How is an SPRS score calculated?

By Hugh Donatello, LAN Service Group · Published October 19, 2026 · Updated October 19, 2026

The formula

The score measures what is missing, not what is present. If every one of the 110 security requirements in NIST SP 800-171 Rev 2 is implemented, the score is 110. For each requirement that is not implemented, its weight is subtracted from 110, and the methodology says plainly that this may result in a negative score. Version 1.2.1 of the NIST SP 800-171 DoD Assessment Methodology, dated June 24, 2020, is the document DFARS 252.204-7019 points to, and 32 CFR 170.24 carries the same weights into the CMMC Level 2 Scoring Methodology.

There is no credit for being most of the way there. Apart from the two requirements with partial credit built in, the methodology is not designed to credit partial implementation. Its own example: if the roll-out of multifactor authentication is 75 percent complete and a plan of action is still being worked, 3.5.3 is scored as not implemented. CMMC states the same rule differently. A requirement is Met only when all of its applicable NIST SP 800-171A assessment objectives are satisfied based on evidence in final form, and it is Not Met if any one applicable objective is not satisfied.

The arithmetic is identical for every type of assessment. Annex A of the methodology says scoring for Basic, Medium and High assessments is the same. What differs is who does the work and how much confidence DoD places in the number: a Basic Assessment is the contractor's own self-assessment and carries a confidence level of Low, a Medium Assessment is a DoD review of the System Security Plan, and a High Assessment adds on-site or virtual verification of evidence and demonstrations by DoD assessors.

How the weights are assigned

NIST SP 800-171 does not rank its requirements, but the DoD methodology weights each one by the damage done to the system and to CUI if it is missing. Requirements whose absence could lead to significant exploitation of the network or exfiltration of CUI are worth 5 points. Those with a specific and confined effect, such as exposing only the CUI on a piece of media or a mobile device, are worth 3. All remaining requirements have a limited or indirect effect and are worth 1. Every one of NIST's basic security requirements, the high-level ones the derived requirements depend on, carries 3 or 5 points, except the System Security Plan, which has no point value at all.

The table below is the complete weighting, tallied from the Annex A scoring template and checked against the lists in 32 CFR 170.24. The counts add up to 110. If a gap-assessment spreadsheet you are using does not reproduce these counts, its weights are wrong.

Taking the maximum deduction for every requirement, including 5 for 3.5.3 and 3.13.11, the largest total deduction is 313 points, so the lowest score a company with a System Security Plan can post works out to 110 minus 313, or -203.

The two partial-credit requirements

Multifactor authentication (3.5.3) is usually rolled out to remote and privileged users first, because there are fewer of them and their accounts matter most. The methodology rewards that order: if MFA covers only remote and privileged users, 3 points are subtracted; if no users have MFA, 5 points are subtracted. Full credit needs MFA for local and network access to privileged accounts and for network access to non-privileged accounts, as the requirement is written.

FIPS-validated cryptography (3.13.11) works the same way. If CUI is encrypted but the cryptography is not FIPS-validated, 3 points are subtracted; if there is no encryption, 5 points are subtracted. The methodology is specific about what validated means: using an approved algorithm such as AES is not enough, because the cryptographic module that implements it must itself be validated under FIPS 140. It also notes that this applies where encryption is required to protect CUI, typically outside your protected system, and that cryptography used for other purposes inside the system does not need to be FIPS-validated. Isolated use of non-validated cryptography covered by a plan of action is treated as a temporary deficiency and scored as implemented.

A worked example

Take a hypothetical defense subcontractor with a current System Security Plan and a plan of action for every gap. Most of the 110 requirements are in place, but the self-assessment finds seven gaps, shown in the table. The deductions total 21 points, so the score posted to SPRS is 110 minus 21, or 89 out of 110.

Under DFARS 252.204-7019, which requires a current assessment of not more than 3 years old unless the solicitation sets a shorter period, 89 is a valid score to post; the clause sets no minimum. Under CMMC, 89 clears the 88-point threshold for a Conditional Level 2 (Self) status, but the company still does not qualify, because 32 CFR 170.21 allows only 1-point requirements on a POA&M, plus 3.13.11 when encryption is in place but not FIPS-validated. Four of the seven gaps, 3.5.3, 3.3.5, 3.11.2 and 3.8.8, carry more than 1 point and are not POA&M-eligible.

If the company fixes those four first, its score becomes 110 minus 3 for 3.13.11 and 1 each for 3.4.9 and 3.10.6, or 105. All three remaining gaps are POA&M-eligible and none is on the list of six that can never be deferred, so it can post a Conditional Level 2 (Self) status. It must then close them, confirm the closure in a POA&M closeout self-assessment, and post the results to SPRS with a new affirmation, all within 180 days, reaching 110, or the conditional status expires.

The company and its gaps are illustrative, not a client. The point values and POA&M rules are taken from the DoD Assessment Methodology v1.2.1 and 32 CFR 170.21 and 170.24.

Not applicable, exceptions and adjudications

Some requirements only apply if you allow the thing they control. The methodology's scoring template says not to subtract points for 3.1.12 and 3.1.13 if remote access is not permitted, for 3.1.16 and 3.1.17 if wireless access is not permitted, and for 3.1.18 if mobile devices may not connect. It adds that a company disallowing these should also have a policy and procedure that keeps them from being enabled by accident, or a point should be deducted. Under CMMC, a requirement or objective that does not apply at the time of assessment is Not Applicable and counts the same as Met; the rule's example is public-access system separation (3.13.5) when no publicly accessible systems are in scope. Record a written reason for every not-applicable call.

Two situations are scored as implemented even though something is imperfect. An enduring exception, where remediation is not feasible, such as specialized manufacturing or laboratory equipment, counts as Met when it is described with its mitigations in the System Security Plan. A temporary deficiency, one that arises after implementation or from specific equipment found during roll-out, counts as Met when a plan of action shows reviews and progress. A requirement that is simply not finished yet is not a temporary deficiency. Separately, if the DoD CIO has adjudicated a requirement as not applicable to you, or accepted an alternative measure as equally effective, that adjudication must be in your SSP to be considered, and the requirement is then scored as implemented, under CMMC provided the environment has not changed.

The SSP and plan-of-action rules

The System Security Plan (3.12.4) has no point value because the score cannot exist without it. The assessment is a review of how the SSP says each requirement is met, so the methodology and 32 CFR 170.24 both say that the absence of an SSP results in a finding that an assessment could not be completed due to incomplete information and noncompliance with DFARS 252.204-7012.

A plan of action never raises the score. Unimplemented requirements are scored as not implemented whether or not a plan of action exists. Having no plan of action for your gaps also costs points, because the methodology assesses requirement 3.12.2, developing and implementing plans of action, as not implemented, a 3-point deduction on top of the gaps themselves. CMMC requires a POA&M for every Not Met requirement as well.

What gets posted to SPRS

Only the summary score goes into the Supplier Performance Risk System, never the value of each requirement. For a Basic Assessment under DFARS 252.204-7019, the entry covers the standard assessed, who did the assessment, each System Security Plan and the CAGE codes it covers, the date the assessment was completed, the summary score such as 95 out of 110, and the date you expect to reach 110 based on your plans of action. The methodology says posting a Basic Assessment requires a PIEE account with the SPRS Cyber Vendor role.

For a CMMC Level 2 self-assessment, 32 CFR 170.16 requires at minimum the CMMC level, the CMMC status date, the assessment scope, all CAGE codes in that scope, the overall score such as 105 out of 110, and POA&M usage and compliance status. Final Level 2 (Self) status requires a Met result for every requirement, reached on the first assessment or at POA&M closeout, and a senior official must affirm compliance at each assessment and annually. DFARS 252.204-7020 lets DoD run Medium and High assessments of your systems, and under 32 CFR 170.16, if a DCMA DIBCAC assessment finds you have not achieved or maintained compliance, its results take precedence over your self-assessed status.

Common scoring mistakes

Most wrong scores come from a few habits. Counting a requirement as met because most systems comply, when one applicable objective is still unsatisfied. Counting a POA&M item as met because the fix is scheduled. Marking remote, wireless or mobile requirements not applicable without a policy that keeps those capabilities switched off. Scoring 3.13.11 as fully met because an approved algorithm such as AES is in use when the module is not FIPS-validated, which is a 3-point deduction, or scoring 3.5.3 as met when MFA covers only remote and privileged users. And scoring against NIST SP 800-171 Rev 3, which NIST published in May 2024 with different requirement numbering. NIST withdrew Rev 2 at the same time, but both the DoD methodology and the CMMC rule still score against Rev 2.

An inflated score is not a safe score. The summary number is posted for DoD to rely on, a senior official affirms it under CMMC, and DoD can verify it with a Medium or High assessment. Score strictly against the NIST SP 800-171A objectives, keep the evidence for every Met call in final form, and keep the worksheet that shows how you reached the number, because SPRS holds only the total.

Common follow-up questions

Sources

1. NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020), incl. Annex A Scoring Template
2. 32 CFR 170.24, CMMC Scoring Methodology (eCFR)
3. 32 CFR 170.21, Plan of Action and Milestones requirements (eCFR)
4. 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements (eCFR)
5. DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements
6. DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements
7. NIST SP 800-171 Rev. 2 (CSRC)
8. NIST SP 800-171A, Assessing Security Requirements for CUI (June 2018, CSRC)
9. NIST SP 800-171 Rev. 3 (CSRC)