How SPRS Scores Are Calculated: NIST 800-171 Scoring

The short answer: an SPRS score starts at 110, one point for each NIST SP 800-171 requirement, and loses 5, 3 or 1 point for every requirement that is not fully implemented. The weights come from the DoD’s NIST SP 800-171 DoD Assessment Methodology. Because the deductions add up to more than 110, scores can go negative, as low as -203.

This guide walks through the weights, the two requirements with partial credit, a worked example, what you actually enter in the Supplier Performance Risk System (SPRS), and how the same scoring decides CMMC Level 2 status.

Who needs an SPRS score

Contractors that handle Controlled Unclassified Information (CUI) under DFARS 252.204-7012 must implement NIST SP 800-171. Under DFARS 252.204-7019 and 252.204-7020, they also need a current assessment score in SPRS to be considered for award: not more than three years old, unless the solicitation sets a shorter period. Most contractors post a Basic assessment, which is a self-assessment. Medium and High assessments are carried out by the government.

CMMC Level 2 uses the same 110 requirements and the same weights, set out in the CMMC program rule at 32 CFR 170.24. CMMC Level 1 does not produce a numeric score; see the section on Level 1 below.

The scoring method: start at 110 and subtract

Each of the 110 requirements in NIST SP 800-171 Rev. 2 is either met or not met. For each one not met, subtract its weight:

5 points (44 requirements): the requirements the methodology treats as most likely to lead to exploitation if missing. Examples: 3.1.1 limit system access to authorized users, 3.3.1 create and keep audit logs, 3.6.1 incident handling, 3.11.2 vulnerability scanning, 3.14.1 flaw remediation and 3.14.2 malicious code protection.
3 points (14 requirements): requirements with a significant but more contained effect, such as 3.12.2, having plans of action to correct deficiencies.
1 point (51 requirements): the rest, such as 3.1.8 limiting unsuccessful logon attempts and 3.1.10 session lock.

That accounts for 109 requirements. The 110th, 3.12.4 (the System Security Plan), has no point value. Without an SSP the methodology says the assessment cannot be completed, so there is no score to post.

Add up every weight and you get 313. A company meeting none of the requirements would score 110 − 313 = −203, which is why that number appears as the floor.

The two requirements with partial credit

The methodology does not give partial credit, with two exceptions:

3.5.3 Multifactor authentication: subtract 5 if MFA is not implemented; subtract 3 if it covers remote and privileged users but not general users’ network access.
3.13.11 FIPS-validated cryptography: subtract 5 if CUI is not encrypted; subtract 3 if encryption is used but the cryptographic modules are not FIPS-validated.

Everything else is binary. MFA rolled out to 75% of users is still “not implemented” for scoring, and so is a requirement you plan to fix next quarter. Listing it on a Plan of Action and Milestones (POA&M) does not earn the points back. Two narrow cases are scored as met: a temporary deficiency already being worked under an operational plan of action, and a documented enduring exception. And if you have no plans of action at all, 3.12.2 is not met, which costs another 3 points.

A worked example

A 60-person machine shop handles CUI drawings for a prime. Its self-assessment finds five gaps:

Example self-assessment gaps, the SPRS points each one costs, and whether it can go on a CMMC Level 2 POA&M
Requirement	Points	Can go on a CMMC POA&M?
3.5.3 Multifactor authentication MFA on remote and privileged access, but not on standard users' network logins	−3	No (worth more than 1 point)
3.13.11 FIPS-validated cryptography Encryption in place, but the modules are not FIPS-validated	−3	Yes (the one named exception)
3.6.1 Incident handling capability No documented, tested incident response process	−5	No
3.1.8 Limit unsuccessful logon attempts No account lockout on the VPN	−1	Yes
3.1.10 Session lock Screen lock not enforced on shop-floor workstations	−1	Yes

Score: 110 − 13 = 97. That is the number the shop posts in SPRS for DFARS 252.204-7019, along with the date it expects to reach 110.

For CMMC Level 2, 97 clears the 88-point bar for Conditional status, but that is not enough on its own. Under 32 CFR 170.21, a POA&M may only hold 1-point requirements, plus 3.13.11 when encryption is used but not FIPS-validated. The MFA gap (3 points) and the incident response gap (5 points) have to be closed first. Once they are, the score is 110 − 5 = 105, the remaining three items go on the POA&M, and they must be closed within 180 days.

What you enter in SPRS

DFARS 252.204-7019 lists what a Basic assessment posting must include:

the standard and version assessed (NIST SP 800-171)
the organization that conducted the assessment
for each System Security Plan, the CAGE codes it covers, and a brief description of the architecture if there is more than one SSP
the date the assessment was completed
the summary score, for example 95 out of 110
the date by which you expect to reach 110

The SPRS entry form also asks for the SSP name, version and date, and the assessment scope (enterprise, enclave or contract). The plan of action completion date is required for any score below 110. Results are due in SPRS within 30 days of the assessment, and SPRS flags records older than three years. The SPRS reference guides walk through each screen.

CMMC Level 1 vs. Level 2 entries in SPRS

Level 1 has no numeric score. You record that all 15 FAR 52.204-21 requirements are met, a senior official affirms it, and you redo the self-assessment every year. POA&Ms are never allowed. See the CMMC Level 1 requirements and self-assessment checklist.
Level 2 uses the 110-point score. A score of 110 gives Final status; 88 to 109 with an allowed POA&M gives Conditional status, which lasts 180 days. Level 2 self-assessments are every three years, with an affirmation each year in between.

Common SPRS scoring mistakes

Counting partial implementation as met. Outside 3.5.3 and 3.13.11, partial is zero.
Treating a POA&M as credit. Planned fixes still cost their full weight until they are done.
Posting a score without a current SSP. No SSP means no completed assessment.
Letting the score go stale. A three-year-old score no longer counts as current, and a score that no longer matches your environment is a misrepresentation risk under the False Claims Act.
Scoring the technical requirements from policy alone. Requirements such as 3.11.2 vulnerability scanning and 3.14.1 flaw remediation are worth 5 points each, and the evidence for them is scan results and patch records, not a policy document.

See Your SPRS Score Update as You Close Gaps

Scan Ninja tracks all 110 NIST SP 800-171 requirements, calculates your SPRS score in real time, shows which gaps cost the most points, and backs the technical requirements with evidence from our own AI-native scanner.

Or Book Security Consultation

Frequently asked questions

How is an SPRS score calculated?

Under the NIST SP 800-171 DoD Assessment Methodology, you start at 110, one point for each requirement, and subtract the weight of every requirement that is not fully implemented: 5, 3 or 1 point. Two requirements (3.5.3 multifactor authentication and 3.13.11 FIPS-validated cryptography) can cost either 5 or 3 depending on how much is in place. The System Security Plan requirement (3.12.4) has no point value; without an SSP the assessment cannot be completed at all.

Can an SPRS score be negative?

Yes. Because the weights add up to more than 110, a company that meets none of the requirements would score 110 minus 313, which works out to -203. Negative scores are common in first honest self-assessments.

What is a good SPRS score?

110 means every requirement is met. Under CMMC Level 2, a score of at least 88 (80% of 110) is the minimum for Conditional status, and only certain 1-point requirements can be left open on a POA&M, which must be closed within 180 days. Below 88, or with a higher-value requirement still open, there is no CMMC Level 2 status to claim.

Does CMMC Level 1 have an SPRS score?

No. Level 1 is recorded in SPRS as met or not met for all 15 FAR 52.204-21 requirements, with an annual affirmation and no POA&Ms. The 110-point score applies to NIST SP 800-171, which is what CMMC Level 2 is built on.

How often does an SPRS score have to be updated?

DFARS 252.204-7019 requires a current assessment, meaning not more than three years old unless the solicitation sets a shorter period. CMMC Level 2 self-assessments are also every three years, with an annual affirmation in between. Update the score sooner if your environment or implementation changes materially, because the score is a representation to the government.

Sources

Rules checked November 8, 2026. For CMMC Level 2 readiness with live SPRS scoring, see CMMC 2.0 readiness with Scan Ninja.

How SPRS Scores Are Calculated: A NIST 800-171 Scoring Guide