Every defense contractor handling FCI or CUI needs to know exactly where they stand. This free tool works the way an assessor does: pick your CMMC level, set each of the requirements to its real status - including whether you have evidence collected - and get your official-methodology SPRS score instantly. Click any control family tile to open its requirements. Nothing you enter is saved or sent anywhere.
How SPRS scoring works
The DoD Assessment Methodology (v1.2.1) weights each of the 110 NIST SP 800-171 requirements at 5, 3 or 1 points. You start at 110; each requirement not fully implemented subtracts its weight. Two special cases receive partial credit - MFA (3.5.3) and FIPS-validated cryptography (3.13.11) - and the System Security Plan (3.12.4) is mandatory: without it no assessment can be conducted. Scores range from -203 to +110 and are reported in SPRS with an assessment date and a projected date for reaching 110. Partial implementation earns no credit.
Why evidence matters as much as the score
Self-reported scores are estimates: in a C3PAO assessment, every requirement is verified against the NIST SP 800-171A assessment objectives, and what cannot be evidenced is scored as not met. That is why this calculator tracks evidence readiness separately - a 110 with 60% evidence coverage is not assessment-ready. Our CMMC Level 2 readiness services build the SSP, the evidence library and the enforced controls behind the score, and we support defense suppliers outside the US in their own timezone.
Frequently asked questions
Is this calculator official?
It implements the official DoD Assessment Methodology weights, but your reportable score must come from a documented self-assessment against your SSP. Use this to estimate, plan and track remediation.
Do I get points for partially implemented requirements?
No - except MFA (3.5.3) and FIPS cryptography (3.13.11), which have defined partial deductions of 3 points. Everything else is all or nothing.
What does the 88-point threshold mean?
Under the CMMC final rule, a Level 2 score of at least 88 (80%) with a POA&M can qualify for Conditional certification status - but most 5-point requirements cannot be on a POA&M, and 110 is required for final status.
Is my data saved?
No. Everything runs in your browser. Nothing is stored, transmitted or tracked.
Can I share my scorecard?
Yes - the copy button generates an anonymous, emoji summary by control family you can paste into Slack, Teams or LinkedIn.
Get an engineer-verified score
Assessors score what you can prove. We will verify your score against your actual environment, build the SSP, POA&M and evidence library, and remediate the gaps - book a free scoping call or email info@itsecops.cloud.
Know your score? Turn it into a plan with the free CMMC Cost & Roadmap Planner.
SPRS score FAQ
What is an SPRS score?
Your SPRS score is the result of a NIST SP 800-171 self-assessment under the DoD Assessment Methodology, submitted to the Supplier Performance Risk System. It ranges from -203 to 110: you start at 110 and subtract 5, 3 or 1 points for each of the 110 requirements you have not implemented.
What SPRS score do I need for CMMC Level 2?
A perfect 110 is required for final Level 2 certification without a POA&M. Conditional certification is possible at 88 or above (80% of 110), provided no POA&M-ineligible controls are open — details in our full answer.
Is a negative SPRS score bad?
It is common — a typical unprepared contractor scores between -50 and +30 because the methodology subtracts up to 5 points per missing control. Negative is not failing; it is a measured starting point for remediation. Primes increasingly screen subs on it, so improving it quickly matters.
Does this calculator store or send my answers?
No. Everything runs in your browser: no signup, no upload, nothing stored on our servers. Share the scorecard only if you choose to copy it.
How often must I submit my score to SPRS?
Scores are valid for three years, but you must keep them current — resubmit whenever your implementation status changes materially, and affirm annually under the 2026 rules. DFARS 252.204-7019 makes a current score a condition of award.
Want the remediation plan behind the number? A fixed-fee gap analysis turns your score into a control-by-control plan with a firm price.