Free tool

Free SPRS score calculator

Tick each control your company has fully implemented today. The calculator applies the DoD Assessment Methodology weights and shows your estimated score and the gaps worth fixing first. It covers 44 of the 110 controls, so treat the result as an estimate, not a number to submit.

Use the free calculator Turn these gaps into a POA&M, $249

Free preview before you pay. Editable Word files. 14 day refund.

Tick the controls you have fully implemented today.

Your setup People access CUI from outside the office affects 3.1.12

Access Control Everyone has their own named account, no shared logins 3.1.1, 3.1.2 · 5 pts Admin rights are limited and separate from everyday accounts 3.1.5 · 3 pts Screens lock automatically after inactivity 3.1.10 · 3 pts

Awareness and Training Security awareness training happens at hire and annually, with records 3.2.1, 3.2.2 · 5 pts Training includes insider threat awareness 3.2.3 · 1 pt

Audit and Accountability Audit logging is on and actions can be traced to a person 3.3.1, 3.3.2 · 5 pts Someone reviews the logs on a schedule and records that review 3.3.3, 3.3.5 · 3 pts

Configuration Management Standard configurations are documented and enforced 3.4.1, 3.4.2 · 5 pts Changes are approved and recorded before they are made 3.4.3 · 3 pts

Identification and Authentication Multifactor authentication is on for all accounts and all remote access 3.5.3 · 5 pts

Incident Response There is a written incident response plan with named responders 3.6.1 · 5 pts The plan has been tested at least once 3.6.3 · 3 pts

Media Protection Drives and media are sanitized or destroyed before disposal, with a record 3.8.3 · 5 pts Documents and media holding CUI carry CUI markings 3.8.4 · 3 pts Removable media is encrypted, or banned and enforced 3.8.7, 3.8.8 · 3 pts Backups of CUI are kept in a protected, encrypted location 3.8.9 · 1 pt

Personnel Security People are screened before getting CUI access, and access is removed when they leave 3.9.1, 3.9.2 · 3 pts

Physical Protection Physical access to CUI systems is limited to authorized people 3.10.1, 3.10.2 · 5 pts Visitors are escorted and access logs are kept 3.10.3, 3.10.4 · 3 pts

Risk Assessment A risk assessment is performed and documented at least annually 3.11.1 · 3 pts We scan for vulnerabilities and remediate findings 3.11.2, 3.11.3 · 5 pts

Security Assessment Controls are assessed periodically and the plan is kept current 3.12.1, 3.12.3 · 5 pts

System and Communications Protection Traffic is controlled and monitored at the network boundary 3.13.1 · 5 pts Public facing systems sit on a separate subnetwork from CUI 3.13.5 · 5 pts CUI is encrypted in transit, including email and file transfer 3.13.8 · 3 pts Disks are encrypted on laptops, workstations, and servers 3.13.16 · 3 pts We have confirmed the encryption modules are FIPS validated (CMVP certificate) 3.13.11 · 3 pts

System and Information Integrity Endpoint protection is deployed and updates automatically 3.14.2, 3.14.4 · 5 pts Patches are applied on a defined schedule 3.14.1 · 5 pts

How the estimate works

The DoD Assessment Methodology starts at 110 and subtracts 5, 3, or 1 points for every requirement that is not implemented. This calculator applies those weights to the 44 controls it asks about. The other 66 are not assessed here, so a full assessment can only produce the same score or a lower one.

Partial or planned counts as not implemented, exactly as in the methodology. Only tick a box if the control is in place and working today.

Why it can go negative

There is no floor. A company early in this work often scores below zero, which is normal. How the SPRS score is calculated explains the arithmetic in detail.

Before you submit anything

Scores go into the Supplier Performance Risk System and the government relies on them. Assess all 110 requirements against NIST SP 800-171A before submitting, and make sure your System Security Plan and POA&M agree with the score. An overstated score on a DoD contract carries real legal exposure.

Questions

Is this an official SPRS calculator?

No. It applies the published DoD Assessment Methodology weights to the controls it covers. The official score is the one your company calculates from a full assessment and submits.

Why does it cover only 44 controls?

A short checklist cannot honestly assess all 110 requirements. It focuses on many of the heavily weighted and commonly missed ones, and says so.

Does it save my answers?

No. It runs in your browser and sends nothing to us.

Full CMMC Level 2 Documentation Kit, $249

System Security Plan, written around your answers, with your boundary and roles
SPRS Score Worksheet showing your estimated score and every deduction
Plan of Action and Milestones, already filled in with your gaps
CUI Security Policy Manual covering all 14 NIST SP 800-171 control families
START HERE guide with the deadlines that catch people out

Turn these gaps into a POA&M, $249

More guides

Templates, not legal advice. Eaglizer IT is not a C3PAO, a Registered Provider Organization, or a law firm, and does not certify compliance with CMMC or NIST SP 800-171. Documentation is a prerequisite for an assessment, not a substitute for one.