Full certification requires meeting all 110 requirements. Conditional Level 2 status is granted at a minimum of 88 of 110 requirements met (80%), with remaining gaps in a POA&M that must close within 180 days — and the highest-weight controls cannot be POA&M-ed at all.
Rules that surprise people
- Failing MFA, FIPS encryption or similar 5-point controls usually blocks even conditional status
- The 180-day clock is hard: miss it and the conditional certificate lapses
- Annual affirmations continue after certification — compliance is not one-and-done
Know your number before the assessor does: the ITSecOps SPRS calculator shows exactly which controls carry 5, 3 or 1 points and whether your gaps are POA&M-eligible.
Before you submit that score: a self-assessed SPRS score is a certification to the U.S. Government. In June 2026 an Alabama contractor paid $507,144 after DCMA re-scored its self-assessment at −170. See how the False Claims Act applies to SPRS scores.