> ## Content Index > Fetch the complete content index at: https://www.cmmcoperator.com/llms.txt > Use this file to discover other available public pages before exploring further. # SPRS Scoring Explained: How CMMC Level 2 Scores Work - URL: https://www.cmmcoperator.com/sprs-scoring/ - Published: 2026-08-15T14:21:41.000Z - Updated: 2026-08-18T17:01:07.000Z - Description: Understand SPRS scoring methodology for CMMC Level 2, including control weights, deductions, POA&Ms, and common misconceptions. - Author: HydratedSec - Tags: CMMC, SPRS, CMMC Level 2 # SPRS Scoring Explained: How CMMC Level 2 Scores Work The Supplier Performance Risk System (SPRS) is the DoD's method for quantifying how well a defense contractor implements the 110 security controls in NIST SP 800-171 Revision 2\. Every organization seeking CMMC Level 2 certification needs to understand how this scoring methodology works and what drives the numbers. A planning score computed from self-reported inputs, including the Suite pre-assessment workbook, is an estimate only. It is NOT an official SPRS score: official scores are calculated under the DoD Assessment Methodology and submitted to SPRS by an authorized representative. ## How SPRS Scoring Works SPRS scoring is simple arithmetic with no partial credit. Here is the complete scoring logic: ### Start at 110 - the perfect score Every organization begins with the maximum score of 110, representing all 110 NIST SP 800-171 R2 controls fully implemented. ### Each control carries a weight: 1, 3, or 5 points The DoD assigns each control a deduction weight based on its security impact. Higher weights mean greater risk when the control is missing. ### NOT\_IMPLEMENTED or PARTIALLY\_IMPLEMENTED: full weight deducted If a control is not fully implemented, its entire weight is subtracted from your score. There is no partial credit - a 5-point control that is 90% implemented still costs you all 5 points. ### FULLY\_IMPLEMENTED: no deduction Controls that are fully implemented preserve your score. The goal is to minimize deductions by achieving full implementation across as many controls as possible, prioritizing higher-weight controls. ### NOT\_APPLICABLE: excluded from scoring Controls that genuinely do not apply to your environment are removed from the calculation entirely. They neither help nor hurt your score. However, N/A designations must be justified and are scrutinized during assessments. **Score range:** the maximum score is 110, with every requirement fully implemented. The commonly quoted floor of -203 is a derived value, 110 minus the 313 total deduction points across all weighted requirements; no DoD document publishes a floor. ## Control Weight Distribution Not all controls are weighted equally. The DoD assigns higher deduction values to controls that have a greater impact on protecting Controlled Unclassified Information (CUI). Understanding this distribution helps you prioritize remediation efforts. | Weight | Controls | Impact Level | Example Control Areas | | ------ | -------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | 5 pts | 44 | Critical Impact | Multi-factor authentication, encryption of CUI at rest and in transit, access control enforcement, audit log review, incident response | | 3 pts | 14 | Moderate Impact | Configuration management, system maintenance procedures, media protection, personnel screening, risk assessments | | 1 pt | 51 | Foundational | Security awareness training, physical access logs, visitor escorts, system boundary documentation | | 0 pts | 1 | Assessment gate | CA.L2-3.12.4, the System Security Plan: carries no deduction weight, because without an SSP a Level 2 assessment cannot proceed at all | **Strategic insight:** A single unimplemented 5-point control costs five times more than a 1-point control. Organizations should prioritize remediating high-weight controls first to maximize their score improvement per unit of effort. ## Scoring Examples These illustrative scenarios show how SPRS scores vary depending on an organization's implementation maturity. Actual scores depend on the specific weights of each non-compliant control. | Scenario | Fully implemented | Partially implemented | Not implemented | Approximate score | | --------------------------------------- | ----------------- | --------------------- | --------------- | ----------------- | | Strong posture: mature security program | 95 | 12 | 3 | 88 | | Average DIB contractor: mid-maturity | 75 | 20 | 15 | 40 | | Early stage: beginning the journey | 40 | 30 | 40 | \-60 | **Strong posture.** A well-prepared contractor with most controls fully implemented. The 15 non-compliant controls (12 partial + 3 not implemented) result in deductions based on their individual weights. Assuming an average weight mix, the estimated deduction is roughly 22 points. **Average DIB contractor.** Represents many defense industrial base contractors in the middle of their compliance journey. With 35 controls not fully implemented, weighted deductions accumulate quickly - especially if several 5-point controls are among them. Estimated deduction is roughly 70 points. **Early stage.** An organization early in its CMMC preparation. With 70 controls not fully implemented, the weighted deductions are substantial. Many critical 5-point controls are likely among the gaps, driving the score well below zero. Estimated deduction is roughly 170 points. These are illustrative approximations, not exact calculations. Your actual SPRS score depends on the specific weights assigned to each non-compliant control in your environment. Use these examples to understand the general relationship between implementation coverage and score. ## Common Misconceptions SPRS scoring is widely misunderstood across the defense industrial base. Clearing up these misconceptions helps organizations plan more effectively. ### “Partial implementation gets half credit” **FALSE.** SPRS scoring is binary for nearly every control: a partially implemented control receives the full weight deduction, the same as not implemented. Exactly two requirements carry codified partial deductions, IA.L2-3.5.3 and SC.L2-3.13.11 (32 CFR 170.24), and under 170.24(b)(1) a partially credited requirement is still NOT MET. Every other control is all or nothing. ### “NOT\_APPLICABLE hurts your score” **FALSE.** Controls marked as not applicable are excluded from the scoring calculation entirely. They do not count against you. The baseline remains 110 regardless of how many controls are marked N/A - but legitimate N/A designations are limited and must be justified. ### “You need a perfect 110 to pass” **NUANCED.** While 110 is the target, CMMC Level 2 allows a Conditional status with an open POA&M, within limits set by 32 CFR 170.21: the assessment score must be at least 88, only requirements valued at 1 point may be deferred (one stated exception: SC.L2-3.13.11 when encryption is employed but not FIPS-validated), six requirements are barred outright, and every item must close within 180 days of the Conditional CMMC Status Date. Check any specific requirement with the [POA&M eligibility checker](https://www.cmmcoperator.com/cmmc-poam-eligibility-checker/). ### “Your SPRS score is permanent” **FALSE.** SPRS scores should be updated whenever your security posture changes - whether through implementing new controls, discovering gaps, or organizational changes. DoD contractors are expected to maintain current scores in the SPRS system and reassess regularly. ## How POA&Ms Affect Your Score Plans of Action and Milestones (POA&Ms) are formal remediation plans that allow organizations to achieve conditional CMMC Level 2 certification while working toward full compliance. However, POA&Ms do not improve your SPRS score. ### Controls on POA&M still count as not implemented Placing a control on a POA&M does not change its scoring impact. The full weight deduction still applies. POA&Ms represent a commitment to remediate, not evidence of implementation. ### 180-day remediation window Organizations granted conditional certification must close out all POA&M items within 180 days. This requires demonstrable progress on each milestone, not just a plan on paper. ### Milestone progress must be demonstrated The POA&M must include specific milestones with target dates, resource allocation, and responsible parties. Assessors evaluate whether the organization has a credible path to full implementation. ### CMMC Level 1 does not allow POA&Ms Unlike Level 2, CMMC Level 1 uses pass/fail scoring with no allowance for Plans of Action and Milestones. Every practice must be fully implemented - there is no conditional path for Level 1. CMMC Operator publishes documentation templates and planning resources for informational purposes only. Planning estimates are based on self-reported inputs and do not constitute a compliance determination or an official SPRS score.