SPRS score calculator
Tick every NIST SP 800-171 requirement your shop has not met. The score starts at 110 and drops by each requirement's DoD value, 5, 3 or 1 points, and the box under the tool says which gaps may sit on a POA&M.
The tool: SPRS score calculator
SPRS score calculator, cuideck.com
Score: 91of 110
No Conditional status on these answers
3 points above 88, but 3 gaps may not sit on a POA&M.
Tick each requirement your shop does not meet. Pre-filled with a realistic example; Reset starts at 110.Example only
7 requirements are not fully met, costing 19 points. A Conditional Level 2 (Self) status needs a score of at least 88 and no gap in the second list.
May go on a POA&M (4)
- AC.L2-3.1.10Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.Worth 1 point, so it may go on a POA&M.minus 1
- AC.L2-3.1.21Limit use of portable storage devices on external systems.Worth 1 point, so it may go on a POA&M.minus 1
- AU.L2-3.3.4Alert in the event of an audit logging process failure.Worth 1 point, so it may go on a POA&M.minus 1
- SC.L2-3.13.11Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.Encryption is used but not FIPS-validated: the one 3-point gap the rule lets you plan.minus 3
May not go on a POA&M (3)
- AU.L2-3.3.5Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.Worth 5 points; only 1-point gaps may go on a POA&M.minus 5
- CM.L2-3.4.8Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.Worth 5 points; only 1-point gaps may go on a POA&M.minus 5
- IA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.Worth 3 points; only 1-point gaps may go on a POA&M.minus 3
What an SPRS score is
An SPRS score is the number a defense contractor posts in the Supplier Performance Risk System to show how much of NIST SP 800-171 Rev 2 it has in place. The maximum Level 2 score is 110. Each requirement not met subtracts its value (1, 3 or 5 points) from 110, which may result in a negative score; the lowest the arithmetic allows is −203.
The same sum scores two things. Under the codified DFARS 252.204-7019 and -7020, a contractor bound by 800-171 needs a current assessment, not more than 3 years old, with its summary score posted in SPRS; a Basic Assessment is the contractor's own self-assessment, scored by the DoD Assessment Methodology. Under the current class deviation, the self-assessment route is CMMC Level 1 or 2 (Self), scored by 32 CFR 170.24. We read both scoring texts side by side: every 5-point and 3-point requirement is the same in each. The clause story is in DFARS 7019 and 7020, the SPRS score clauses.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
How to use this calculator
- 01Score the system your SSP describesThe score belongs to one assessment scope: the computers, people and places that handle CUI. Score that boundary, not the whole company.
- 02Tick what is not metOpen each family and tick a requirement only if one or more of its NIST SP 800-171A objectives is not satisfied. Half done is not met.
- 03Answer the two partial-credit questionsMFA (3.5.3) and FIPS encryption (3.13.11) take three answers each, because the rule takes 3 points, not 5, for a partial job.
- 04Read the POA&M check, then copy the tableThe box under the tool sorts every gap into may and may not go on a POA&M. Copy as table pastes all 110 rows into a spreadsheet for your records.
Not sure what each requirement asks for? Work through the NIST SP 800-171 checklist first, then come back with your answers. When the number is ready, the steps to post it are in how to submit your SPRS score. A senior official, the Affirming Official, then affirms it in SPRS after every assessment and annually.
A score of 88 or more does not on its own mean a Conditional status. That turns on which requirements are open, and the next sections show why.
If you already track the requirements in a compliance platform, Vanta vs Drata for CMMC shows which of them work this score out for you. And if the number points to a third-party assessment, the CMMC cost estimator puts DoD's own hours and dollars for it beside your quotes.
How the points are weighted
NIST does not rank its requirements; the DoD Assessment Methodology does. It weights each one by what happens to the network and its CUI when it is missing, and 32 CFR 170.24 carries the same weights into CMMC. Across the 110 requirements there are 313 points to lose, and they are far from even.
| Value | Requirements | Points | What sits there |
|---|---|---|---|
| 5 points | 42 | 210 | Gaps that could let an attacker through or CUI out: 3.1.1 access, 3.8.7 removable media, 3.14.2 malicious code. |
| 3 or 5 | 2 | 10 | MFA (3.5.3) and FIPS encryption (3.13.11): 3 points for a partial job, 5 for none. |
| 3 points | 14 | 42 | Gaps with a confined effect: 3.8.2 media access, 3.1.19 encrypting CUI on phones and laptops. |
| 1 point | 51 | 51 | Everything else: session locks, banners, audit-log protection, collaborative devices. |
| No value | 1 | 0 | The SSP (3.12.4). No SSP, no score. |
The 42 five-point requirements alone hold 210 of the 313 points, about 67 percent. One open five-pointer costs as much as five one-pointers, and none of them may sit on a POA&M. If you have a month, spend it on the five-pointers.
A requirement that does not apply counts as met: 32 CFR 170.24 treats an objective assessed as N/A the same as MET. Annex A of the methodology says the same thing in practice for AC.L2-3.1.12, AC.L2-3.1.13, AC.L2-3.1.16, AC.L2-3.1.17, AC.L2-3.1.18: do not subtract points when the shop allows no remote, wireless or mobile access. Write that ban down as a policy, because the methodology expects one to show the access cannot be switched on by accident.
Worked example: a 40-person machine shop
The tool opens on this shop. It machines parts for two primes, keeps drawings marked CUI on one file server, and has done most of the work. Seven gaps are left. Here is what it found and what each one costs.
| Requirement | What the shop found | Points | POA&M |
|---|---|---|---|
| AC.L2-3.1.10 | Shop-floor PCs never lock; operators share them across shifts. | 1 | Allowed |
| AC.L2-3.1.21 | No written limit on company USB drives used on customers' machines. | 1 | Allowed |
| AU.L2-3.3.4 | Nobody is alerted when the file server stops writing its audit log. | 1 | Allowed |
| AU.L2-3.3.5 | Firewall, server and laptop logs are never reviewed together. | 5 | Not allowed |
| CM.L2-3.4.8 | Any user can install any software; there is no allowlist. | 5 | Not allowed |
| IA.L2-3.5.3 | MFA on the VPN and admin accounts, not on everyday sign-ins. | 3 | Not allowed |
| SC.L2-3.13.11 | Laptops are encrypted, but not with a FIPS-validated module. | 3 | Allowed |
| Score | 110 minus 19 | 91 | No Conditional |
91 clears the 88 line, and that is the trap. 3 of the gaps are worth more than 1 point (AU.L2-3.3.5, CM.L2-3.4.8, IA.L2-3.5.3), so they may not sit on a POA&M, and a Conditional Level 2 (Self) status needs every open gap to be one that may. The encryption gap is different: at 3 points it may still go on the plan, because the rule names it as the one 3-point exception.
Second pass: the shop turns on MFA for every user, writes an allowlist, and starts reviewing its logs together. The score rises to 104, every one of the 4 remaining gaps is allowed on a POA&M, and the result reads Conditional. From the Conditional CMMC Status Date the shop has 180 days to close the plan; if it does not, the status expires. Build the plan with the POA&M template.
Third pass, the one nobody plans for: the SSP is two years out of date and describes a server the shop has since replaced. Without an up-to-date SSP the assessment cannot be completed, so the shop has no score to post at all, whatever the other 109 answers say. Keep the system security plan current before you score anything.
Which gaps may sit on a POA&M
A score is not a status. To hold a Conditional Level 2 status with open items, three tests in 32 CFR 170.21 must all pass, and the calculator runs them on every change. Here they are in the rule's own words.
32 CFR 170.21(a)(2), eCFR, read 2026-10-22(i) The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8;
(ii) None of the security requirements included in the POA&M have a point value of greater than 1 as specified in the CMMC Scoring Methodology set forth in § 170.24, except SC.L2-3.13.11 CUI Encryption may be included on a POA&M if encryption is employed but it is not FIPS-validated, which would result in a point value of 3; and
(iii) None of the following security requirements are included in the POA&M: …
The list in (iii) is the part people miss. Five of its six requirements are worth 1 point, so the point test alone would let them through; the rule bars them by name. Those five are about where CUI goes and who walks past it, and the sixth is the SSP itself.
| Requirement | Name in the rule | Value |
|---|---|---|
| AC.L2-3.1.20 | External Connections (CUI Data) | 1 point |
| AC.L2-3.1.22 | Control Public Information (CUI Data) | 1 point |
| CA.L2-3.12.4 | System Security Plan | No value |
| PE.L2-3.10.3 | Escort Visitors (CUI Data) | 1 point |
| PE.L2-3.10.4 | Physical Access Logs (CUI Data) | 1 point |
| PE.L2-3.10.5 | Manage Physical Access (CUI Data) | 1 point |
One more distinction decides many scores. The rule says “A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement.” But it also says “Temporary deficiencies that are appropriately addressed in operational plans of action … shall be assessed as MET.” The methodology's own examples draw the line: an MFA rollout that is 75 percent done, with a plan still running, is not implemented; FIPS encryption that was in place until a patch broke a module's validation is a temporary deficiency and scores as implemented.
Marking a requirement met because it is “on the POA&M”. A planned fix is still NOT MET and still costs its points. Only something that worked and then slipped, with an operational plan to restore it, scores as met. The background is in what a POA&M is.
Questions about the SPRS score
What is a good SPRS score?
The rule gives two lines. 110 is the only score with nothing left open, and the score for a Final Level 2 (Self) status. 88 is the lowest score at which a Conditional status is possible, and only if every open gap may sit on a POA&M.
The codified DFARS 252.204-7019 asks for a summary score and the date you expect to reach 110; the text we read sets no minimum. A prime or contracting officer may expect more, so ask them in writing.
Can an SPRS score be negative?
Yes. The rule says the subtraction “may result in a negative score”. With every requirement not met at full value the sum reaches −203, the lowest score the methodology's values allow.
Do I send DoD every requirement or just the score?
Just the summary. The 7019 Basic Assessment asks for the “Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement)”, and a CMMC Level 2 (Self) entry asks for the overall score plus whether you use a POA&M. Keep the full table for your own records and for an assessor. The entry itself is covered in how to submit your SPRS score.
Is there an Excel version of the DoD scoring template?
DoD publishes the template as Annex A of the NIST SP 800-171 DoD Assessment Methodology, a PDF. Copy as table on this page gives you the same 110 rows with your answers, values and POA&M calls, tab-separated, so it pastes straight into Excel or Google Sheets.
Does a requirement that does not apply count against me?
No. Under 32 CFR 170.24 an objective assessed as N/A is equivalent to MET. Leave it unticked here, and say in the SSP why it does not apply.
Which revision of NIST SP 800-171 does this score?
Rev 2, the 110-requirement version. DoD binds Rev 2: Part 170 incorporates it and the deviated 7012 clause names “Revision 2”, even though NIST published Rev 3 in May 2024. See CMMC Level 2 requirements for the full list in plain English.