A perfect SPRS score is 110. For CMMC Level 2 certification you need all 110 NIST SP 800-171 requirements met, but conditional certification is possible at 88 or higher (80%) with a POA&M closed out within 180 days.
Not every gap can sit in a POA&M: the highest-weight requirements — like multifactor authentication and FIPS-validated encryption — generally cannot be deferred.
How the score works
- Start at 110; each unimplemented requirement subtracts 5, 3 or 1 points per the DoD Assessment Methodology
- Scores range from -203 to 110
- MFA (3.5.3) and FIPS crypto (3.13.11) have partial-credit rules
- No System Security Plan means you cannot legitimately submit a score at all
Calculate yours in 15 minutes with the free ITSecOps SPRS Score Calculator — all 110 controls, official weights, evidence-state dropdowns.