SPRS Score Calculator: Self-Compute Your 110-Point NIST SP 800-171 Score

The Supplier Performance Risk System (SPRS) is the DoD's central scoring and reporting system for supplier cybersecurity posture. Since November 30, 2020, every prime and subcontractor that handles Controlled Unclassified Information (CUI) must perform a self-assessment against the 110 security controls in NIST SP 800-171 Rev 2 and submit the resulting numerical score to the SPRS portal. That score, on a scale of -203 to +110, tells contracting officers how far a supplier is from full CMMC Level 2 readiness before the contract award.

The rule that made this mandatory is DFARS clause 252.204-7019, which requires a current SPRS assessment as a condition of contract award, and 252.204-7020, which requires the prime to flow the requirement down to every subcontractor that will receive CUI. A missing, expired, or zero-filled SPRS submission is a compliance gap that can stall a contract file review and eliminate a bid from evaluation.

The score has three practical effects. First, contracting officers can see it directly in SPRS when evaluating award decisions. Second, primes increasingly refuse to flow CUI down to subs with low scores because the prime inherits the sub's exposure. Third, the score anchors the conversation with your Certified Third-Party Assessor Organization (C3PAO) when you move to a formal CMMC Level 2 assessment. A score of 110 with a valid System Security Plan means you are ready to schedule a C3PAO engagement. A lower score maps to a Plan of Action and Milestones with concrete remediation timelines.

The SPRS score is self-reported. That does not mean it is optional. The DoD's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) performs spot-check Medium and High assessments against the same 110 controls. A self-reported 110 that a DIBCAC audit cannot substantiate is a False Claims Act exposure. The calculator on this page is a planning instrument, not a substitute for a formal gap assessment.

Weight 5 controls carry the most penalty because the DoD treats them as foundational. Miss a weight 5 control and your ceiling score falls by 5 points. There are 42 weight 5 controls, 14 weight 3 controls that reduce to weight 1 once partially remediated, and the rest at weight 1. If you miss every single control, the math produces a score of -203 (110 minus the total 313-point penalty), which is the official floor of the SPRS scale.

Three rules shape how the calculation actually works in practice. First, a control is either fully implemented or it is not. There is no partial credit in SPRS. A control implemented for 80% of systems still counts as not implemented for scoring. Second, a Plan of Action and Milestones (POA&M) can hold an implementation date, but the score itself does not rise until the control is actually implemented and evidenced. Third, the CMMC final rule (effective 2025) limits POA&M eligibility to controls with weights of 1 or 3 only. All weight 5 controls must be fully implemented to pass the C3PAO assessment, regardless of the SPRS math.

This calculator lets you check each of the 110 controls as implemented or not. The score updates in real time as you toggle. Families are organized by NIST SP 800-171 control family (Access Control, Configuration Management, Incident Response, and so on), so you can see which areas are dragging your score the most. The tool persists your selections in your browser so you can come back later without losing progress.

Many defense contractors treat SPRS and CMMC as separate programs. They are connected. CMMC Level 2, which is the tier required for contracts involving CUI, is essentially a third-party validation of the same 110 NIST SP 800-171 Rev 2 controls that feed your SPRS score. A perfect self-reported SPRS score of 110 with a valid System Security Plan means you are ready to schedule a C3PAO assessment. The assessor will spot-check your evidence, confirm the controls are actually implemented, and issue the Level 2 certification if they hold up.

The reverse is also true. If your SPRS score is 45, you are not ready for a C3PAO engagement. Attempting an assessment in that state wastes $30,000 to $120,000 of engagement fees and burns 6 to 18 months of calendar time. The cost-effective path is to use the SPRS calculator as your directional instrument, build a Plan of Action and Milestones, remediate in priority order, re-run the self-assessment every quarter, and only schedule the C3PAO when your score is reliably at or near 110.

The CMMC final rule also sets a hard 180-day ceiling on any POA&M that survives into a Level 2 assessment. If you are still carrying open findings 180 days after the assessment, your certification is at risk. That makes the SPRS calculator not just a pre-assessment tool but also a during-engagement tool, because you need to close gaps faster than you used to.

A common mistake we see in CMMC gap engagements at Petronella Technology Group is contractors who submitted a 110 to SPRS in 2021 without ever implementing FIPS-validated cryptography or multi-factor authentication on every privileged account. The self-reported score looks great, the DIBCAC Medium assessment is brutal. The calculator gives you a chance to honestly re-score now, before anyone else does.