How to Calculate Your SPRS Score for CMMC Level 2

Direct answer: an SPRS score for CMMC Level 2 starts at 110 — one point for each of the 110 NIST SP 800-171 Rev. 2 security requirements — and you subtract a weighted 5, 3, or 1 point for every requirement you have not implemented. The weights reflect risk, not effort, so the scale runs from a maximum of 110 down to a minimum of -203. Two requirements allow partial credit (3.5.3 and 3.13.11), and 3.12.4 gates the assessment entirely. Score all 110 requirements below and download the ledger — free, no sign-up, and nothing you enter leaves your browser.

What the SPRS score is

SPRS is the Supplier Performance Risk System. For CMMC Level 2, your SPRS score is a single number representing how completely you have implemented the 110 security requirements in NIST SP 800-171 Rev. 2. You start at a perfect 110 and lose weighted points for every requirement not fully met.

The 110-point scale and the weighted deductions

It is not one point per requirement. Under the DoD Assessment Methodology, each unimplemented requirement costs 5, 3, or 1 point according to its risk to the confidentiality of CUI, so the scale runs from 110 down to -203. Every requirement is scored all-or-nothing — you earn the point only when every applicable assessment objective is satisfied — with two documented exceptions:

• 3.5.3 (multifactor authentication) carries a 5-point weight. When MFA is implemented for remote and privileged users but not for general users on local access, 3 points are deducted instead of 5.
• 3.13.11 (FIPS-validated cryptography) carries a 5-point weight. When cryptography is employed to protect CUI but the modules are not FIPS-validated, 3 points are deducted instead of 5.

The 3.12.4 gate. Requirement 3.12.4 requires a system security plan. Without one there is no assessment to score, so the calculator treats 3.12.4 as a gate rather than as one more point: mark it Not Met and the result is not a defensible score.

A worked example, verified exactly

Take an organization with 106 of the 110 requirements Met — including 3.12.4, which must be Met for the score to mean anything — and exactly these four exceptions:

Total deductions: 3 + 3 + 3 + 5 = 14. Score: 110 − 14 = 96. Note that you cannot derive this from counts alone: four unimplemented requirements produce a deduction of 14, not 4, because the weights and the two partial-credit rules decide the arithmetic.

Which assessment are we talking about?

Four different things get called "the assessment," and they are not interchangeable:

• SPRS Basic Assessment. Your own self-assessment of the 110 NIST SP 800-171 requirements, scored with the DoD Assessment Methodology and reported in SPRS under DFARS 252.204-7019/7020. This calculator computes that score.
• CMMC Level 2 self-assessment. An assessment against the CMMC Level 2 practices and their assessment objectives, affirmed by a senior official. Related to, but not the same as, the SPRS Basic Assessment score.
• DIBCAC assessment. A government-conducted assessment by the Defense Industrial Base Cybersecurity Assessment Center. Not something you self-report.
• C3PAO assessment. A CMMC Level 2 certification assessment conducted by an authorized third-party assessment organization. Only a C3PAO (through the accreditation body) can produce a CMMC certification.

Nothing on this page produces a certification, an official score, or a submitted SPRS entry. It is a readiness aid.

How to calculate it, step by step

1. Confirm your scope. Identify the assets that store, process, or transmit CUI. Scoping errors are the most common reason a score has to be redone — the CUI scoping check walks the categories.
2. Assess all 110 requirements against their assessment objectives with the Level 2 self-assessment checklist. A requirement is Met only when every applicable objective is satisfied.
3. Prove each objective with the artifacts an assessor will examine — the 320-objective evidence checklist lists them.
4. Apply the weighted deductions (5/3/1) and the two partial-credit rules, then subtract from 110.
5. Build your POA&M for the gaps with the POA&M builder — not every requirement is eligible.
6. Submit in SPRS with your assessment date and scope, then use the C3PAO preparation checklist before a certification assessment.

One caution: submitted scores are spot-checked against system security plans. A number you cannot defend with evidence is a liability, not an asset.

Official sources

• Scoring methodology, weights and the −203 floor — DoD NIST SP 800-171 Assessment Methodology, Version 1.2.1
• The 110 security requirements — NIST SP 800-171 Rev. 2
• The 320 assessment objectives — NIST SP 800-171A
• Reporting obligation — DFARS 252.204-7020 (eCFR)
• Score submission — Supplier Performance Risk System

Point values on this page follow the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (24 June 2020), scored against NIST SP 800-171 Rev. 2 (110 requirements). Athena last verified this is the current edition on 9 September 2026. Verify against the DoD source before submitting a score to SPRS.

Turning the number into something defensible

Hand-scoring 110 weighted requirements is the easy part. The hard part is the evidence behind each of the 320 assessment objectives, and the POA&M that closes the gaps in an order an assessor will accept. That is what Athena does with the score you just produced.

Turn this score into an assessor-ready remediation plan →

FAQ

What is a passing SPRS score?

110 means every requirement is met; 88 or above with a valid POA&M supports Conditional status; below 88 is no CMMC status.

What is the lowest possible score?

-203 — because unimplemented requirements carry weighted 3- and 5-point deductions.

Can every requirement be placed on a POA&M?

No — higher-weighted practices are not eligible, a minimum score is required to use one, and scoring is all-or-nothing apart from 3.5.3 and 3.13.11.

Related: 3.5.3 MFA evidence · Level 2 self-assessment · Evidence checklist