How to Calculate Your SPRS Score: DoD Deductions and Common Mistakes
Understand SPRS score ranges, DoD deduction categories, special scoring cases, and common mistakes. Validate estimates against the official assessment methodology.
Table of Contents(13 sections)
What Is the SPRS Score?
The Supplier Performance Risk System (SPRS) score records a NIST SP 800-171 assessment result. When DFARS 252.204-7019 applies and an offeror is required to implement NIST SP 800-171, a current assessment must be posted in SPRS before award.
The score ranges from -203 to 110. A score of 110 means all applicable requirements were assessed MET; deductions for NOT MET requirements can produce a score as low as -203.
How the Score Is Calculated
The calculation is straightforward:
- Start at 110 (the maximum score)
- Apply the methodology's deduction and special-case rules to each applicable requirement
- A POA&M alone does not establish implementation; apply any expressly permitted methodology exception
The DOD Weight Categories
| DoD weight | Deduction when a requirement is assessed NOT MET |
|---|---|
| 5 | 5 points |
| 3 | 3 points |
| 1 | 1 point |
Note: The score starts at 110 and can fall to -203. An estimate based on user-entered statuses should be validated against the current DoD Assessment Methodology before submission.
Score Interpretation
DoD does not publish qualitative SPRS bands such as "excellent" or "audit-ready." In CMMC Command, a 110 estimate means the entered statuses produced no deductions for numerically weighted requirements. It does not establish that the assessment can be completed, that the SSP requirement is satisfied, that an official SPRS submission occurred, or that CMMC status was achieved. Conditional CMMC Level 2 status has separate eligibility rules, including a minimum score of 88 and restrictions on which items may remain on a POA&M.
Common SPRS Calculation Mistakes
1. Using Equal Weights
Many spreadsheet-based tools treat all controls equally. This produces wildly inaccurate scores. A weight-5 access control gap costs 5x more than a weight-1 supporting control.
2. Counting Partial as Full
An incomplete requirement is generally assessed as NOT MET. The DoD methodology includes specific adjusted deductions for MFA (3.5.3) and FIPS-validated cryptography (3.13.11); apply those conditions explicitly. A POA&M alone does not establish implementation; apply the methodology's expressly permitted exceptions and distinguish them from CMMC POA&M eligibility.
3. POA&M Without Milestones
A useful POA&M entry identifies the finding, planned remediation, milestones, owner, resources, and dates needed for qualified review. Eligibility and required content depend on the applicable CMMC and contract requirements; a vague statement is not enough to manage or validate the work.
4. Not Updating After Changes
An SPRS estimate should be recalculated when an entered assessment result changes. Validate the basis for every change and follow the applicable contract and DoD requirements for maintaining or updating an official SPRS record.
Prioritizing by Weight
Weight-5 requirements carry the largest individual numeric deductions. A requirement that is validly assessed MET instead of NOT MET can recover five points in the estimate, but sequencing should also account for security risk, dependencies, effort, contractual duties, and POA&M eligibility.
High-Impact Control Families
- Access Control (AC): 22 controls, many weight-5. Biggest single impact
- System & Communications Protection (SC): 16 controls, heavy weight-5 concentration
- Identification & Authentication (IA): 11 controls, critical for CUI protection
- Audit & Accountability (AU): 9 controls, frequently flagged by assessors
Automated SPRS Calculation
Manually calculating your SPRS score from a spreadsheet is error-prone and time-consuming. CMMC Command calculates your score in real-time using the official DOD weight table as you assess each control.
Features include:
- Estimated SPRS score that updates as you change entered control statuses
- SPRS Impact Simulator: see exactly how implementing a specific control changes your score
- SPRS trend history: track your score improvement over time
- DoD assessment weights: an estimate based on the published DoD Assessment Methodology
Estimate your SPRS score for free. Review and validate the result before any submission.
Sources
- DoD NIST SP 800-171 Assessment Methodology, version 1.2.1 — scoring, deduction table and special implementation cases.
- DFARS 252.204-7019 — applicable pre-award assessment and SPRS requirements.
- 32 CFR Part 170 — separate Conditional CMMC Status and POA&M rules.
Related Resources
Organize your CMMC preparation
Review all 110 requirements and see an estimated SPRS score based on the statuses you enter. Completion time varies. Free, no credit card.