# SPRS Score Recovery Timeline Calculator > Source: https://netray.co/tools/sprs-score-recovery-timeline-calculator > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Enter your open 5, 3 and 1 point gaps and your monthly closure rate. See your score by month, months to reach 88 and the score at the 180 day POA&M window. ## Category compliance-legal ## Industry Defense ## Audience - Quality manager - IT manager - Compliance lead - Operations manager ## Tool **Kind:** calculator **Inputs:** #### Open 5 point gaps **Key:** open5 **Type:** number **Default:** 4 **Min:** 0 **Max:** 42 **Step:** 1 **Unit:** practices **Help:** Practices scored at 5 points that are not yet fully implemented. #### Open 3 point gaps **Key:** open3 **Type:** number **Default:** 9 **Min:** 0 **Max:** 14 **Step:** 1 **Unit:** practices **Help:** Practices scored at 3 points that are not yet fully implemented. #### Open 1 point gaps **Key:** open1 **Type:** number **Default:** 12 **Min:** 0 **Max:** 60 **Step:** 1 **Unit:** practices **Help:** Practices scored at 1 point that are not yet fully implemented. #### 5 point gaps closed per month **Key:** close5 **Type:** number **Default:** 1 **Min:** 0 **Max:** 10 **Step:** 0.5 **Unit:** per month **Help:** Usually the hardest: MFA, FIPS validated encryption, logging, flaw remediation. #### 3 point gaps closed per month **Key:** close3 **Type:** number **Default:** 2 **Min:** 0 **Max:** 10 **Step:** 0.5 **Unit:** per month #### 1 point gaps closed per month **Key:** close1 **Type:** number **Default:** 3 **Min:** 0 **Max:** 20 **Step:** 0.5 **Unit:** per month **Help:** Often documentation and policy items. #### Months from now **Key:** months **Type:** slider **Default:** 6 **Min:** 0 **Max:** 24 **Step:** 1 **Unit:** months #### Target score **Key:** target **Type:** number **Default:** 88 **Min:** -203 **Max:** 110 **Step:** 1 **Unit:** points **Help:** 88 of 110 is the 80 percent line commonly used for conditional Level 2 status. **Outputs:** #### Current estimated score **Key:** current **Expr:** 110 - 5 * open5 - 3 * open3 - open1 **Format:** integer **Description:** 110 minus the weighted deductions. Real scoring has a few practices with partial credit options, so confirm in the DoD Assessment Methodology. #### 5 point gaps closed by selected month **Key:** closed5 **Expr:** min(open5, close5 * months) **Format:** decimal #### 3 point gaps closed by selected month **Key:** closed3 **Expr:** min(open3, close3 * months) **Format:** decimal #### 1 point gaps closed by selected month **Key:** closed1 **Expr:** min(open1, close1 * months) **Format:** decimal #### Projected score at selected month **Key:** score_m **Expr:** current + 5 * closed5 + 3 * closed3 + closed1 **Format:** integer **Primary:** true #### Projected score at 180 days (6 months) **Key:** score_180 **Expr:** current + 5 * min(open5, close5 * 6) + 3 * min(open3, close3 * 6) + min(open1, close1 * 6) **Format:** integer **Description:** The POA&M closeout window for conditional status is 180 days. #### Points still needed to hit target **Key:** need **Expr:** max(0, target - current) **Format:** integer #### Points recovered per month (uncapped) **Key:** rate **Expr:** 5 * close5 + 3 * close3 + close1 **Format:** decimal #### Months to reach target **Key:** months_to_target **Expr:** if(gt(rate, 0), ceil(need / rate), 0) **Format:** integer **Primary:** true **Description:** Zero means already at target or no closure rate entered. Ignores caps, so treat as a lower bound. **Chart:** #### Projected SPRS score by month **Type:** line **X:** months **From:** 0 **To:** 24 **Steps:** 25 **Series:** - score_m **Disclaimer:** Planning aid only. Scoring weights come from the DoD Assessment Methodology for NIST SP 800-171. Your official SPRS submission must follow the methodology and your own assessment. ## Content **Intro:** A SPRS score is 110 minus a weighted deduction for each NIST SP 800-171 requirement that is not implemented. This calculator turns your open gaps and your realistic monthly closure rate into a timeline, so you can tell a prime what date your score will clear a threshold. **Sections:** #### How to use it **Body:** Count the practices you scored as not implemented in your last self assessment and sort them by point value: 5, 3 or 1. Enter those counts, then enter how many of each your team can truly close per month given budget, change windows and engineering time. Move the month slider to see the projected score, or read the chart for the full curve. Use the target field to test thresholds such as 88 for a conditional Level 2 outcome or 110 for full implementation. Run it twice, once with an optimistic closure rate and once with a conservative one, and plan around the conservative number. #### The method behind the numbers **Body:** The DoD Assessment Methodology starts at 110 points and subtracts 5, 3 or 1 for each requirement not met, with a small number of requirements having partial credit rules. The score can go negative, down to minus 203. This tool uses straight weighted subtraction, caps closures at the number of open gaps, and computes months to target as points needed divided by points recovered per month, rounded up. Because the months to target figure ignores caps it is a lower bound; the chart uses the capped numbers and is the safer picture. **Bullets:** - Score = 110 - 5 x open5 - 3 x open3 - open1 - Projected score = current + 5 x closed5 + 3 x closed3 + closed1 - Closed counts never exceed the open counts - The 180 day output matches the POA&M closeout window #### Reading the result and common mistakes **Body:** If the 180 day score is below your target, either the closure rate is too slow or the plan depends on a few expensive 5 point items. Prioritise 5 point practices first, since each is worth five 1 point practices. The usual mistakes are counting a practice as closed when it is only configured but not documented or evidenced, assuming MFA and encryption rollouts take a week when they cross every user and device, and forgetting that a SPRS submission has to be re-done when the scope or the score changes. Treat the output as a schedule, then back it with an SSP and POA&M. **Cta:** If your gap list lives in spreadsheets across IT, quality and contracts, we can help pull the evidence from your ERP and ticketing systems into one tracker that stays current. **Faq:** #### What is the lowest possible SPRS score? **Answer:** The DoD Assessment Methodology allows a score as low as minus 203 when every scored requirement is unmet. Most small suppliers that submit a score for the first time land somewhere between about zero and the 70s, which is why a dated recovery plan matters more than the starting number. #### Is 88 enough for CMMC Level 2? **Answer:** A score of 88 of 110, which is 80 percent, is the commonly cited minimum for conditional Level 2 status, and only if the remaining gaps are allowed on a POA&M and close within 180 days. Some requirements cannot be on a POA&M at all. Confirm against the current CMMC rule. #### Does a higher closure rate always work? **Answer:** No. Five point items such as MFA, logging and FIPS validated cryptography touch many systems and often need purchases and downtime. Enter a rate you can defend with named owners and dates, not the rate you wish you had. #### Do I need to resubmit my score? **Answer:** Contract clauses require a current assessment score to be posted in SPRS, and DFARS 252.204-7019 refers to assessments no more than three years old. Many primes ask for updates as the score improves. Check your contract language. ## Search terms sprs score improvement plan, how to raise sprs score, nist 800-171 score timeline, sprs score 88 calculator, cmmc level 2 score plan, dod assessment methodology score, poam closeout 180 days, sprs score planning spreadsheet --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json