NIST 800-171 SPRS Score Calculator
Defense suppliers handling CUI must post a NIST SP 800-171 summary score to SPRS under DFARS 252.204-7019 and 7020. This calculator applies the DoD Assessment Methodology arithmetic: start at 110 and subtract each unmet requirement's weight.
Your numbers
Count requirements weighted 5 points that are not fully implemented. Exclude MFA and FIPS encryption, handled below.
Count requirements weighted 3 points that are not fully implemented.
Count requirements weighted 1 point that are not fully implemented.
The DoD methodology allows a reduced deduction when MFA covers remote and privileged access but not all users.
Encryption in use but not FIPS validated earns a partial deduction rather than the full amount.
CMMC Level 2 conditional status is generally tied to a score of 88 of 110 or higher. Change it to model your own goal.
Your results
Planning aid only. Your official score must follow the current DoD Assessment Methodology and be supported by a system security plan. Verify the weight of each requirement against the current methodology document.
Score as 1-point gaps grow
Sweeps Unmet 1-point requirements from 0 to 60, holding your other inputs fixed.
Get an expert read on your SPRS inputs
Share your counts and we will review the assumptions and suggest the cheapest path to your target score.
Optional. The tool and every export work without this. No spam.
How to use the calculator
Work through your 110 NIST SP 800-171 Rev 2 requirements and count how many are not fully implemented, grouped by the point weight the DoD methodology assigns (5, 3 or 1). Enter those counts, then answer the two special cases for multifactor authentication and FIPS-validated encryption, which allow partial credit. The result is your estimated SPRS score, the share of the maximum, and how many points you need to recover to hit a target such as 88.
- Count a requirement as unmet unless it is fully implemented across the whole CUI boundary.
- Do not give credit for items that exist only as a plan of action.
- Rerun after each remediation sprint to track progress.
The method behind the score
The DoD Assessment Methodology assigns each of the 110 requirements a value of 5, 3 or 1 based on its impact on protecting CUI. A perfect score is 110. Each unmet requirement subtracts its value, so scores can fall well below zero. Two requirements, multifactor authentication and FIPS-validated cryptography, can be partially credited. A missing or incomplete system security plan means no meaningful assessment can be performed at all, so write the plan first.
Reading your result
A score near 110 means few documented gaps; a low or negative score means a large remediation backlog. The gap to your target translates into concrete work: if you are 12 points short, closing three 5-point requirements and one 3-point requirement gets you there. Prioritise 5-point items first because each recovers the most score per unit of effort, then pair the list with a plan of action and milestones so every open item has an owner and a date.
Common mistakes
The most frequent error is optimism: scoring a control as met because a policy exists while the technical control is only deployed on part of the environment. Others include scoping the wrong boundary, forgetting external service providers that handle CUI, and posting a score that does not match the system security plan. Because the score is attested, treat it as a statement an assessor or contracting officer may test.
Frequently Asked Questions
What is a good SPRS score?
The maximum is 110. For CMMC Level 2 conditional status, a score of 88 or higher is generally the reference point, with remaining items tracked on a plan of action. Anything lower signals significant gaps to close before relying on it for new awards.
Can an SPRS score be negative?
Yes. Because points are subtracted from 110 for each unmet requirement, a supplier with many gaps can post a negative score. The methodology's lowest possible value is well below zero, which is why the calculator does not clamp the main score.
Does a plan of action raise my score?
No. A plan of action and milestones documents how you will close a gap, but the requirement still counts as unmet in the score until it is fully implemented. The score reflects current implementation status, not intent.
Where do I post the score?
Basic assessment results are submitted to the DoD Supplier Performance Risk System, SPRS. Contracting officers can check for a current score tied to your CAGE code when DFARS 252.204-7019 applies to a solicitation.
If you want your SPRS inputs pulled from asset, user and configuration data instead of typed by hand, Netray can build a private, on-prem workflow around your own systems.
Related Tools
NIST 800-171 POA&M Worksheet
An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
Aerospace & DefenseCUI Marking Checklist for DoD Contractors
A practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments.
Compliance & ContractsDFARS 252.204-7012 Cyber Incident Report Template
A fill-in internal record to collect the details you need for a DFARS 7012 cyber incident report: timeline, systems, CUI impact, preservation and notifications.
Aerospace & DefenseCMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
More Aerospace & Defense tools
See all- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)
- Aerospace Supplier Scorecard
- First Article Inspection (AS9102) Checklist
- Government Contract Compliance Cost Calculator