SPRS score calculator for CMMC Level 2 (NIST SP 800-171)
An SPRS score starts at 110 and loses 1, 3, or 5 points for each NIST SP 800-171 requirement not met, down to -203. Mark each requirement below to get your score the DoD way, with partial credit for multifactor sign-in and FIPS encryption, the POA&M rules, and whether you qualify for Conditional Level 2.
- 110the highest score: every requirement met
- -203the lowest score: nothing met
- 88the minimum for Conditional Level 2 (80% of 110)
- 180 daysto close POA&M items under Conditional status
Access Control (AC)
3.1.1
-5 pts
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
May not go on a POA&M.
3.1.2
-5 pts
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
May not go on a POA&M.
3.1.3
-1 pts
Control the flow of CUI in accordance with approved authorizations.
May go on a POA&M.
3.1.4
-1 pts
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
May go on a POA&M.
3.1.5
-3 pts
Employ the principle of least privilege, including for specific security functions and privileged accounts.
May not go on a POA&M.
3.1.6
-1 pts
Use non-privileged accounts or roles when accessing nonsecurity functions
May go on a POA&M.
3.1.7
-1 pts
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
May go on a POA&M.
3.1.8
-1 pts
Limit unsuccessful logon attempts.
May go on a POA&M.
3.1.9
-1 pts
Provide privacy and security notices consistent with applicable CUI rules.
May go on a POA&M.
3.1.10
-1 pts
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity
May go on a POA&M.
3.1.11
-1 pts
Terminate (automatically) a user session after a defined condition.
May go on a POA&M.
3.1.12
-5 pts
Monitor and control remote access sessions.
May not go on a POA&M.
3.1.13
-5 pts
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
May not go on a POA&M.
3.1.14
-1 pts
Route remote access via managed access control points.
May go on a POA&M.
3.1.15
-1 pts
Authorize remote execution of privileged commands and remote access to security-relevant information.
May go on a POA&M.
3.1.16
-5 pts
Authorize wireless access prior to allowing such connections
May not go on a POA&M.
3.1.17
-5 pts
Protect wireless access using authentication and encryption
May not go on a POA&M.
3.1.18
-5 pts
Control connection of mobile devices.
May not go on a POA&M.
3.1.19
-3 pts
Encrypt CUI on mobile devices and mobile computing platforms.
May not go on a POA&M.
3.1.20
-1 pts
Verify and control/limit connections to and use of external systems.
May not go on a POA&M.
3.1.21
-1 pts
Limit use of portable storage devices on external systems.
May go on a POA&M.
3.1.22
-1 pts
Control CUI posted or processed on publicly accessible systems.
May not go on a POA&M.
Awareness and Training (AT)
3.2.1
-5 pts
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to
May not go on a POA&M.
3.2.2
-5 pts
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
May not go on a POA&M.
3.2.3
-1 pts
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
May go on a POA&M.
Audit and Accountability (AU)
3.3.1
-5 pts
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
May not go on a POA&M.
3.3.2
-3 pts
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
May not go on a POA&M.
3.3.3
-1 pts
Review and update logged events.
May go on a POA&M.
3.3.4
-1 pts
Alert in the event of an audit logging process failure.
May go on a POA&M.
3.3.5
-5 pts
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
May not go on a POA&M.
3.3.6
-1 pts
Provide audit record reduction and report generation to support on-demand analysis and reporting.
May go on a POA&M.
3.3.7
-1 pts
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records
May go on a POA&M.
3.3.8
-1 pts
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
May go on a POA&M.
3.3.9
-1 pts
Limit management of audit logging functionality to a subset of privileged users.
May go on a POA&M.
Configuration Management (CM)
3.4.1
-5 pts
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
May not go on a POA&M.
3.4.2
-5 pts
Establish and enforce security configuration settings for information technology products employed in organizational systems.
May not go on a POA&M.
3.4.3
-1 pts
Track, review, approve or disapprove, and log changes to organizational systems.
May go on a POA&M.
3.4.4
-1 pts
Analyze the security impact of changes prior to implementation.
May go on a POA&M.
3.4.5
-5 pts
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
May not go on a POA&M.
3.4.6
-5 pts
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
May not go on a POA&M.
3.4.7
-5 pts
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
May not go on a POA&M.
3.4.8
-5 pts
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
May not go on a POA&M.
3.4.9
-1 pts
Control and monitor user-installed software.
May go on a POA&M.
Identification and Authentication (IA)
3.5.1
-5 pts
Identify system users, processes acting on behalf of users, and devices.
May not go on a POA&M.
3.5.2
-5 pts
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
May not go on a POA&M.
3.5.3
-5 pts
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. .
May not go on a POA&M. Partly met: -3 (MFA for remote and privileged users only, not general users).
3.5.4
-1 pts
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
May go on a POA&M.
3.5.5
-1 pts
Prevent reuse of identifiers for a defined period.
May go on a POA&M.
3.5.6
-1 pts
Disable identifiers after a defined period of inactivity.
May go on a POA&M.
3.5.7
-1 pts
Enforce a minimum password complexity and change of characters when new passwords are created.
May go on a POA&M.
3.5.8
-1 pts
Prohibit password reuse for a specified number of generations.
May go on a POA&M.
3.5.9
-1 pts
Allow temporary password use for system logons with an immediate change to a permanent password.
May go on a POA&M.
3.5.10
-5 pts
Store and transmit only cryptographically-protected passwords.
May not go on a POA&M.
3.5.11
-1 pts
Obscure feedback of authentication information
May go on a POA&M.
Incident Response (IR)
3.6.1
-5 pts
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
May not go on a POA&M.
3.6.2
-5 pts
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
May not go on a POA&M.
3.6.3
-1 pts
Test the organizational incident response capability.
May go on a POA&M.
Maintenance (MA)
3.7.1
-3 pts
Perform maintenance on organizational systems..
May not go on a POA&M.
3.7.2
-5 pts
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
May not go on a POA&M.
3.7.3
-1 pts
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
May go on a POA&M.
3.7.4
-3 pts
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
May not go on a POA&M.
3.7.5
-5 pts
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
May not go on a POA&M.
3.7.6
-1 pts
Supervise the maintenance activities of maintenance personnel without required access authorization.
May go on a POA&M.
Media Protection (MP)
3.8.1
-3 pts
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
May not go on a POA&M.
3.8.2
-3 pts
Limit access to CUI on system media to authorized users
May not go on a POA&M.
3.8.3
-5 pts
Sanitize or destroy system media containing CUI before disposal or release for reuse.
May not go on a POA&M.
3.8.4
-1 pts
Mark media with necessary CUI markings and distribution limitations.
May go on a POA&M.
3.8.5
-1 pts
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
May go on a POA&M.
3.8.6
-1 pts
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
May go on a POA&M.
3.8.7
-5 pts
Control the use of removable media on system components.
May not go on a POA&M.
3.8.8
-3 pts
Prohibit the use of portable storage devices when such devices have no identifiable owner.
May not go on a POA&M.
3.8.9
-1 pts
Protect the confidentiality of backup CUI at storage locations.
May go on a POA&M.
Personnel Security (PS)
3.9.1
-3 pts
Screen individuals prior to authorizing access to organizational systems containing CUI.
May not go on a POA&M.
3.9.2
-5 pts
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers
May not go on a POA&M.
Physical Protection (PE)
3.10.1
-5 pts
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
May not go on a POA&M.
3.10.2
-5 pts
Protect and monitor the physical facility and support infrastructure for organizational systems.
May not go on a POA&M.
3.10.3
-1 pts
Escort visitors and monitor visitor activity.
May not go on a POA&M.
3.10.4
-1 pts
Maintain audit logs of physical access.
May not go on a POA&M.
3.10.5
-1 pts
Control and manage physical access devices.
May not go on a POA&M.
3.10.6
-1 pts
Enforce safeguarding measures for CUI at alternate work sites.
May go on a POA&M.
Risk Assessment (RA)
3.11.1
-3 pts
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the assoc
May not go on a POA&M.
3.11.2
-5 pts
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
May not go on a POA&M.
3.11.3
-1 pts
Remediate vulnerabilities in accordance with risk assessments.
May go on a POA&M.
Security Assessment (CA)
3.12.1
-5 pts
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
May not go on a POA&M.
3.12.2
-3 pts
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
May not go on a POA&M.
3.12.3
-5 pts
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
May not go on a POA&M.
3.12.4
required
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to
May not go on a POA&M.
System and Communications Protection (SC)
3.13.1
-5 pts
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
May not go on a POA&M.
3.13.2
-5 pts
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
May not go on a POA&M.
3.13.3
-1 pts
Separate user functionality from system management functionality.
May go on a POA&M.
3.13.4
-1 pts
Prevent unauthorized and unintended information transfer via shared system resources.
May go on a POA&M.
3.13.5
-5 pts
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
May not go on a POA&M.
3.13.6
-5 pts
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
May not go on a POA&M.
3.13.7
-1 pts
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
May go on a POA&M.
3.13.8
-3 pts
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
May not go on a POA&M.
3.13.9
-1 pts
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
May go on a POA&M.
3.13.10
-1 pts
Establish and manage cryptographic keys for cryptography employed in organizational systems.
May go on a POA&M.
3.13.11
-5 pts
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
May go on a POA&M only when partly met. Partly met: -3 (Encryption employed, but not FIPS-validated).
3.13.12
-1 pts
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device..
May go on a POA&M.
3.13.13
-1 pts
Control and monitor the use of mobile code.
May go on a POA&M.
3.13.14
-1 pts
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
May go on a POA&M.
3.13.15
-5 pts
Protect the authenticity of communications sessions.
May not go on a POA&M.
3.13.16
-1 pts
Protect the confidentiality of CUI at rest.
May go on a POA&M.
System and Information Integrity (SI)
3.14.1
-5 pts
Identify, report, and correct system flaws in a timely manner.
May not go on a POA&M.
3.14.2
-5 pts
Provide protection from malicious code at designated locations within organizational systems.
May not go on a POA&M.
3.14.3
-5 pts
Monitor system security alerts and advisories and take action in response.
May not go on a POA&M.
3.14.4
-5 pts
Update malicious code protection mechanisms when new releases are available.
May not go on a POA&M.
3.14.5
-3 pts
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
May not go on a POA&M.
3.14.6
-5 pts
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
May not go on a POA&M.
3.14.7
-3 pts
Identify unauthorized use of organizational systems.
May not go on a POA&M.
Your score: -203 / 110. What next?
Get the full checklist with every requirement, its points, and the records assessors ask for. Gardience then checks and fixes the technical side on your Windows and Linux machines and keeps this score live from evidence: Starter plus the CMMC add-on is $10,000 a year.
Get the CMMC Level 2 checklistBuy Starter + CMMC ($10,000 a year)Book a 15-minute walkthroughYour answers stay in this browser. Nothing is sent anywhere.
How is an SPRS score calculated?
#The DoD Assessment Methodology, adopted in 32 CFR 170.24, starts at 110 and subtracts the value of every requirement that is not met. Requirements are worth 5, 3, or 1 points. Two allow partial credit: multifactor sign-in (3.5.3) costs 3 points instead of 5 when it covers remote and privileged users but not general users, and FIPS cryptography (3.13.11) costs 3 instead of 5 when encryption is used but not FIPS-validated. The System Security Plan (3.12.4) has no point value, but without it an assessment cannot be completed.
A worked example
#A contractor meets every requirement except two: disks are encrypted, but not with FIPS-validated cryptography (3.13.11, partly met, 3 points instead of 5), and failed sign-in attempts are not limited (3.1.8, not met, 1 point). The score is 110 - 3 - 1 = 106. Both items may go on a POA&M (3.13.11 only because it is partly met), so the contractor qualifies for Conditional Level 2 and has 180 days to close them.
Now say multifactor sign-in also covers only remote and privileged users, not general users (3.5.3, partly met). It costs 3 points instead of 5, so the score is 110 - 3 - 1 - 3 = 103, still above 88. But 3.5.3 may never go on a POA&M, so the contractor is not eligible for Conditional Level 2 until multifactor sign-in covers everyone.
What does Conditional Level 2 require?
#A score of at least 88, which is 80% of 110, and every open requirement eligible for a POA&M. Requirements worth 3 or 5 points, and five worth 1 point, may not be on a POA&M; FIPS cryptography (3.13.11) may be only when partly met. Every open item must be closed within 180 days.
How does Gardience fill this in for you?
#Gardience checks the technical requirements on every Windows and Linux machine, fixes them with your approval, and collects your records for the rest. The score updates as evidence arrives, and the System Security Plan, POA&M, and a signed evidence pack come from the same data. See CMMC Level 2 with Gardience.
Questions
#What is a good SPRS score?
#110 means every requirement is met. 88 or higher, with every open item eligible for a POA&M, qualifies for Conditional Level 2 status.
Can a score be negative?
#Yes. The lowest possible score is -203, when no requirement is met.
Where do I report my score?
#In the Supplier Performance Risk System (SPRS), for each system you assess, with the date of your System Security Plan.
Sources
#Checked November 7, 2026.
- 32 CFR 170.24, CMMC scoring methodology: the point values, partial credit, and the score range.
- 32 CFR 170.21, Conditional Level 2: the 88-point minimum, the requirements that may not go on a POA&M, and the 180-day close-out.
- DoD NIST SP 800-171 Assessment Methodology, version 1.2.1, the scoring the rule adopts.
- NIST SP 800-171 Rev. 2, the requirement text below.
Read more
- CMMC Phase 2 is paused: what defense suppliers still owe
- STIG and CIS evidence for assessors: Windows and Linux
Check your CMMC Level 2 score, then close the gaps
Score all 110 requirements free with the SPRS calculator. Gardience then checks and fixes the technical side on your Windows and Linux machines and keeps the evidence for the rest: Starter plus the CMMC add-on is $10,000 a year, free for 90 days.
Free SPRS score calculatorBuy Starter + CMMCCMMC Level 2 checklistBook a 15-minute CMMC walkthrough