How to Calculate Your SPRS Score — and Whether It's Defensible
Quick answer: A SPRS score starts from a perfect 110 and subtracts weighted values for controls that are not fully implemented. Weights are commonly 1, 3, or 5 depending on the control. Calculation is the easy half—defensibility requires evidence, correct scope, and a score someone can sign without inventing maturity.
Key takeaways
- Learn the 110 baseline and weighted deductions before you trust a tool output.
- Some controls are not POA&M-friendly in the way teams hope—know the rules you are using.
- Pair every calculation with a signature-risk review.
The arithmetic (conceptual)
At a high level, DoD’s assessment scoring methodology for NIST SP 800-171:
- Start at 110
- For each control not fully implemented, subtract its weight (commonly 5, 3, or 1)
- Results can fall well below zero (methodology allows deep negatives) when many controls are unmet
Always confirm the current official scoring methodology you are required to use for your assessment—do not rely on a blog as the legal source.
Weights in plain English
| Weight | Meaning in practice |
|---|---|
| 5 | High impact if missing; errors here swing scores hard |
| 3 | Material controls; easy to under-document |
| 1 | Still required; death by a thousand cuts if ignored in bulk |
Teams that treat every row like a “1” produce nonsense totals.
Defensibility layer (the part most calculators skip)
After you have a number, ask:
- Scope — Did we assess the real CUI environment?
- Evidence — Can we show implemented controls?
- Consistency — Does the SSP match the marks?
- POA&M honesty — Are open items tracked with owners and dates?
- Signature — Would we sign this under scrutiny? (False Claims Act guide)
Worked mindset example
Suppose two companies both “score” 70:
- Company A sampled evidence, documented partials correctly, and briefed leadership.
- Company B copied last year’s sheet and upgraded marks because “we bought a firewall.”
Same arithmetic surface; different legal and operational risk.
New to the terms? CMMC & DFARS glossary covers SPRS, POA&M, weights, and related acronyms.
Calculate, then check defensibility
- Complete (or refresh) your control-by-control assessment.
- Apply official weights carefully.
- Run the free Defensibility Check for optimism patterns.
- Return to the suspension guide for the broader 2026 context.
Frequently asked questions
What is a 'good' SPRS score?
The score that truthfully reflects your environment and meets contractual expectations—not the highest number you can rationalize. A lower honest score with a real POA&M plan is safer than a fictionally high one.
Can software calculate it for me?
Tools help with arithmetic and tracking. They cannot see whether your control marks are true. Garbage in, confident garbage out.
This page is readiness and advisory guidance only. It is not legal advice, a certification, or a substitute for a formal NIST SP 800-171 / CMMC assessment. CUI designation is driven by government requirements and contract language—not by this site.