Eaglizer ITHow to calculate your SPRS score
Your SPRS score is a number you submit to the Department of Defense, and it is arithmetic, not opinion. Once you understand the weighting, you can see which gaps are actually worth fixing first.
Free preview before you pay. Editable Word files. 14 day refund.
The arithmetic
The DoD Assessment Methodology starts you at 110, one point for each security requirement in NIST SP 800-171 Rev. 2, then subtracts a weighted value for every requirement that is not implemented.
Most requirements are worth 1 point. A middle tier is worth 3. The requirements whose absence exposes the network broadly are worth 5. There is no floor, so a company at the beginning of this work often scores below zero. That is normal and not an error.
The rule people get wrong
A requirement counts as implemented only when it is actually in place. Partially implemented scores the same as not implemented, and planned scores the same as not implemented. There is no partial credit.
This is why honest scoring usually produces a lower number than people expect the first time, and why the number climbs quickly once the heavyweight items are fixed.
The gaps that cost 5 points
- Multifactor authentication (3.5.3). Usually the cheapest 5 points available, because it is already included with most business identity platforms.
- Malicious code protection (3.14.2, 3.14.4). Endpoint protection deployed and updating automatically.
- Flaw remediation (3.14.1). A real patch cadence with defined windows by severity.
- Vulnerability scanning (3.11.2, 3.11.3). Scanning on a cadence and remediating by severity, with the reports kept.
- Boundary protection (3.13.1) and subnetwork separation (3.13.5). Controlling traffic at the edge and keeping public facing systems off the CUI network.
- Account management (3.1.1, 3.1.2) and audit records (3.3.1, 3.3.2). Named accounts, and logs that trace actions to a person.
- Incident handling (3.6.1) and media sanitization (3.8.3). A real plan with named responders, and a destruction record for drives.
Work the weights, not the list
Fixing a 5 point item takes roughly the same effort as fixing a 1 point item, and moves your score five times further. Sort your gaps by weight before you plan the work. Insider threat awareness training is worth 1 point and takes an afternoon; it is still worth doing, just not first.
Submitting the score
Scores are submitted through the Supplier Performance Risk System, along with the assessment date and the date you expect to close your plan. Assess all 110 requirements before you submit, using NIST SP 800-171A, which states the assessment objective for each one.
The score is expected to move. Rescore after each round of fixes rather than leaving a stale number in the system.
Questions
Can my SPRS score be negative?
Yes. The methodology subtracts weighted points from 110 with no lower bound, so a company at the start of this work commonly scores below zero.
What is a good SPRS score?
Primes increasingly look for a score at or near 110, and some set a floor before awarding work. What matters more day to day is that the score is honest and moving in the right direction with a credible plan behind it.
Does a POA&M item still cost me points?
Yes. An unimplemented requirement is deducted whether or not it is on the plan. The POA&M records the intent to fix it; it does not restore the points.
How often must the score be updated?
At least every three years, and sooner whenever your posture changes materially.
Full CMMC Level 2 Documentation Kit, $249
- System Security Plan, written around your answers, with your boundary and roles
- SPRS Score Worksheet showing your estimated score and every deduction
- Plan of Action and Milestones, already filled in with your gaps
- CUI Security Policy Manual covering all 14 NIST SP 800-171 control families
- START HERE guide with the deadlines that catch people out
More guides
Templates, not legal advice. Eaglizer IT is not a C3PAO, a Registered Provider Organization, or a law firm, and does not certify compliance with CMMC or NIST SP 800-171. Documentation is a prerequisite for an assessment, not a substitute for one.