Guides CMMC and SPRS

SPRS score explained: range, weights, and what counts as good

An SPRS score runs from 110 down to -203. How the DoD method subtracts 5, 3 or 1 points per unmet requirement, what 88 means, and how scores are posted.

By Chris Edwards, Edwards Consulting Group · Updated October 22, 2026

An SPRS score is the summary result of a NIST SP 800-171 DoD assessment, posted in the Supplier Performance Risk System. Every contractor starts at 110, one point for each of the 110 security requirements, and each requirement that is not met subtracts 5, 3 or 1 points, so the score can fall to -203. DoD does not define a "good" score: 110 means every requirement is met, and 88 is the least a company can have and still hold a Conditional CMMC Level 2 status with a plan of action.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What is an SPRS score?

Under the DFARS provision at 252.204-7019, an offeror must have a current NIST SP 800-171 DoD assessment, "not more than 3 years old unless a lesser time is specified in the solicitation", with its summary level score posted in SPRS: "e.g., 95 out of 110, NOT the individual value for each requirement". That provision and the clause at 252.204-7020 are the codified text, still printed on acquisition.gov and ecfr.gov. Since February 1, 2026 DoD contracting officers use Class Deviation 2026-O0025, which removes 7019 and replaces 7020 with 252.240-7997; the three-year cycle now rests on 32 CFR 170.16, and the posting and access rules on 7997. See DFARS and FAR cybersecurity clauses, as of 2026.

The method is the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020), and the same arithmetic is written into the CMMC rule at 32 CFR 170.24. A Basic assessment is the contractor's own, and the codified DFARS 252.204-7020 says it carries "a confidence level of 'Low' in the resulting score, because it is a self-generated score"; Medium and High assessments are conducted by Government personnel. The deviation clause 252.240-7997 defines only Medium and High Assessments.

How is an SPRS score calculated?

32 CFR 170.24(c)(2) sets the arithmetic. The maximum score is "equal to the total number of CMMC Level 2 security requirements", 110, and "For each requirement NOT MET, the associated value of the security requirement is subtracted from the maximum score, which may result in a negative score." Each requirement is worth 5, 3 or 1 points:

Value	What the regulation says about the requirement	How many
5	"if not implemented, could lead to significant exploitation of the network, or exfiltration of CUI"	42 named requirements, plus 3.5.3 and 3.13.11 when not implemented at all
3	"if not implemented, have a specific and confined effect on the security of the network and its data"	14 named requirements
1	"a limited or indirect effect on the security of the network and its data"	every remaining requirement (51)

The 5-point and 3-point requirements are listed by number in 170.24(c)(2)(i)(B)(1) and (2). Three more rules:

Not Applicable counts as Met. Under 170.24(b)(3), "an assessment objective assessed as N/A is equivalent to the same assessment objective being assessed as MET."
A plan of action does not change the score. Under 170.24(c)(2)(i)(B)(6), requirements not implemented, "whether described in a POA&M or not", are assessed as NOT MET.
Met needs evidence in final form. Under 170.24(b)(1), "working papers, drafts, and unofficial or unapproved policies" are not acceptable evidence.

Each requirement's points are on its family's page under Requirements: 3.1 Access Control alone can cost 54 of the 110, 3.13 System and Communications Protection 42.

What is the SPRS score range? Why -203 to 110?

The top is 110. The bottom is what is left when every scored requirement is not met: 44 requirements at 5 points (220), 14 at 3 points (42) and 51 at 1 point (51) subtract 313, and 110 minus 313 is -203. Neither the regulation nor the methodology prints -203; it follows from their lists. The methodology's scoring template gives 3.12.4, the system security plan, no value.

A negative score is allowed: both sources say the subtraction "may result in a negative score". It means the unmet requirements are worth more than 110 together, which happens quickly when 44 requirements cost 5 each: twenty-two of them unmet is already 0.

SPRS 3.5.3 and 3.13.11: the only partial credit

Under 170.24(c)(2)(i)(B)(4), "Two derived security requirements, IA.L2-3.5.3 and SC.L2-3.13.11, can be partially effective even if not completely or properly implemented, and the points deducted may be adjusted depending on how the security requirement is implemented."

3.5.3, multifactor authentication. "three (3) points are subtracted from the maximum score if MFA is implemented only for remote and privileged users. Five (5) points are subtracted from the maximum score if MFA is not implemented for any users."
3.13.11, FIPS-validated cryptography. "If encryption is employed, but is not FIPS-validated, three (3) points are subtracted from the maximum score; if encryption is not employed; five (5) points are subtracted from the maximum score."

No other requirement earns partial credit: the methodology says that apart from these two it "is not designed to credit partial implementation".

No system security plan, no score

Under 170.24(c)(2)(i)(B)(5), a company "must have a System Security Plan (SSP) (CMMC security requirement CA.L2-3.12.4) in place at the time of assessment". Without one there is no score at all: "an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012."

What is a good SPRS score?

DoD publishes no threshold called "good". Three numbers matter.

110 means every requirement is met or not applicable. Under 32 CFR 170.16(a)(1), a Final Level 2 (Self) status requires "a MET result for all security requirements", which is 110.
88 is the floor for a Conditional CMMC Level 2 status. Under 32 CFR 170.21(a)(2)(i), the score divided by the number of requirements must be "greater than or equal to 0.8", and 0.8 times 110 is 88. The score alone is not enough: only 1-point requirements may be on the plan of action (3.13.11 may be on it at 3 points), six named requirements never may, and the plan must be closed out within 180 days. The POA&M rules guide covers each condition.
Below 88 rules out a Conditional CMMC status. The assessment and its score are still posted in SPRS: neither 252.204-7019 nor 32 CFR 170.16 sets a minimum score for posting.

A score is only as good as its evidence. Under 32 CFR 170.16(a)(1)(iv), DoD "reserves the right to conduct a DCMA DIBCAC assessment", whose results "will take precedence over any pre-existing CMMC Status", and 170.16(c)(4) requires the artifacts behind a self-assessment to be kept for six years. A 110 that cannot be shown is worth less than an honest 95 with its evidence filed.

How to submit an SPRS score

"SPRS only stores the results of NIST SP 800-171 Assessments"; the assessment happens first. The SPRS Quick Entry Guide (Version 4.0, May 2024) gives the steps:

Get a Procurement Integrated Enterprise Environment (PIEE) account with the SPRS Cyber Vendor User role, which "is required to enter Basic Assessment information".
Sign in at PIEE, open SPRS, then the Cyber Reports module for your company hierarchy.
On the NIST SP 800-171 Assessments tab, choose Add New Assessment and save the details.

The module holds the assessment date, score, scope, plan of action completion date, CAGE code(s), SSP name, version and date, and confidence level. The plan of action completion date is, in the methodology's SPRS entry instructions, the "date that a score of 110 is expected to be achieved for each system security plan assessed"; the SPRS user guide calls it the "Estimated date that all identified deficiencies will be resolved". The CAGE hierarchy comes from SAM.gov. "The Basic Confidence Level is the only assessment that can be maintained (add/edit/delete) by vendors."

Who can see an SPRS score?

Under the codified DFARS 252.204-7019, scores "are available to DoD personnel, and are protected", and "Authorized representatives of the Offeror for which the assessment was conducted may access SPRS" to see their own; the deviation clause 252.240-7997(f) says the same of the Contractor. The SPRS FAQ adds that reports are "not releasable under the Freedom of Information Act" and that anyone who needs a subcontractor's score should "contact them directly": a prime cannot look it up.

How often should an SPRS score be updated?

At least every three years. The codified DFARS 252.204-7019 requires an assessment "not more than 3 years old", and 32 CFR 170.16(a)(1) requires a Level 2 self-assessment "every three years" with the results in SPRS. The Quick Entry Guide says results "turn red when the assessment date expands beyond three years."
Whenever your status changes. The guide says a user "may update as necessary to reflect the company's current status". After a POA&M closeout, 170.16(a)(1)(ii)(B) requires the results in SPRS within 180 days of the Conditional CMMC Status Date.
Affirm every year. Under 32 CFR 170.22, an Affirming Official affirms continuing compliance in SPRS after every assessment, after a closeout, and annually after a Final CMMC Status Date.

Working out your score before you post it

Without an account, the free SPRS score calculator on tiermark.io works the score out the same way, with nothing saved. With Supplier Pro, a paid plan, the SPRS score calculator in the Tiermark supplier console lists the 110 requirements with their points, applies the partial credit for 3.5.3 and 3.13.11, counts not applicable as met, gives no score without a system security plan, and names any gap no plan of action may hold. It is an estimate from your own answers, not an assessment, and Tiermark posts nothing to SPRS.

Where Tiermark fits

Tiermark is supplier-assurance software for defense contractors and their suppliers. With Supplier Pro, a supplier keeps the self-assessment behind its score in the self-assessment workspace, and Compliance dates works out when the next self-assessment, posting, affirmation and POA&M closeout are due and emails reminders. Tiermark never reads SPRS.

SPRS, Conditional status, Affirming Official and the other terms used here are defined in the glossary.

Sources

Still have a question?

Write to help@tiermark.io and a person will answer.