What is a good SPRS score?

110 is a perfect score, and under CMMC Level 2 the practical target, since a Final Level 2 status requires all 110 requirements to be met (a Conditional status allows limited, time-boxed POA&M items). For the older DFARS 252.204-7019 and -7020 self-assessment obligation, any current score on file satisfies the posting requirement — but primes increasingly screen subcontractors on the number itself.

Where do I submit my SPRS score?

Results are entered in the Supplier Performance Risk System (SPRS), reached through the PIEE portal (piee.eb.mil). For a CMMC Level 2 self-assessment, 32 CFR 170.16 lists what is entered: the CMMC level, the CMMC status date, the assessment scope, the CAGE codes for the systems in that scope, the overall score (for example, 105 out of 110), and whether a POA&M is in use and its status. Under DFARS 252.204-7021, results are entered for each CMMC unique identifier (CMMC UID). The older Basic Assessment (DFARS 252.204-7019 and -7020) also asked for the date you expect to reach a score of 110.

Can my SPRS score really be negative?

Yes. The methodology subtracts up to 313 points from 110, so the floor is −203. A negative score simply means many high-weight requirements are not yet implemented — it is common for first assessments and it improves quickly with the 5-point fixes.

Is this calculator the same as an official assessment?

No. This is an informational estimate that applies the DoD's published scoring method (32 CFR 170.24) to 12 questions. A full self-assessment covers all 110 requirements against the 320 assessment objectives in NIST SP 800-171A — the full WorkuGRC questionnaire walks you through that in plain English.

Guide

SPRS score calculator

This calculator scores you the way the DoD Assessment Methodology does — start at 110, subtract 1, 3, or 5 points for every NIST SP 800-171 requirement you haven't fully implemented. Answer the 12 highest-signal questions below for an estimated range. No signup. Nothing is saved unless you ask us to email your result.

Written by WorkuGRC. Last updated November 12, 2026.

SPRS score estimator

This is the same 12-question tool as on the SPRS score estimator page. The guide to how the score is worked out follows it.

0 of 12 answered

Estimated range −203 to 28

1. Does every person sign in to company computers and systems with their own individual account — no shared logins?
2. Where is multi-factor authentication (MFA) turned on?
3. Are operating systems and software patched promptly, with automatic updates on and critical fixes prioritized?
4. Is reputable antivirus running on all computers, updating itself automatically, with real-time protection plus scheduled scans?
5. Is there a properly configured firewall at your internet connection, with your network designed so sensitive systems are separated from the rest?
6. Is CUI encrypted where it's stored — full-disk encryption on computers, encrypted shares or cloud storage?
7. Is activity logging turned on for your key systems — computers, email/cloud accounts, firewall — and kept for at least 90 days?
8. Do you run vulnerability scans on a schedule (for example monthly) and after major changes?
9. Do you have a written incident response plan — how you'd detect, contain, and recover from a security incident, and who to call?
10. Are standard users prevented from installing software or changing system settings — only admins can?
11. What's your policy on USB drives and other removable media?
12. When you encrypt CUI, is the encryption FIPS-validated?

Your estimate

Answer a question and this shows what it settles. Twelve questions cannot settle all 110 requirements, so the result is a range.

Estimated SPRS range

−203 to 28 (perfect is 110)

The range tightens as you answer. The low end assumes everything not yet answered is missing.

How the SPRS score is actually calculated

The score comes from the DoD's published "NIST SP 800-171 Assessment Methodology." The math is simple but unforgiving:

Start at 110 — one point for each of the 110 security requirements in NIST SP 800-171 Rev 2.
Subtract that control's weight for every requirement not fully implemented: 5 points for the 44 requirements whose absence exposes the network broadly, 3 points for 14 with a narrower effect, and 1 point for the other 51. The weights are fixed in Annex A of the methodology — you don't get to choose them.
There is no partial credit. A requirement is implemented only when every one of its assessment objectives (from NIST SP 800-171A) is met. "Mostly done" deducts the full weight, with exactly two exceptions below.
The floor is −203, not zero. Implementing nothing scores 110 − 313 = −203.

The two partial-credit exceptions: multifactor authentication (3.5.3) deducts 3 instead of 5 if MFA covers remote and privileged users but not yet everyone, and FIPS-validated cryptography (3.13.11) deducts 3 instead of 5 if you encrypt but the cryptography isn't FIPS-validated. One requirement — 3.12.4, the System Security Plan itself — carries no point value, because without an SSP a DoD assessment can't be conducted at all.

A worked example

A 12-person machine shop has done the basics but has no incident-response plan (3.6.1, a 5-point control), no security-awareness training (3.2.1 and 3.2.2, 5 points each), and hasn't set up log review (3.3.3, a 1-point control). Their score is 110 − 5 − 5 − 5 − 1 = 94. A shop that has never run a gap assessment can land far lower on a first honest pass, because the 5-point controls concentrate in areas small businesses rarely formalize.

Frequently asked questions

What is a good SPRS score?: 110 is a perfect score, and under CMMC Level 2 the practical target, since a Final Level 2 status requires all 110 requirements to be met (a Conditional status allows limited, time-boxed POA&M items). For the older DFARS 252.204-7019 and -7020 self-assessment obligation, any current score on file satisfies the posting requirement — but primes increasingly screen subcontractors on the number itself.
Where do I submit my SPRS score?: Results are entered in the Supplier Performance Risk System (SPRS), reached through the PIEE portal (piee.eb.mil). For a CMMC Level 2 self-assessment, 32 CFR 170.16 lists what is entered: the CMMC level, the CMMC status date, the assessment scope, the CAGE codes for the systems in that scope, the overall score (for example, 105 out of 110), and whether a POA&M is in use and its status. Under DFARS 252.204-7021, results are entered for each CMMC unique identifier (CMMC UID). The older Basic Assessment (DFARS 252.204-7019 and -7020) also asked for the date you expect to reach a score of 110.
Can my SPRS score really be negative?: Yes. The methodology subtracts up to 313 points from 110, so the floor is −203. A negative score simply means many high-weight requirements are not yet implemented — it is common for first assessments and it improves quickly with the 5-point fixes.
Is this calculator the same as an official assessment?: No. This is an informational estimate that applies the DoD's published scoring method (32 CFR 170.24) to 12 questions. A full self-assessment covers all 110 requirements against the 320 assessment objectives in NIST SP 800-171A — the full WorkuGRC questionnaire walks you through that in plain English.

Get your full self-assessment score — and the documents that go with it.

The full plain-English questionnaire assesses all 110 requirements, computes your SPRS self-assessment score, and drafts your System Security Plan and POA&M for you to review.

Start your full assessment →

Informational only — not a compliance determination, an assessment, or legal advice. Requirements are defined by NIST SP 800-171 Rev 2, NIST SP 800-171A, the DoD Assessment Methodology, and 32 CFR Part 170; always verify against the official publications.