Your SPRS Score, Explained
Most contractors first meet their SPRS score as a number they have to post before they can bid. It is worth understanding what that number actually says. You begin at 110 — one point for each requirement in NIST SP 800-171 Revision 2 — and subtract for every control you have not implemented. The deductions total 313, which is why the scale bottoms out at −203 rather than zero. A contractor who has done nothing does not score badly. They score catastrophically, by design.
That design matters more now than it did a year ago. When the Department of War suspended CMMC Phase 2 in July 2026, it removed the third-party assessment layer — not the underlying obligation. Your SPRS score is still required, still self-attested, and still the figure the government will hold you to.
How the score is built
Start 110
minus 44 controls x 5 points = -220
minus 14 controls x 3 points = -42
minus 51 controls x 1 point = -51
-----
Total available deduction 313
110 - 313 = -203The 42-versus-44 question
Published sources disagree on how many controls carry a five-point weight, and both answers are right. Forty-two carry a straight five-point deduction. Two more — 3.5.3 (multi-factor authentication) and 3.13.11 (FIPS-validated cryptography) — cost five when wholly unimplemented but three when partially implemented. Counting those gives 44 controls at risk of a five-point hit.
The arithmetic only closes on −203 if you count them at full weight, which is the tell that 44 is the right figure for the floor calculation.
The requirement worth zero that can void everything
3.12.4 — the System Security Plan — is the only unscored requirement in the standard. Failing it costs you nothing directly. But the methodology treats a missing SSP as meaning the assessment could not be completed for want of information, which leaves you with no valid score at all.
A requirement worth nothing that invalidates everything is an odd piece of design, and it catches people out. If you need somewhere to start, we publish an ungated SSP template.
Where POA&Ms help, and where they are prohibited
Under 32 CFR 170.21, only one-point requirements may generally be deferred to a POA&M. The single exception is 3.13.11 under its partial-credit condition. Six requirements can never be deferred regardless of weight:
3.1.20 · 3.1.22 · 3.12.4 · 3.10.3 · 3.10.4 · 3.10.5
What counts as a passing score
There is no single pass mark, which surprises people. What exists are thresholds tied to particular outcomes.
110 means every requirement is implemented, with nothing deferred. 88 is the floor for Conditional Level 2 status — eighty percent of 110 — with a 180-day clock to close whatever sits on the POA&M. Below 88, conditional status is not available and the remaining gap has to be closed before it is.
A negative score is not unusual on a first honest assessment and is not a judgement on the organisation. The methodology weights deductions at 313 against a starting 110, so any environment not deliberately built to this standard starts underwater. The useful output of a first assessment is the ordering of what to fix, not the number.
Where the points concentrate
Four families carry 160 of the 313 points at risk: Access Control at 54, System and Communications Protection at 42, Configuration Management at 33, and System and Information Integrity at 31. More than half your exposure sits in four of fourteen families, which is the single most useful fact for sequencing remediation.
Density tells a different story from totals. System and Information Integrity averages 4.43 points per requirement and contains no one-pointers at all — every SI requirement hurts. Audit and Accountability is the inverse: the lowest density in the standard at 2.11, yet it holds three of the ten most-failed requirements in DIBCAC’s published data. Low stakes per control, high failure rate. The control families page has the full table.
Submitting and refreshing your score
The score is entered in the Supplier Performance Risk System, along with the standard assessed against, the date, the scope of the assessment, and the date by which you expect to reach 110. That last field is a commitment, not a formality. If this is your first score, the CMMC self-assessment guide walks through it step by step.
Refresh it whenever the environment materially changes and at minimum annually. A score that was accurate when posted and is no longer accurate is precisely the situation False Claims Act cases turn on — the representation was true once and was left standing after it stopped being true.
Accuracy is the actual risk
Your score is self-attested and relied on by the government. In June 2026 a contractor settled for roughly $500,000 over scores that DoD audits contradicted. With third-party verification suspended, the self-attestation is now the whole control — which raises rather than lowers the standard of care expected.
To work out where you stand, the calculator applies the weights above across all 110 requirements. For what sits behind each family, see the control families. For what changed in July, see program status.
To turn a score into a plan, the SPRS score calculator shows what each gap costs, and a CMMC gap assessment scores all 110 requirements at objective level and orders the fixes.
Frequently asked questions
What is a good SPRS score?
A perfect score is 110. Conditional Level 2 status requires at least 88 with a 180-day closeout on the remainder. Many contractors post negative scores on a first honest self-assessment, which is normal given that the weights total 313.
How often should I refresh my score?
Whenever your environment materially changes, and at minimum annually. A score submitted a year ago that no longer reflects reality is the specific risk the False Claims Act cases turn on.
Can I put a five-point control on a POA&M?
Generally no. Under 32 CFR 170.21 only one-point requirements may be deferred, with 3.13.11 as the sole exception under its partial-credit condition. Six requirements can never be deferred at all.
Does the CMMC suspension affect SPRS reporting?
No. DFARS 252.204-7019 and 7020 were untouched by the July 2026 suspension. If anything the score matters more now, because it is the primary enforcement artefact rather than a preliminary one.