Free SPRS Score Calculator
Estimate your NIST SP 800-171 score before you post it. Answer each of the 110 requirements in plain language, watch your score update, and see which gaps cost the most points.
Start the calculator
Estimated SPRS score
-203 / 110
0 of 110 answered (0%). Unanswered requirements count as not met.
See my resultsAnswer for the computers, people and places that handle your CUI (Controlled Unclassified Information, the sensitive government information in your contract). If a requirement truly does not apply, for example you have no Wi-Fi, answer Yes and write down why in your System Security Plan. Your answers are saved in this browser only.
Who can get inAccess Control (AC) · 0 of 22 answered · 54 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.1.1: Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
Official wording
NIST SP 800-171 Rev. 2, 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
Official wording
NIST SP 800-171 Rev. 2, 3.1.3: Control the flow of CUI in accordance with approved authorizations.
Official wording
NIST SP 800-171 Rev. 2, 3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
Official wording
NIST SP 800-171 Rev. 2, 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.
Official wording
NIST SP 800-171 Rev. 2, 3.1.6: Use non-privileged accounts or roles when accessing nonsecurity functions.
Official wording
NIST SP 800-171 Rev. 2, 3.1.7: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
Official wording
NIST SP 800-171 Rev. 2, 3.1.8: Limit unsuccessful logon attempts.
Official wording
NIST SP 800-171 Rev. 2, 3.1.9: Provide privacy and security notices consistent with applicable CUI rules.
Official wording
NIST SP 800-171 Rev. 2, 3.1.10: Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
Official wording
NIST SP 800-171 Rev. 2, 3.1.11: Terminate (automatically) a user session after a defined condition.
Official wording
NIST SP 800-171 Rev. 2, 3.1.12: Monitor and control remote access sessions.
Official wording
NIST SP 800-171 Rev. 2, 3.1.13: Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
Official wording
NIST SP 800-171 Rev. 2, 3.1.14: Route remote access via managed access control points.
Official wording
NIST SP 800-171 Rev. 2, 3.1.15: Authorize remote execution of privileged commands and remote access to security-relevant information.
Official wording
NIST SP 800-171 Rev. 2, 3.1.16: Authorize wireless access prior to allowing such connections.
Official wording
NIST SP 800-171 Rev. 2, 3.1.17: Protect wireless access using authentication and encryption.
Official wording
NIST SP 800-171 Rev. 2, 3.1.18: Control connection of mobile devices.
Official wording
NIST SP 800-171 Rev. 2, 3.1.19: Encrypt CUI on mobile devices and mobile computing platforms.
Official wording
NIST SP 800-171 Rev. 2, 3.1.20: Verify and control/limit connections to and use of external systems.
Official wording
NIST SP 800-171 Rev. 2, 3.1.21: Limit use of portable storage devices on external systems.
Official wording
NIST SP 800-171 Rev. 2, 3.1.22: Control CUI posted or processed on publicly accessible systems.
Staff trainingAwareness and Training (AT) · 0 of 3 answered · 11 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.2.1: Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Official wording
NIST SP 800-171 Rev. 2, 3.2.2: Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
Official wording
NIST SP 800-171 Rev. 2, 3.2.3: Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Activity logsAudit and Accountability (AU) · 0 of 9 answered · 19 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Official wording
NIST SP 800-171 Rev. 2, 3.3.2: Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
Official wording
NIST SP 800-171 Rev. 2, 3.3.3: Review and update logged events.
Official wording
NIST SP 800-171 Rev. 2, 3.3.4: Alert in the event of an audit logging process failure.
Official wording
NIST SP 800-171 Rev. 2, 3.3.5: Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Official wording
NIST SP 800-171 Rev. 2, 3.3.6: Provide audit record reduction and report generation to support on-demand analysis and reporting.
Official wording
NIST SP 800-171 Rev. 2, 3.3.7: Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
Official wording
NIST SP 800-171 Rev. 2, 3.3.8: Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Official wording
NIST SP 800-171 Rev. 2, 3.3.9: Limit management of audit logging functionality to a subset of privileged users.
Computer setup and changesConfiguration Management (CM) · 0 of 9 answered · 33 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.4.1: Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Official wording
NIST SP 800-171 Rev. 2, 3.4.2: Establish and enforce security configuration settings for information technology products employed in organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.4.3: Track, review, approve or disapprove, and log changes to organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.4.4: Analyze the security impact of changes prior to implementation.
Official wording
NIST SP 800-171 Rev. 2, 3.4.5: Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.4.6: Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
Official wording
NIST SP 800-171 Rev. 2, 3.4.7: Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Official wording
NIST SP 800-171 Rev. 2, 3.4.8: Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
Official wording
NIST SP 800-171 Rev. 2, 3.4.9: Control and monitor user-installed software.
Logins and passwordsIdentification and Authentication (IA) · 0 of 11 answered · 27 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.5.1: Identify system users, processes acting on behalf of users, and devices.
Official wording
NIST SP 800-171 Rev. 2, 3.5.2: Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.5.3: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
Official wording
NIST SP 800-171 Rev. 2, 3.5.4: Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Official wording
NIST SP 800-171 Rev. 2, 3.5.5: Prevent reuse of identifiers for a defined period.
Official wording
NIST SP 800-171 Rev. 2, 3.5.6: Disable identifiers after a defined period of inactivity.
Official wording
NIST SP 800-171 Rev. 2, 3.5.7: Enforce a minimum password complexity and change of characters when new passwords are created.
Official wording
NIST SP 800-171 Rev. 2, 3.5.8: Prohibit password reuse for a specified number of generations.
Official wording
NIST SP 800-171 Rev. 2, 3.5.9: Allow temporary password use for system logons with an immediate change to a permanent password.
Official wording
NIST SP 800-171 Rev. 2, 3.5.10: Store and transmit only cryptographically-protected passwords.
Official wording
NIST SP 800-171 Rev. 2, 3.5.11: Obscure feedback of authentication information.
Handling security incidentsIncident Response (IR) · 0 of 3 answered · 11 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.6.1: Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Official wording
NIST SP 800-171 Rev. 2, 3.6.2: Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Official wording
NIST SP 800-171 Rev. 2, 3.6.3: Test the organizational incident response capability.
Repairs and maintenanceMaintenance (MA) · 0 of 6 answered · 18 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.7.1: Perform maintenance on organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.7.2: Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Official wording
NIST SP 800-171 Rev. 2, 3.7.3: Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Official wording
NIST SP 800-171 Rev. 2, 3.7.4: Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.7.5: Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
Official wording
NIST SP 800-171 Rev. 2, 3.7.6: Supervise the maintenance activities of maintenance personnel without required access authorization.
USB drives, paper and backupsMedia Protection (MP) · 0 of 9 answered · 23 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.8.1: Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Official wording
NIST SP 800-171 Rev. 2, 3.8.2: Limit access to CUI on system media to authorized users.
Official wording
NIST SP 800-171 Rev. 2, 3.8.3: Sanitize or destroy system media containing CUI before disposal or release for reuse.
Official wording
NIST SP 800-171 Rev. 2, 3.8.4: Mark media with necessary CUI markings and distribution limitations.
Official wording
NIST SP 800-171 Rev. 2, 3.8.5: Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Official wording
NIST SP 800-171 Rev. 2, 3.8.6: Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
Official wording
NIST SP 800-171 Rev. 2, 3.8.7: Control the use of removable media on system components.
Official wording
NIST SP 800-171 Rev. 2, 3.8.8: Prohibit the use of portable storage devices when such devices have no identifiable owner.
Official wording
NIST SP 800-171 Rev. 2, 3.8.9: Protect the confidentiality of backup CUI at storage locations.
Hiring and departuresPersonnel Security (PS) · 0 of 2 answered · 8 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.9.1: Screen individuals prior to authorizing access to organizational systems containing CUI.
Official wording
NIST SP 800-171 Rev. 2, 3.9.2: Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
Building and physical securityPhysical Protection (PE) · 0 of 6 answered · 14 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.10.1: Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Official wording
NIST SP 800-171 Rev. 2, 3.10.2: Protect and monitor the physical facility and support infrastructure for organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.10.3: Escort visitors and monitor visitor activity.
Official wording
NIST SP 800-171 Rev. 2, 3.10.4: Maintain audit logs of physical access.
Official wording
NIST SP 800-171 Rev. 2, 3.10.5: Control and manage physical access devices.
Official wording
NIST SP 800-171 Rev. 2, 3.10.6: Enforce safeguarding measures for CUI at alternate work sites.
Finding risks and weaknessesRisk Assessment (RA) · 0 of 3 answered · 9 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.11.1: Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Official wording
NIST SP 800-171 Rev. 2, 3.11.2: Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Official wording
NIST SP 800-171 Rev. 2, 3.11.3: Remediate vulnerabilities in accordance with risk assessments.
Checking your security, and your planSecurity Assessment (CA) · 0 of 4 answered · 13 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Official wording
NIST SP 800-171 Rev. 2, 3.12.2: Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.12.3: Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Official wording
NIST SP 800-171 Rev. 2, 3.12.4: Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
Network and encryptionSystem and Communications Protection (SC) · 0 of 16 answered · 42 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.13.2: Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.13.3: Separate user functionality from system management functionality.
Official wording
NIST SP 800-171 Rev. 2, 3.13.4: Prevent unauthorized and unintended information transfer via shared system resources.
Official wording
NIST SP 800-171 Rev. 2, 3.13.5: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Official wording
NIST SP 800-171 Rev. 2, 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Official wording
NIST SP 800-171 Rev. 2, 3.13.7: Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
Official wording
NIST SP 800-171 Rev. 2, 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
Official wording
NIST SP 800-171 Rev. 2, 3.13.9: Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
Official wording
NIST SP 800-171 Rev. 2, 3.13.10: Establish and manage cryptographic keys for cryptography employed in organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.13.11: Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
Official wording
NIST SP 800-171 Rev. 2, 3.13.12: Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
Official wording
NIST SP 800-171 Rev. 2, 3.13.13: Control and monitor the use of mobile code.
Official wording
NIST SP 800-171 Rev. 2, 3.13.14: Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
Official wording
NIST SP 800-171 Rev. 2, 3.13.15: Protect the authenticity of communications sessions.
Official wording
NIST SP 800-171 Rev. 2, 3.13.16: Protect the confidentiality of CUI at rest.
Updates, malware and monitoringSystem and Information Integrity (SI) · 0 of 7 answered · 31 points at stake
Official wording
NIST SP 800-171 Rev. 2, 3.14.1: Identify, report, and correct system flaws in a timely manner.
Official wording
NIST SP 800-171 Rev. 2, 3.14.2: Provide protection from malicious code at designated locations within organizational systems.
Official wording
NIST SP 800-171 Rev. 2, 3.14.3: Monitor system security alerts and advisories and take action in response.
Official wording
NIST SP 800-171 Rev. 2, 3.14.4: Update malicious code protection mechanisms when new releases are available.
Official wording
NIST SP 800-171 Rev. 2, 3.14.5: Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
Official wording
NIST SP 800-171 Rev. 2, 3.14.6: Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
Official wording
NIST SP 800-171 Rev. 2, 3.14.7: Identify unauthorized use of organizational systems.
Your estimated SPRS score: -203
Scores run from -203 to 110. You answered 0 of 110 requirements: 0 met, 0 not met or not sure, and 110 unanswered (counted as not met).
You have not confirmed a System Security Plan (3.12.4). Without an up-to-date SSP, an assessment cannot be completed at all, so any score is not valid until the plan exists. Write the SSP first: it is also where you record the gaps below and your plan to fix them.
Your answers do not yet fit the rules for Conditional CMMC Level 2 status
Under the CMMC rule, a company can start with a few open items on a plan of action (a POA&M) only if its score is at least 88, every open item is a 1-point item (or encryption that is not FIPS-validated), and certain requirements are fully met. Open items must then be closed within 180 days.
- Your estimated score is below 88, the minimum (80% of 110) for a plan of action.
- 58 open requirements are worth 3 or 5 points. Only 1-point items (and non-FIPS encryption) may go on a plan of action.
- 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5, 3.12.4 must be fully met; they can never go on a plan of action.
Score by area
- Who can get in (AC)0 of 22 met, -54 points
- Staff training (AT)0 of 3 met, -11 points
- Activity logs (AU)0 of 9 met, -19 points
- Computer setup and changes (CM)0 of 9 met, -33 points
- Logins and passwords (IA)0 of 11 met, -27 points
- Handling security incidents (IR)0 of 3 met, -11 points
- Repairs and maintenance (MA)0 of 6 met, -18 points
- USB drives, paper and backups (MP)0 of 9 met, -23 points
- Hiring and departures (PS)0 of 2 met, -8 points
- Building and physical security (PE)0 of 6 met, -14 points
- Finding risks and weaknesses (RA)0 of 3 met, -9 points
- Checking your security, and your plan (CA)0 of 4 met, -13 points
- Network and encryption (SC)0 of 16 met, -42 points
- Updates, malware and monitoring (SI)0 of 7 met, -31 points
The 10 gaps worth the most points
Answer the questions above to see your biggest gaps here.
What is an SPRS score?
It is the summary number a defense contractor reports to the Department of Defense to show how much of NIST SP 800-171 it has in place, written like "95 out of 110". If your contract requires NIST SP 800-171, you need a current score (not more than 3 years old) posted in SPRS, the Supplier Performance Risk System, to be considered for award (DFARS 252.204-7019).
NIST SP 800-171 is the federal list of 110 security requirements for protecting CUI, Controlled Unclassified Information: the sensitive but not classified information that comes with many defense contracts, such as drawings and specifications.
Most companies start with a Basic Assessment, which is a self-assessment against their own System Security Plan. The government treats it as "Low" confidence because it is self-generated; Medium and High assessments are done by government assessors (DFARS 252.204-7020).
How is the SPRS score calculated?
You start at 110, one point for each requirement, and subtract the value of every requirement that is not fully met. Each requirement is worth 5, 3 or 1 points depending on how much damage its absence could do, so the score can fall as low as -203 (32 CFR 170.24).
| Points lost if not met | Number of requirements | Examples |
|---|---|---|
| 5 points | 44 (including 3.5.3 and 3.13.11 when not done at all) | Limiting who can log in, security training, anti-malware, firewalls at the network edge, multi-factor authentication |
| 3 points (or partial credit) | 14, plus 3.5.3 and 3.13.11 when partly done | Tracing actions to individual people, securing media, encrypting CUI sent over networks |
| 1 point | 51 | Account lockout, screen lock, session time-outs, visitor logs |
| No points, but required | 1 (3.12.4, System Security Plan) | Without an SSP, the assessment cannot be completed |
- Partial credit exists in only two places. Multi-factor authentication (3.5.3) loses 3 points instead of 5 when it covers remote and admin accounts but not everyone yet. Encryption (3.13.11) loses 3 instead of 5 when CUI is encrypted but not with FIPS-validated encryption (32 CFR 170.24(c)(2)).
- A requirement that truly does not apply counts as met, for example public-facing system separation when you have no public-facing systems. Write down why in your SSP (32 CFR 170.24(b)(3)).
- A plan to fix something is not the same as fixing it. A requirement on a plan of action still scores as not met (32 CFR 170.24(c)(2)).
Which version of NIST SP 800-171 does CMMC use?
CMMC Level 2 uses Revision 2. The CMMC rule says the Level 2 requirements "are identical to the requirements in NIST SP 800-171 R2" (32 CFR 170.14(c)(3)), which is why this calculator uses the 110 Revision 2 requirements.
NIST published Revision 3 in May 2024, and it lists Revision 2 as superseded. That does not change what CMMC Level 2 and SPRS scoring use today; follow what your contract and the CMMC rule say.
What score do I need for CMMC Level 2?
To reach Final Level 2 status you need every requirement met, which is a score of 110 (32 CFR 170.16). You can start with Conditional status if your score is at least 88 (80% of 110) and every open item is a 1-point item, then you have 180 days to close them (32 CFR 170.21).
- Only 1-point requirements can sit on the plan of action (POA&M). The one exception is FIPS encryption (3.13.11) when you do encrypt but the encryption is not FIPS-validated (32 CFR 170.21(a)(2)).
- Six requirements can never be on the plan of action: 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and the System Security Plan, 3.12.4 (32 CFR 170.21(a)(2)(iii)).
- If the open items are not closed within 180 days, the Conditional status expires (32 CFR 170.21(b)).
- A senior-level representative of your company, the Affirming Official, must affirm compliance in SPRS after every assessment and every year after that (32 CFR 170.22).
Key takeaway: A score of 88 or more with only small items open can get you started. A score of 110 is the goal.
Do I need a self-assessment or a C3PAO assessment?
Your contract decides. Some contracts accept a CMMC Level 2 self-assessment, posted in SPRS; others require a Level 2 certification assessment by a C3PAO, an authorized third-party assessment organization (32 CFR 170.16, 32 CFR 170.17). Both are repeated at least every three years.
CMMC is being phased into contracts. Phase 1 began on November 10, 2025, when the matching DFARS rule took effect (Federal Register, DFARS Case 2019-D041), and mainly calls for self-assessments. The rule schedules Phase 2 to begin one year after Phase 1 and add C3PAO certification as a condition of award for applicable contracts (32 CFR 170.3(e)), but on July 13, 2026 the Department suspended Phase 2 while it reviews the program (Holland & Knight). Self-assessments and SPRS scores still apply; our CMMC guide tracks the current status.
Whichever applies to you, the scoring is the same, so the gaps this calculator shows are the ones an assessor will look at too.
What should I fix first?
Write or update your System Security Plan first, because without it no assessment can be completed. Then work through the 5-point gaps, starting with the ones on your results list, before the 3-point and 1-point items.
- Multi-factor authentication for everyone, not just remote and admin accounts, recovers up to 5 points on its own.
- Many 5-point items share one fix: a managed firewall, endpoint protection and patching cover several requirements at once.
- "Not sure" answers are worth checking before you spend money. Some may already be in place and just need documenting.
- Our cybersecurity team helps defense suppliers write the SSP and plan of action and close the technical gaps. For the bigger picture, read our CMMC compliance guide.
Frequently asked questions
Can an SPRS score be negative?
Yes. The score starts at 110 and the point values of all requirements add up to 313, so a company with none of them in place would score -203, the lowest possible (DoD Assessment Methodology v1.2.1).
How long is an SPRS score good for?
To be considered for award, your posted assessment must not be more than 3 years old unless the solicitation sets a shorter period (DFARS 252.204-7019). Under CMMC, a Level 2 self-assessment is repeated every three years and affirmed every year (32 CFR 170.16).
What happens if I do not have a System Security Plan?
Then the assessment cannot be completed. The CMMC rule says the absence of an up-to-date SSP results in a finding that "an assessment could not be completed due to incomplete information" (32 CFR 170.24). The SSP also cannot be put on a plan of action.
Do "Partly" or "Not sure" answers count?
They count as not met, because the methodology only gives partial credit for multi-factor authentication (3.5.3) and FIPS-validated encryption (3.13.11). For those two, the calculator offers the specific partial answer instead of "Partly".
Who posts the official score in SPRS?
Your company does, for a self-assessment, and a senior-level Affirming Official affirms it (32 CFR 170.16, 32 CFR 170.22). For a C3PAO certification assessment, the assessor submits the results, which then flow to SPRS (32 CFR 170.17). This calculator does not post anything.
Are my answers stored or shared?
Your answers are saved only in your own browser so you can come back later. Nothing is sent to Preferred Data unless you choose "Have an expert review my results", which shares your score summary and top gaps with us so we can follow up.
Sources
- NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020)
- 32 CFR 170.24, CMMC Scoring Methodology (eCFR)
- 32 CFR 170.14, CMMC Model (eCFR)
- 32 CFR 170.16, CMMC Level 2 self-assessment (eCFR)
- 32 CFR 170.17, CMMC Level 2 certification assessment (eCFR)
- 32 CFR 170.21, Plan of Action and Milestones requirements (eCFR)
- 32 CFR 170.3, Applicability and phase-in (eCFR)
- Holland & Knight: DoW suspends CMMC Phase II requirements (July 2026)
- 32 CFR 170.22, Affirmation (eCFR)
- DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements (eCFR)
- DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements (eCFR)
- Federal Register: DFARS CMMC final rule, effective November 10, 2025
- NIST SP 800-171 Revision 2 (NIST CSRC)
- NIST SP 800-171 Revision 3 (NIST CSRC)
More help with CMMC
GuideCMMC for North Carolina Defense Suppliers, in Plain EnglishCMMC in plain English for North Carolina defense suppliers and subcontractors: which level applies, what changed in 2026, what an SPRS score means and what to do first.
Policy templateInformation Security PolicyEstablish the core security program every insurer, auditor and customer now asks about: data classification, access control, patching, encryption, logging and vendor risk.
Policy templateIncident Response PlanKnow exactly who does what in the first hours of a ransomware attack, data breach or business email compromise, including who to call and which notification clocks start.
Policy templateAccess Control PolicyGive people only the access they need, protect every sign-in with MFA, keep admin accounts separate, review access every quarter and remove it the moment someone leaves.
Policy templateSecurity Awareness Training PolicyDecide who gets cybersecurity training, when, how phishing tests work, and which training records you keep for insurers and customer questionnaires.
Policy templateSystem Security Plan (SSP) StarterA starter System Security Plan for defense contractors that handle CUI, organized by the 14 NIST SP 800-171 families, with a plan of action and milestones (POA&M) section and the CMMC rules that apply to it.
Want a second set of eyes on your score?
Preferred Data has supported manufacturers from High Point, NC since 1987. We can review your answers with you, help write your System Security Plan and plan of action, and close the gaps worth the most points.