Estimate your score
Every requirement starts as Met, so the score starts at 110. Open each family and switch a requirement to Not met if it is not fully in place today. For multi-factor authentication and FIPS-validated encryption you can also choose the partial option, which costs 3 points instead of 5. Be strict: a requirement that is only partly done counts as not met everywhere else.
AC · Access Control (22)no deductions
- 3.1.1Limit system access to authorized users, processes acting for them, and devices.5 pts
- 3.1.2Limit system access to the types of transactions and functions authorized users may run.5 pts
- 3.1.3Control the flow of CUI in line with approved authorizations.1 pt
- 3.1.4Separate the duties of individuals to reduce the risk of malicious activity without collusion.1 pt
- 3.1.5Apply least privilege, including for specific security functions and privileged accounts.3 pts
- 3.1.6Use non-privileged accounts or roles for non-security functions.1 pt
- 3.1.7Prevent non-privileged users from running privileged functions, and log their execution.1 pt
- 3.1.8Limit unsuccessful logon attempts.1 pt
- 3.1.9Show privacy and security notices consistent with CUI rules.1 pt
- 3.1.10Use session lock with pattern-hiding displays after inactivity.1 pt
- 3.1.11Terminate user sessions automatically after a defined condition.1 pt
- 3.1.12Monitor and control remote access sessions.5 pts
- 3.1.13Use cryptography to protect the confidentiality of remote access sessions.5 pts
- 3.1.14Route remote access through managed access control points.1 pt
- 3.1.15Authorize remote execution of privileged commands and remote access to security information.1 pt
- 3.1.16Authorize wireless access before allowing connections.5 pts
- 3.1.17Protect wireless access with authentication and encryption.5 pts
- 3.1.18Control the connection of mobile devices.5 pts
- 3.1.19Encrypt CUI on mobile devices and mobile computing platforms.3 pts
- 3.1.20Verify and control or limit connections to and use of external systems.1 pt
- 3.1.21Limit the use of portable storage devices on external systems.1 pt
- 3.1.22Control CUI posted or processed on publicly accessible systems.1 pt
AT · Awareness and Training (3)no deductions
- 3.2.1Make managers, administrators and users aware of security risks and the applicable policies and procedures.5 pts
- 3.2.2Train personnel to carry out their security-related duties.5 pts
- 3.2.3Provide awareness training on recognizing and reporting insider threats.1 pt
AU · Audit and Accountability (9)no deductions
- 3.3.1Create and keep system audit logs to allow monitoring, analysis, investigation and reporting.5 pts
- 3.3.2Make sure the actions of individual users can be traced to them.3 pts
- 3.3.3Review and update logged events.1 pt
- 3.3.4Alert when an audit logging process fails.1 pt
- 3.3.5Correlate audit record review, analysis and reporting for investigation and response.5 pts
- 3.3.6Provide audit record reduction and report generation.1 pt
- 3.3.7Synchronize system clocks with an authoritative time source for audit time stamps.1 pt
- 3.3.8Protect audit information and logging tools from unauthorized access, change and deletion.1 pt
- 3.3.9Limit management of audit logging to a subset of privileged users.1 pt
CM · Configuration Management (9)no deductions
- 3.4.1Establish and maintain baseline configurations and inventories of systems.5 pts
- 3.4.2Establish and enforce security configuration settings.5 pts
- 3.4.3Track, review, approve or disapprove, and log changes to systems.1 pt
- 3.4.4Analyze the security impact of changes before implementing them.1 pt
- 3.4.5Define, document, approve and enforce access restrictions for changes.5 pts
- 3.4.6Apply least functionality: configure systems to provide only essential capabilities.5 pts
- 3.4.7Restrict, disable or prevent nonessential programs, functions, ports, protocols and services.5 pts
- 3.4.8Apply deny-by-exception (blacklist) or permit-by-exception (whitelist) policy to software.5 pts
- 3.4.9Control and monitor user-installed software.1 pt
IA · Identification and Authentication (11)no deductions
- 3.5.1Identify system users, processes acting for users, and devices.5 pts
- 3.5.2Authenticate users, processes and devices before allowing access.5 pts
- 3.5.3Use multi-factor authentication for local and network access to privileged accounts and network access to non-privileged accounts.5 pts (3 if partial)
- 3.5.4Use replay-resistant authentication for network access to accounts.1 pt
- 3.5.5Prevent reuse of identifiers for a defined period.1 pt
- 3.5.6Disable identifiers after a defined period of inactivity.1 pt
- 3.5.7Enforce minimum password complexity and change of characters for new passwords.1 pt
- 3.5.8Prohibit password reuse for a specified number of generations.1 pt
- 3.5.9Allow temporary passwords for logon only with an immediate change to a permanent password.1 pt
- 3.5.10Store and transmit only cryptographically protected passwords.5 pts
- 3.5.11Obscure feedback of authentication information.1 pt
IR · Incident Response (3)no deductions
- 3.6.1Establish an incident-handling capability: preparation, detection, analysis, containment, recovery and user response.5 pts
- 3.6.2Track, document and report incidents to designated officials and authorities.5 pts
- 3.6.3Test the incident response capability.1 pt
MA · Maintenance (6)no deductions
- 3.7.1Perform maintenance on systems.3 pts
- 3.7.2Control the tools, techniques, mechanisms and personnel used for system maintenance.5 pts
- 3.7.3Sanitize equipment removed for off-site maintenance of any CUI.1 pt
- 3.7.4Check media with diagnostic and test programs for malicious code before use.3 pts
- 3.7.5Require multi-factor authentication for nonlocal maintenance sessions, and end them when done.5 pts
- 3.7.6Supervise the maintenance activities of personnel without required access authorization.1 pt
MP · Media Protection (9)no deductions
- 3.8.1Protect (physically control and securely store) system media containing CUI, paper and digital.3 pts
- 3.8.2Limit access to CUI on system media to authorized users.3 pts
- 3.8.3Sanitize or destroy system media containing CUI before disposal or reuse.5 pts
- 3.8.4Mark media with the necessary CUI markings and distribution limits.1 pt
- 3.8.5Control access to media with CUI and maintain accountability during transport outside controlled areas.1 pt
- 3.8.6Use cryptography to protect CUI on digital media during transport unless otherwise physically safeguarded.1 pt
- 3.8.7Control the use of removable media on system components.5 pts
- 3.8.8Prohibit portable storage devices that have no identifiable owner.3 pts
- 3.8.9Protect the confidentiality of backup CUI at storage locations.1 pt
PS · Personnel Security (2)no deductions
- 3.9.1Screen individuals before authorizing access to systems containing CUI.3 pts
- 3.9.2Protect CUI and systems during and after personnel actions such as terminations and transfers.5 pts
PE · Physical Protection (6)no deductions
- 3.10.1Limit physical access to systems, equipment and operating environments to authorized individuals.5 pts
- 3.10.2Protect and monitor the physical facility and support infrastructure.5 pts
- 3.10.3Escort visitors and monitor visitor activity.1 pt
- 3.10.4Keep audit logs of physical access.1 pt
- 3.10.5Control and manage physical access devices.1 pt
- 3.10.6Enforce safeguarding measures for CUI at alternate work sites.1 pt
RA · Risk Assessment (3)no deductions
- 3.11.1Periodically assess the risk to operations, assets and individuals from operating systems that handle CUI.3 pts
- 3.11.2Scan for vulnerabilities periodically and when new vulnerabilities are identified.5 pts
- 3.11.3Remediate vulnerabilities in line with risk assessments.1 pt
CA · Security Assessment (4)no deductions
- 3.12.1Periodically assess security controls to determine whether they are effective.5 pts
- 3.12.2Develop and carry out plans of action to correct deficiencies and reduce vulnerabilities.3 pts
- 3.12.3Monitor security controls on an ongoing basis.5 pts
- 3.12.4Develop, document, update and maintain a system security plan (SSP).not scored
SC · System and Communications Protection (16)no deductions
- 3.13.1Monitor, control and protect communications at external and key internal system boundaries.5 pts
- 3.13.2Use architectural designs, development techniques and engineering principles that promote security.5 pts
- 3.13.3Separate user functionality from system management functionality.1 pt
- 3.13.4Prevent unauthorized and unintended information transfer through shared system resources.1 pt
- 3.13.5Put publicly accessible system components in subnetworks separated from internal networks.5 pts
- 3.13.6Deny network traffic by default and allow it by exception.5 pts
- 3.13.7Prevent split tunneling for remote devices.1 pt
- 3.13.8Use cryptography to prevent unauthorized disclosure of CUI in transit unless otherwise protected.3 pts
- 3.13.9End network connections at the end of sessions or after inactivity.1 pt
- 3.13.10Establish and manage cryptographic keys.1 pt
- 3.13.11Use FIPS-validated cryptography when it protects the confidentiality of CUI.5 pts (3 if partial)
- 3.13.12Prohibit remote activation of collaborative computing devices and show users when they are in use.1 pt
- 3.13.13Control and monitor the use of mobile code.1 pt
- 3.13.14Control and monitor the use of Voice over Internet Protocol (VoIP).1 pt
- 3.13.15Protect the authenticity of communications sessions.5 pts
- 3.13.16Protect the confidentiality of CUI at rest.1 pt
SI · System and Information Integrity (7)no deductions
- 3.14.1Identify, report and correct system flaws in a timely manner.5 pts
- 3.14.2Provide protection from malicious code at appropriate locations.5 pts
- 3.14.3Monitor security alerts and advisories and act on them.5 pts
- 3.14.4Update malicious code protection mechanisms when new releases are available.5 pts
- 3.14.5Run periodic scans of systems and real-time scans of files from external sources.3 pts
- 3.14.6Monitor systems, including inbound and outbound traffic, to detect attacks and indicators of attack.5 pts
- 3.14.7Identify unauthorized use of systems.3 pts
How the SPRS score works
The Supplier Performance Risk System (SPRS) is where the Department of War (formerly DoD) looks up a supplier's NIST SP 800-171 assessment results. The scoring rule comes from the DoD Assessment Methodology: begin with 110, one point per requirement, then subtract the value of every requirement that is not implemented.
| Point value | How many requirements | What they tend to cover |
|---|---|---|
| 5 points | 44 | Requirements whose absence leaves the network open to exploitation or CUI to theft: access limits, MFA, audit logging, baselines, incident response, malware protection, boundary protection |
| 3 points | 14 | Requirements whose absence has a specific, confined effect: least privilege, encryption on mobile devices, media protection, personnel screening, risk assessment, plans of action |
| 1 point | 51 | Requirements with a limited or indirect effect: session locks, password rules, visitor logs, VoIP and mobile code controls |
| Not scored | 1 | 3.12.4, the system security plan; without it no assessment can be completed |
Add up the values and you get 313 points at stake, so a company that meets none of the requirements scores 110 minus 313, which is -203. Most first assessments land somewhere between those two numbers. The CMMC assessment checklist lists the same 110 requirements by domain if you want to work through them on paper first.
Reading your result
- 110: every requirement is met. Under CMMC that supports a Level 2 Final status once you complete the self-assessment and affirm it.
- 88 to 109: at or above the Conditional floor in 32 CFR 170.21, provided every open item is allowed on a POA&M. The estimator counts the open items that are not allowed, such as any unmet 5-point requirement.
- Below 88: there is still work to do before Conditional status. Start with the 5-point requirements: each one closed moves the score faster than anything else.
- Negative: normal for a first look. It means the basics, such as MFA, logging and configuration baselines, are not in place yet.
Where the score is required
DFARS 252.204-7019 tells a contractor that it needs a current NIST SP 800-171 assessment score in SPRS for each covered contractor information system, and DFARS 252.204-7020 sets out how the Basic (self), Medium and High assessments work, including checking subcontractor scores. The CMMC clause, DFARS 252.204-7021, adds the CMMC status and the annual affirmation on top. See DFARS 7012, 7019, 7020 and 7021 explained for how the four clauses fit together.
The suspension of CMMC Phase 2 on July 13, 2026 did not remove any of this. New requirements may still call for Level 1 (Self) or Level 2 (Self), DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply, and your SPRS entry is still how the government checks your status. The Phase 2 suspension explainer has the details.
How to raise your score
- Write or update the SSP. Without it there is no score. It also forces you to decide the system boundary, which is often the biggest lever on cost.
- Close the 5-point requirements first. MFA, audit logging, baseline configurations, malware protection and incident response are the usual large items.
- Shrink the scope. Keeping CUI in a smaller enclave means fewer systems, users and requirements to evidence.
- Track the rest in a POA&M. Record each open 1-point item with an owner and a date, and update SPRS when your score changes.
If you would rather have a Registered Practitioner walk through the 110 requirements with your team, Galaxy's NIST 800-171 gap assessment typically takes 2 to 3 weeks and ends with a written gap report, a remediation roadmap and an SPRS score estimate you can plan against. See Galaxy's CMMC readiness services for the full picture.
Frequently asked questions
How is an SPRS score calculated?
Under the NIST SP 800-171 DoD Assessment Methodology you start at 110 and subtract the point value of every requirement that is not fully implemented. Each requirement is worth 5, 3 or 1 point, so the lowest possible score is -203. Two requirements, multi-factor authentication (3.5.3) and FIPS-validated encryption (3.13.11), can lose 3 points instead of 5 when they are partly in place.
What is a good SPRS score?
The goal is 110, which means every requirement is met. For CMMC Level 2, a score of at least 88 is the floor for Conditional status, and the remaining gaps must be eligible for a POA&M and be closed within 180 days. A negative score is common at the start and simply shows how much work is left.
Can I post the number from this calculator in SPRS?
No. This page gives an estimate for planning. The score you post comes from your own assessment of each requirement against your system security plan and evidence, entered and affirmed by your company in SPRS.
Why does a missing SSP matter so much?
Requirement 3.12.4, the system security plan, carries no point value, but without a current SSP an assessment cannot be completed at all. Write the SSP first; it is also where you describe how each of the other 109 requirements is met.
Which unmet requirements cannot go on a POA&M?
Under 32 CFR 170.21, a Level 2 POA&M may only hold 1-point requirements, plus 3.13.11 when encryption is used but not FIPS-validated. Requirements 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4 may never be on one. The calculator counts these for you.
How often do I update my SPRS score?
DFARS 252.204-7019 calls for a current assessment, no more than three years old, for each covered system. Under CMMC, a Level 2 self-assessment is repeated every three years and affirmed every year. Update SPRS whenever your score changes materially, for example after you close gaps.
Related CMMC pages
- CMMC assessment checklist: all 110 practices by domain
- NIST 800-171 and CMMC gap assessment service
- The CMMC annual affirmation in SPRS: who signs and when
- DFARS 7012, 7019, 7020 and 7021 explained
- CMMC Level 2: the 110 practices and how to prepare
Talk it through with a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) in Fort Washington, Maryland. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.