A perfect SPRS score is 110. For CMMC Level 2 certification you need all 110 NIST SP 800-171 requirements met, but conditional certification is possible at 88 or higher (80%) with a POA&M closed out within 180 days.
Not every gap can sit in a POA&M: the highest-weight requirements — like multifactor authentication and FIPS-validated encryption — generally cannot be deferred.
How the score works
- Start at 110; each unimplemented requirement subtracts 5, 3 or 1 points per the DoD Assessment Methodology
- Scores range from -203 to 110
- MFA (3.5.3) and FIPS crypto (3.13.11) have partial-credit rules
- No System Security Plan means you cannot legitimately submit a score at all
Calculate yours in 15 minutes with the free ITSecOps SPRS Score Calculator — all 110 controls, official weights, evidence-state dropdowns.
Before you submit that score: a self-assessed SPRS score is a certification to the U.S. Government. In June 2026 an Alabama contractor paid $507,144 after DCMA re-scored its self-assessment at −170. See how the False Claims Act applies to SPRS scores.