## Executive Summary

**Overview.** This assessment evaluated Mavis’s Machine Shop, a DIB contract manufacturer, against the Protect and Detect functions of NIST CSF 2.0, cross-mapped to SP 800-171 Rev 2 for CMMC Level 2 readiness. Of 33 subcategories, 32 were scored.

**Findings.** Average current maturity is 2.3 against an average target of 3.3, with 24 subcategories below target. Identity and access management is the strongest area (3.3 current); however,  it has the largest gaps in hardware authentication and physical access logging. Adverse event analysis is the weakest (1.2 current against a target of 3). Nine subcategories are two or more levels below target.

**Top Risks.** No centralized log monitoring, undefined incident declaration criteria, and MFA applied only to external access.

**Recommendations.** In order: deploy a SIEM or managed detection service, formalize the incident response plan, extend MFA, and add physical access logging.

**Limitations.** The incident response and BC/DR plans were not provided, and the written policy is dated 2021.