SPRS Score Calculator
Score all 110 requirements in NIST SP 800-171 Revision 2 using the DoD Assessment Methodology weighting, including partial credit on the only two controls that allow it.
Everything starts as not implemented, which is why you begin at −203. Mark what you actually have in place.
Score each family
Five-point requirements
This is an estimate, not a submission. It applies the DoD Assessment Methodology weighting to your own answers. A real score requires assessing against the 320 objectives in NIST SP 800-171A, where most “met” answers turn out to be partial.
Your answers stay in this browser and are not sent anywhere unless you press Save below, which stores the assessment so a resume link can bring you back to it. No email is required either way. Separately, we record a coarse score band — negative, 0–50, 51–89, 90–110 — never your figure and never your answers. Nothing here is submitted to DoD or to SPRS; posting your score is something only you can do.
How the weighting works
Forty-two requirements carry a straight five-point deduction. Two more — 3.5.3 (multi-factor authentication) and 3.13.11 (FIPS-validated cryptography) — cost five when wholly unimplemented and three when partially implemented. Fourteen requirements are worth three points, fifty-one are worth one, and 3.12.4 is worth nothing at all.
Those weights total 313. Starting from 110, that puts the floor at −203. The full breakdown by family is on the control families page, and how the score is built covers the arithmetic.
How to use it honestly
The calculator is only as good as the answers you give it, and the temptation is to answer as the organisation you intend to be rather than the one you are. Three habits keep it useful.
Answer for the whole scope, not the best part of it. If MFA covers your Microsoft 365 tenant but not the engineering workstation that opens CAD files from a prime, the requirement is not met. Scope is set by where CUI actually lives — see finding CUI in your environment.
Answer for what you can evidence. If an assessor asked for the artefact today, would it exist? “We do that” without a policy, a configuration export or a log is a partial at best.
Use “partial” only where the methodology allows it. Two requirements carry partial credit and no others. Everything else is implemented or it is not.
What the two partial-credit controls mean
3.5.3 covers multi-factor authentication. Full credit requires MFA for local and network access to privileged accounts and for network access to non-privileged accounts. If you have it for remote and privileged users but not for general users, the deduction is 3 rather than 5.
3.13.11 covers FIPS-validated cryptography. The distinction people miss is between an algorithm and a validated module: using AES is not the same as using a CMVP-certificated implementation configured in FIPS mode. If encryption is in place but not FIPS-validated, the deduction is 3 rather than 5.
Both appear in DIBCAC’s published list of most-failed requirements — 3.13.11 at number one and 3.5.3 at number two — so if you are unsure about either, assume the answer is less favourable than it feels.
What the number is for
Three things, in order of usefulness. First, sequencing: it tells you which families cost you most, so remediation starts where the points are. Second, budgeting: the distance to 88 is a reasonable proxy for how much work stands between you and conditional status. Third, and least, the figure itself — which should be replaced by a properly assessed score before anything is posted to SPRS.
Where estimates go wrong
Almost always in the same place: answering at requirement level rather than objective level. “We use MFA” feels like a yes. NIST SP 800-171A breaks that requirement into objectives covering which accounts, which access paths, and how it is enforced — and a real assessment tests every one.
If you want the number you could actually defend, that is what a readiness assessment produces.
Frequently asked questions
Is this calculator free?
Yes, and it is ungated. There is no email wall and nothing you enter is transmitted — the calculation runs entirely in your browser.
How accurate is the result?
The arithmetic is exact: it applies the DoD Assessment Methodology weights to your answers. Its accuracy depends on your answers being honest at the objective level, which is where most self-assessments overstate. Treat it as a working figure, not a submission.
Why does it start at minus 203?
Because nothing is marked as implemented yet. You begin at 110 and the total available deduction is 313, so an environment with nothing in place scores minus 203. Marking controls as met moves the number up.
What do I do with the number?
If it is below 88 you cannot reach conditional Level 2 status without more remediation. Either way, your posted SPRS score should reflect a real assessment against NIST SP 800-171A objectives, not this estimate.
Want a second opinion on your score?
A self-assessed score is a representation to the government. We will check yours against the 320 assessment objectives and show you where it will not hold up.