How to Calculate Your SPRS Score: DOD Weight Table & Step-by-Step Guide

What Is the SPRS Score?

The Supplier Performance Risk System (SPRS) score records a NIST SP 800-171 assessment result. When DFARS 252.204-7019 applies and an offeror is required to implement NIST SP 800-171, a current assessment must be posted in SPRS before award.

The score ranges from -203 to 110. A score of 110 means all applicable requirements were assessed MET; deductions for NOT MET requirements can produce a score as low as -203.

How the Score Is Calculated

The calculation is straightforward:

1. Start at 110 (the maximum score)
2. For each applicable requirement assessed as NOT MET, subtract the DoD weight
3. A POA&M records the remediation plan but does not prevent the deduction

The DOD Weight Categories

Note: The score starts at 110 and can fall to -203. An estimate based on user-entered statuses should be validated against the current DoD Assessment Methodology before submission.

Score Interpretation

DoD does not publish qualitative SPRS bands such as "excellent" or "audit-ready." In CMMC Command, a 110 estimate means the entered statuses produced no deductions for numerically weighted requirements. It does not establish that the assessment can be completed, that the SSP requirement is satisfied, that an official SPRS submission occurred, or that CMMC status was achieved. Conditional CMMC Level 2 status has separate eligibility rules, including a minimum score of 88 and restrictions on which items may remain on a POA&M.

Common SPRS Calculation Mistakes

1. Using Equal Weights

Many spreadsheet-based tools treat all controls equally. This produces wildly inaccurate scores. A weight-5 access control gap costs 5x more than a weight-1 supporting control.

2. Counting Partial as Full

A partially implemented requirement is assessed as NOT MET and deducted under the methodology. A POA&M does not create partial credit or avoid the deduction.

3. POA&M Without Milestones

A useful POA&M entry identifies the finding, planned remediation, milestones, owner, resources, and dates needed for qualified review. Eligibility and required content depend on the applicable CMMC and contract requirements; a vague statement is not enough to manage or validate the work.

4. Not Updating After Changes

An SPRS estimate should be recalculated when an entered assessment result changes. Validate the basis for every change and follow the applicable contract and DoD requirements for maintaining or updating an official SPRS record.

Prioritizing by Weight

Weight-5 requirements carry the largest individual numeric deductions. A requirement that is validly assessed MET instead of NOT MET can recover five points in the estimate, but sequencing should also account for security risk, dependencies, effort, contractual duties, and POA&M eligibility.

High-Impact Control Families

• Access Control (AC): 22 controls, many weight-5. Biggest single impact
• System & Communications Protection (SC): 16 controls, heavy weight-5 concentration
• Identification & Authentication (IA): 11 controls, critical for CUI protection
• Audit & Accountability (AU): 9 controls, frequently flagged by assessors

Automated SPRS Calculation

Manually calculating your SPRS score from a spreadsheet is error-prone and time-consuming. CMMC Command calculates your score in real-time using the official DOD weight table as you assess each control.

Features include:

• Estimated SPRS score that updates as you change entered control statuses
• SPRS Impact Simulator: see exactly how implementing a specific control changes your score
• SPRS trend history: track your score improvement over time
• DoD assessment weights: an estimate based on the published DoD Assessment Methodology

Estimate your SPRS score for free. Review and validate the result before any submission.