SPRS Score Recovery Timeline Calculator
A SPRS score is 110 minus a weighted deduction for each NIST SP 800-171 requirement that is not implemented. This calculator turns your open gaps and your realistic monthly closure rate into a timeline, so you can tell a prime what date your score will clear a threshold.
Your numbers
Practices scored at 5 points that are not yet fully implemented.
Practices scored at 3 points that are not yet fully implemented.
Practices scored at 1 point that are not yet fully implemented.
Usually the hardest: MFA, FIPS validated encryption, logging, flaw remediation.
Often documentation and policy items.
88 of 110 is the 80 percent line commonly used for conditional Level 2 status.
Your results
Planning aid only. Scoring weights come from the DoD Assessment Methodology for NIST SP 800-171. Your official SPRS submission must follow the methodology and your own assessment.
Projected SPRS score by month
Sweeps Months from now from 0 to 24, holding your other inputs fixed.
Get a second pair of eyes on your recovery plan
Send your gap list and we will check the sequencing and flag items that tend to run long. Optional, the calculator works without it.
Optional. The tool and every export work without this. No spam.
How to use it
Count the practices you scored as not implemented in your last self assessment and sort them by point value: 5, 3 or 1. Enter those counts, then enter how many of each your team can truly close per month given budget, change windows and engineering time. Move the month slider to see the projected score, or read the chart for the full curve. Use the target field to test thresholds such as 88 for a conditional Level 2 outcome or 110 for full implementation. Run it twice, once with an optimistic closure rate and once with a conservative one, and plan around the conservative number.
The method behind the numbers
The DoD Assessment Methodology starts at 110 points and subtracts 5, 3 or 1 for each requirement not met, with a small number of requirements having partial credit rules. The score can go negative, down to minus 203. This tool uses straight weighted subtraction, caps closures at the number of open gaps, and computes months to target as points needed divided by points recovered per month, rounded up. Because the months to target figure ignores caps it is a lower bound; the chart uses the capped numbers and is the safer picture.
- Score = 110 - 5 x open5 - 3 x open3 - open1
- Projected score = current + 5 x closed5 + 3 x closed3 + closed1
- Closed counts never exceed the open counts
- The 180 day output matches the POA&M closeout window
Reading the result and common mistakes
If the 180 day score is below your target, either the closure rate is too slow or the plan depends on a few expensive 5 point items. Prioritise 5 point practices first, since each is worth five 1 point practices. The usual mistakes are counting a practice as closed when it is only configured but not documented or evidenced, assuming MFA and encryption rollouts take a week when they cross every user and device, and forgetting that a SPRS submission has to be re-done when the scope or the score changes. Treat the output as a schedule, then back it with an SSP and POA&M.
Frequently Asked Questions
What is the lowest possible SPRS score?
The DoD Assessment Methodology allows a score as low as minus 203 when every scored requirement is unmet. Most small suppliers that submit a score for the first time land somewhere between about zero and the 70s, which is why a dated recovery plan matters more than the starting number.
Is 88 enough for CMMC Level 2?
A score of 88 of 110, which is 80 percent, is the commonly cited minimum for conditional Level 2 status, and only if the remaining gaps are allowed on a POA&M and close within 180 days. Some requirements cannot be on a POA&M at all. Confirm against the current CMMC rule.
Does a higher closure rate always work?
No. Five point items such as MFA, logging and FIPS validated cryptography touch many systems and often need purchases and downtime. Enter a rate you can defend with named owners and dates, not the rate you wish you had.
Do I need to resubmit my score?
Contract clauses require a current assessment score to be posted in SPRS, and DFARS 252.204-7019 refers to assessments no more than three years old. Many primes ask for updates as the score improves. Check your contract language.
If your gap list lives in spreadsheets across IT, quality and contracts, we can help pull the evidence from your ERP and ticketing systems into one tracker that stays current.
Related Tools
CMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Costing & FinanceDefense Supplier Compliance Hours and Staffing Calculator
Add up the recurring work behind NIST 800-171: log review, access reviews, training, scanning, patching, POA&M and assessor prep. See hours, FTE and loaded labor cost.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Compliance & ContractsCMMC C3PAO Assessment Day Prep Checklist
A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical.
More Compliance & Contracts tools
See all- CMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
Keep exploring
Free tools
- NIST 800-171 SPRS Score CalculatorCalculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
- NIST 800-171 POA&M WorksheetAn editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
- CMMC POA&M (Plan of Action and Milestones) WorksheetAn editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
ERP fixes and how-tos
- ERP Selection RFP Timeline: How Long It TakesA realistic ERP selection RFP timeline: requirements, RFI, RFP, demos, AI proof of value, references, negotiation. Typical durations and what stretches them.
- How to Test ERP Backup and Disaster RecoveryHow to test ERP backups and disaster recovery: define RTO and RPO, restore the database and file tiers, prove the app works, and document results for audit.
Guides
- How to Improve Your SPRS Score as a Small ManufacturerHow to calculate and improve your SPRS score as a small manufacturer: the NIST 800-171 scoring method, high-value controls to fix first, and common mistakes.
- Infor LN Implementation: Realistic Timeline ExpectationsGet realistic Infor LN implementation timelines. Typical phase durations, common delays, resource requirements, and how to avoid schedule overruns.
- SyteLine Database Backup and Recovery StrategyPlan database backup and disaster recovery for Infor SyteLine SQL Server environments. Configure full, differential, and transaction log backup strategies.