What is a SPRS score?

The Supplier Performance Risk System (SPRS) score reflects a contractor’s implementation of the 110 NIST SP 800-171 security requirements. Under the DoD Assessment Methodology you start at 110 and subtract 1, 3, or 5 points for each requirement not yet met, so scores range from 110 down to -203.

What SPRS score do I need for CMMC Level 2?

CMMC Level 2 ultimately requires all 110 requirements implemented (a perfect SPRS score of 110), though a contractor may bid with a plan of action (POA&M) for a limited subset of lower-weighted controls that must be closed within 180 days.

Live tool

CMMC 2.0 self-assessment & SPRS score estimator

Answer for each of the 14 NIST SP 800-171 control families to estimate your SPRS score and CMMC Level 2 readiness — then get a checklist of what to close next.

3.1 Access Control · 22 controls

3.2 Awareness & Training · 3 controls

3.3 Audit & Accountability · 9 controls

3.4 Configuration Management · 9 controls

3.5 Identification & Authentication · 11 controls

3.6 Incident Response · 3 controls

3.7 Maintenance · 6 controls

3.8 Media Protection · 9 controls

3.9 Personnel Security · 2 controls

3.10 Physical Protection · 6 controls

3.11 Risk Assessment · 3 controls

3.12 Security Assessment · 4 controls

3.13 System & Communications Protection · 16 controls

3.14 System & Information Integrity · 7 controls