How to Calculate Your SPRS Score for CMMC Level 2
If a DoD contracting officer looked you up today, your SPRS score is the number they'd see — and it decides whether you're eligible to win or keep CUI-carrying work. Here's exactly how the score is calculated, what counts as passing, and how to check yours.
What the SPRS score is
SPRS is the Supplier Performance Risk System. For CMMC Level 2, your SPRS score is a single number that represents how completely you've implemented the 110 security requirements in NIST SP 800-171 Rev. 2. You start at a perfect 110 and lose points for every requirement not fully met.
The 110-point scale — and how deductions work
It isn't one point per control. Under the DoD Assessment Methodology, each unmet requirement is weighted 1, 3, or 5 points by risk, so the scale runs from a high of 110 down to -203. Controls are scored all-or-nothing: you only earn the points if every assessment objective is met.
| SPRS score | Meaning | Validity |
|---|---|---|
| 110 | All requirements met — supports Final status | 3 years + annual affirmation |
| 88–109 | Minor gaps with a valid POA&M — Conditional | 180 days to close the POA&M |
| Below 88 | No CMMC status — affects eligibility | — |
How to calculate it, step by step
- Confirm your scope. Identify the assets that store, process, or transmit CUI. Scoping errors are the #1 reason scores go sideways.
- Assess all 110 requirements against their objectives — met or not met, all-or-nothing.
- Apply the weighted deductions (1/3/5) from the DoD Assessment Methodology.
- Subtract from 110 to get your score.
- Build your POA&M for the gaps — not everything can be POA&M'd, and you need at least 88 to use one.
- Submit in SPRS with your assessment date and scope.
One caution: DCMA has been spot-checking SSPs and submitted SPRS scores. An inflated number you can't defend with evidence is a liability, not an asset.
Do it automatically with Athena
Hand-scoring 110 weighted controls is slow and error-prone. Athena auto-calculates your SPRS score as you assess each control, shows the exact deductions, drafts the POA&M, and projects your score once gaps close — with a defensible evidence trail behind every number, and a simulation of how six DIBCAC assessor archetypes would view your binder.
Start a free SPRS readiness check →
FAQ
What is a passing SPRS score?
110 is perfect; 88+ with a valid POA&M supports Conditional status; below 88 is no CMMC status.
What is the lowest possible score?
-203 — because some unmet controls carry 3- or 5-point deductions.
Can every control be POA&M'd?
No — higher-weighted practices can't be, you must reach 88 to use one, and scoring is all-or-nothing.
Related: 3.5.3 MFA evidence · Athena CMMC platform