is aligned with NIST SP 800-171; certification assessments are done by an authorized C3PAO. See the defense section.
Do you perform the audit yourselves?
No, and you should not want the same company to do both. We do the preparation: scoping, the gap assessment, the fixes, the System Security Plan and the evidence. The annual independent audit is performed by a separate CPA or cybersecurity firm, and we coordinate it. Keeping the two apart is what makes the audit credible to the State and the Comptroller.
Our case management software says it is HIPAA compliant. Does that cover us?
Usually not by itself. The clause covers your organization and every system that touches grant client data: your email and files, staff laptops and phones, and the vendor platform. Many nonprofit software vendors point to their cloud host's SOC 2 report rather than holding their own, and that leaves a gap your assessment has to document. We request the vendor evidence for you and write it into the plan.
What does it cost?
The readiness assessment is a fixed fee quoted after a free scoping call, and the biggest cost lever is scope, so we work hard to keep grant data in as few places as possible. The independent audit is a separate quote from the audit firm. The State contract does not add money for this, so we help you check whether your grant budget has a line for it or needs an amendment. If cost is the barrier, ask us anyway; we are working on funded options for small nonprofits.
How long does it take?
Scoping and the gap assessment take a few weeks. Remediation depends on what is found and is often six to twelve weeks of steady work alongside your staff. The independent audit follows. If the State's deadline is close, we can produce a dated plan and a readiness letter you can send to your grant manager while the work is underway.
We are not a State of Tennessee grantee. Does this apply to us?
Very likely, under a different name. Federal awards made on or after October 1, 2024 require reasonable cybersecurity measures to safeguard information (2 CFR 200.303(e)), and that includes federal money passed through the State. HUD homeless programs that use HMIS follow HUD's HMIS security standards, IRS VITA and TCE tax sites follow Publication 4299, health and recovery programs follow HIPAA and 42 CFR Part 2, and programs that touch criminal justice information follow the FBI CJIS Security Policy. One readiness assessment can map your controls to every set of rules you are under. See the side-by-side.
Send us the contract
Forward the grant manager's email and the contract, and we will tell you in plain language what it means and what it will take. If it is not something we can help with, we will tell you that instead.
Black Pearl Automation LLC prepares organizations for assessment and manages their security. It does not issue the independent audit opinion the State requires or CMMC certifications; those are performed by separate, authorized firms. Black Pearl Automation LLC is an independent installer and integrator. UniFi, UISP, and Ubiquiti are trademarks of Ubiquiti Inc. We are not affiliated with or endorsed by Ubiquiti Inc.