Every defense contractor handling FCI or CUI needs to know exactly where they stand. This free tool works the way an assessor does: pick your CMMC level, set each of the requirements to its real status - including whether you have evidence collected - and get your official-methodology SPRS score instantly. Click any control family tile to open its requirements. Nothing you enter is saved or sent anywhere.
How SPRS scoring works
The DoD Assessment Methodology (v1.2.1) weights each of the 110 NIST SP 800-171 requirements at 5, 3 or 1 points. You start at 110; each requirement not fully implemented subtracts its weight. Two special cases receive partial credit - MFA (3.5.3) and FIPS-validated cryptography (3.13.11) - and the System Security Plan (3.12.4) is mandatory: without it no assessment can be conducted. Scores range from -203 to +110 and are reported in SPRS with an assessment date and a projected date for reaching 110. Partial implementation earns no credit.
Why evidence matters as much as the score
Self-reported scores are estimates: in a C3PAO assessment, every requirement is verified against the NIST SP 800-171A assessment objectives, and what cannot be evidenced is scored as not met. That is why this calculator tracks evidence readiness separately - a 110 with 60% evidence coverage is not assessment-ready. Our CMMC Level 2 readiness services build the SSP, the evidence library and the enforced controls behind the score, and we support defense suppliers outside the US in their own timezone.
Frequently asked questions
Is this calculator official?
It implements the official DoD Assessment Methodology weights, but your reportable score must come from a documented self-assessment against your SSP. Use this to estimate, plan and track remediation.
Do I get points for partially implemented requirements?
No - except MFA (3.5.3) and FIPS cryptography (3.13.11), which have defined partial deductions of 3 points. Everything else is all or nothing.
What does the 88-point threshold mean?
Under the CMMC final rule, a Level 2 score of at least 88 (80%) with a POA&M can qualify for Conditional certification status - but most 5-point requirements cannot be on a POA&M, and 110 is required for final status.
Is my data saved?
No. Everything runs in your browser. Nothing is stored, transmitted or tracked.
Can I share my scorecard?
Yes - the copy button generates an anonymous, emoji summary by control family you can paste into Slack, Teams or LinkedIn.
Get an engineer-verified score
Assessors score what you can prove. We will verify your score against your actual environment, build the SSP, POA&M and evidence library, and remediate the gaps - book a free scoping call or email info@itsecops.cloud.
Know your score? Turn it into a plan with the free CMMC Cost & Roadmap Planner.