Check the requirements you have fully implemented and see your estimated SPRS score from 110 down to -203, whether you meet the 88-point minimum for conditional Level 2 status, and which gaps cost the most points.
Runs in your browser · Nothing is stored or sent · Last reviewed October 15, 2026
Tick a requirement when it is fully implemented today and you hold the evidence. A written policy is not an implemented control, and a partly met requirement counts as not met, except the two that allow partial credit.
Requirement wording is from NIST SP 800-171 Rev. 2. Point values follow the DoD Assessment Methodology as published in 32 CFR 170.24. This is an estimate, not an assessment, and it is not legal advice.
Every requirement is worth 5, 3 or 1 point. The system security plan is required but carries no points. If every deduction applies, 110 minus 313 gives the floor of -203.
| Point value | Requirements | Total deduction |
|---|---|---|
| 5 points | 44, including 3.5.3 and 3.13.11 at their full value | 220 |
| 3 points | 14 | 42 |
| 1 point | 51 | 51 |
| No points | 1 (system security plan, 3.12.4) | 0 |
| Total | 110 | 313 |
Partial credit applies to two requirements. Multifactor authentication (3.5.3) deducts 3 points when it covers only remote and privileged users and 5 when it is not implemented. FIPS-validated cryptography (3.13.11) deducts 3 points when encryption is used but is not FIPS-validated and 5 when no encryption is used.
A score is a starting point. These guides cover the decisions that come next.
The Supplier Performance Risk System (SPRS) is the DoD application where contractors post the results of their NIST SP 800-171 assessments. The score starts at 110 and drops by the point value of every requirement that is not fully implemented. It can go as low as -203.
Start at 110, the number of NIST SP 800-171 Rev. 2 requirements. For each requirement that is not met, subtract its value under the DoD Assessment Methodology: 5, 3 or 1 point. Multifactor authentication (3.5.3) and FIPS-validated cryptography (3.13.11) allow partial credit. This calculator applies those values to the 110 requirements.
110 means every requirement is implemented. For conditional Level 2 status under the CMMC program rule, a score of at least 88 out of 110 (80 percent) is required, and the unmet items must be eligible for a plan of action and milestones.
Yes. The lowest possible score is -203. A negative score is permitted, but it signals substantial gaps and should come with a credible remediation plan.
The assessment is based on the system security plan. Under the DoD Assessment Methodology, an assessment cannot be completed without a current plan that describes your system boundary, environment and how each requirement is met.
No. It is a free estimate from Cyberix based on the published point values and the NIST SP 800-171 Rev. 2 requirement text. Your posted score is a representation to the government, so confirm each requirement against NIST SP 800-171A with evidence before you submit it.
No. Everything runs in your browser. Nothing you tick is sent to Cyberix or saved, and clearing the page clears the answers.
No. Self-assessment scoring continues. The suspension affected the start date of third-party certification as a condition of award, not the point values or your NIST SP 800-171 obligations under DFARS 252.204-7012.
Book a free call. We will review the systems that handle CUI, your contract clauses and the fastest path to an accurate SPRS score.