# NIST 800-171 SPRS Score Calculator

> Source: https://netray.co/tools/nist-800-171-sprs-score-calculator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.

## Category

aerospace-defense

## Industry

Defense Contracting

## Region

United States

## Audience

- Compliance manager
- IT security lead
- Defense supplier owner

## Tool

**Kind:** calculator

**Inputs:**

#### Unmet 5-point requirements

**Key:** unmet5

**Type:** number

**Default:** 4

**Min:** 0

**Step:** 1

**Unit:** controls

**Help:** Count requirements weighted 5 points that are not fully implemented. Exclude MFA and FIPS encryption, handled below.

#### Unmet 3-point requirements

**Key:** unmet3

**Type:** number

**Default:** 3

**Min:** 0

**Step:** 1

**Unit:** controls

**Help:** Count requirements weighted 3 points that are not fully implemented.

#### Unmet 1-point requirements

**Key:** unmet1

**Type:** number

**Default:** 12

**Min:** 0

**Step:** 1

**Unit:** controls

**Help:** Count requirements weighted 1 point that are not fully implemented.

#### Multifactor authentication (3.5.3)

**Key:** mfa

**Type:** select

**Default:** 0

**Options:**

##### Fully implemented (0 deducted)

**Value:** 0

##### Partial: MFA for remote and privileged only (3 deducted)

**Value:** 3

##### Not implemented (5 deducted)

**Value:** 5

**Help:** The DoD methodology allows a reduced deduction when MFA covers remote and privileged access but not all users.

#### FIPS-validated encryption of CUI (3.13.11)

**Key:** fips

**Type:** select

**Default:** 0

**Options:**

##### Fully implemented (0 deducted)

**Value:** 0

##### Encryption used but not FIPS validated (3 deducted)

**Value:** 3

##### No encryption (5 deducted)

**Value:** 5

**Help:** Encryption in use but not FIPS validated earns a partial deduction rather than the full amount.

#### Target score

**Key:** target

**Type:** number

**Default:** 88

**Min:** -203

**Max:** 110

**Step:** 1

**Help:** CMMC Level 2 conditional status is generally tied to a score of 88 of 110 or higher. Change it to model your own goal.

**Outputs:**

#### Total points deducted

**Key:** deductions

**Expr:** 5 * unmet5 + 3 * unmet3 + unmet1 + mfa + fips

**Format:** integer

**Description:** Sum of all weights for unmet or partially met requirements.

#### Estimated SPRS score

**Key:** score

**Expr:** 110 - deductions

**Format:** integer

**Primary:** true

**Description:** Starts at 110 and can go negative. This is the number posted to SPRS.

#### Share of maximum score

**Key:** pct

**Expr:** clamp(score / 110 * 100, 0, 100)

**Format:** percent

**Description:** Floors at zero for readability; the real score can be negative.

#### Points to reach target

**Key:** gap

**Expr:** max(0, target - score)

**Format:** integer

**Primary:** true

**Description:** Points you must recover through remediation to meet the target.

#### Equivalent 5-point fixes

**Key:** five_needed

**Expr:** ceil(gap / 5)

**Format:** integer

**Description:** Fewest 5-point requirements you would need to close to reach the target.

**Chart:**

#### Score as 1-point gaps grow

**Type:** line

**X:** unmet1

**From:** 0

**To:** 60

**Steps:** 30

**Series:**

- score

**Disclaimer:** Planning aid only. Your official score must follow the current DoD Assessment Methodology and be supported by a system security plan. Verify the weight of each requirement against the current methodology document.

## Content

**Intro:** Defense suppliers handling CUI must post a NIST SP 800-171 summary score to SPRS under DFARS 252.204-7019 and 7020. This calculator applies the DoD Assessment Methodology arithmetic: start at 110 and subtract each unmet requirement's weight.

**Sections:**

#### How to use the calculator

**Body:** Work through your 110 NIST SP 800-171 Rev 2 requirements and count how many are not fully implemented, grouped by the point weight the DoD methodology assigns (5, 3 or 1). Enter those counts, then answer the two special cases for multifactor authentication and FIPS-validated encryption, which allow partial credit. The result is your estimated SPRS score, the share of the maximum, and how many points you need to recover to hit a target such as 88.

**Bullets:**

- Count a requirement as unmet unless it is fully implemented across the whole CUI boundary.
- Do not give credit for items that exist only as a plan of action.
- Rerun after each remediation sprint to track progress.

#### The method behind the score

**Body:** The DoD Assessment Methodology assigns each of the 110 requirements a value of 5, 3 or 1 based on its impact on protecting CUI. A perfect score is 110. Each unmet requirement subtracts its value, so scores can fall well below zero. Two requirements, multifactor authentication and FIPS-validated cryptography, can be partially credited. A missing or incomplete system security plan means no meaningful assessment can be performed at all, so write the plan first.

#### Reading your result

**Body:** A score near 110 means few documented gaps; a low or negative score means a large remediation backlog. The gap to your target translates into concrete work: if you are 12 points short, closing three 5-point requirements and one 3-point requirement gets you there. Prioritise 5-point items first because each recovers the most score per unit of effort, then pair the list with a plan of action and milestones so every open item has an owner and a date.

#### Common mistakes

**Body:** The most frequent error is optimism: scoring a control as met because a policy exists while the technical control is only deployed on part of the environment. Others include scoping the wrong boundary, forgetting external service providers that handle CUI, and posting a score that does not match the system security plan. Because the score is attested, treat it as a statement an assessor or contracting officer may test.

**Cta:** If you want your SPRS inputs pulled from asset, user and configuration data instead of typed by hand, Netray can build a private, on-prem workflow around your own systems.

**Faq:**

#### What is a good SPRS score?

**Answer:** The maximum is 110. For CMMC Level 2 conditional status, a score of 88 or higher is generally the reference point, with remaining items tracked on a plan of action. Anything lower signals significant gaps to close before relying on it for new awards.

#### Can an SPRS score be negative?

**Answer:** Yes. Because points are subtracted from 110 for each unmet requirement, a supplier with many gaps can post a negative score. The methodology's lowest possible value is well below zero, which is why the calculator does not clamp the main score.

#### Does a plan of action raise my score?

**Answer:** No. A plan of action and milestones documents how you will close a gap, but the requirement still counts as unmet in the score until it is fully implemented. The score reflects current implementation status, not intent.

#### Where do I post the score?

**Answer:** Basic assessment results are submitted to the DoD Supplier Performance Risk System, SPRS. Contracting officers can check for a current score tied to your CAGE code when DFARS 252.204-7019 applies to a solicitation.

## Search terms

sprs score calculator, nist 800-171 score calculator, dod assessment methodology scoring, how to calculate sprs score, sprs score 110, dfars 252.204-7019 score, nist 800-171 self assessment score, sprs score template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json