Free worksheet

SPRS score worksheet

Official DoD Assessment Methodology math for NIST SP 800-171 Rev 2: start at 110, subtract 1, 3, or 5 for each requirement that is not fully implemented. This is a working calculator for your marks — it does not submit a SPRS score and it is not a CMMC assessment.

Data practice: marks live in this browser (local storage) so you can leave and come back. Export is a CSV you download. We do not receive your 110-row marks. Do not enter CUI. Privacy.

Not a C3PAO. Browser arithmetic over your marks using DoD Assessment Methodology v1.2.1. Not an official SPRS submission. Not a CMMC assessment. No CUI.

Free worksheet · 110 requirements · stays in your browser

SPRS score worksheet

Start at 110. Subtract the official 1 / 3 / 5 weight for each requirement that is not fully implemented. Marks never leave this browser unless you export a CSV. Do not type CUI into notes.

MET needs an evidence type. MET with no artifact deducts the full weight and flags optimism.
N/A needs a justification. Official “capability not permitted” cases (remote / wireless / mobile) are labeled on those rows.
Partial credit exists only for 3.5.3 (MFA) and 3.13.11 (FIPS cryptography). A POA&M does not make a row MET.

Working score

110 / 110

Answered: 0 / 110
Deducted: −0
Optimism flags: 0
Unjustified N/A: 0

FamilyFilterSearch

Showing 110 of 110

3.1.1−5FAR 21
Limit system access to authorized users, processes, and devices.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.2−5FAR 21
Limit system access to permitted types of transactions and functions.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.3−1
Control the flow of CUI in accordance with approved authorizations.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.4−1
Separate duties of individuals to reduce the risk of malevolent activity.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.5−3
Employ the principle of least privilege, including for privileged accounts.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.6−1
Use non-privileged accounts or roles when accessing non-security functions.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.7−1
Prevent non-privileged users from executing privileged functions; log those executions.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.8−1
Limit unsuccessful logon attempts.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.9−1
Provide privacy and security notices consistent with applicable CUI rules.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.10−1
Use session lock with pattern-hiding displays after inactivity.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.11−1
Terminate a user session automatically after a defined condition.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.12−5N/A if unused
Monitor and control remote access sessions.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.13−5N/A if unused
Employ cryptographic mechanisms to protect confidentiality of remote access sessions.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.14−1
Route remote access via managed access control points.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.15−1
Authorize remote execution of privileged commands and remote access to security-relevant information.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.16−5N/A if unused
Authorize wireless access prior to allowing such connections.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.17−5N/A if unused
Protect wireless access using authentication and encryption.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.18−5N/A if unused
Control connection of mobile devices.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.19−3
Encrypt CUI on mobile devices and mobile computing platforms.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.20−1FAR 21
Verify and control/limit connections to and use of external systems.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.21−1
Limit use of portable storage devices on external systems.
3.1 · Access Control
unanswered
Notes (no CUI)
3.1.22−1FAR 21
Control CUI posted or processed on publicly accessible systems.
3.1 · Access Control
unanswered
Notes (no CUI)
3.2.1−5
Ensure managers, administrators, and users are aware of security risks and applicable policies.
3.2 · Awareness and Training
unanswered
Notes (no CUI)
3.2.2−5
Ensure personnel are trained to carry out assigned information security-related duties.
3.2 · Awareness and Training
unanswered
Notes (no CUI)
3.2.3−1
Provide security awareness training on recognizing and reporting indicators of insider threat.
3.2 · Awareness and Training
unanswered
Notes (no CUI)
3.3.1−5
Create and retain system audit logs needed to monitor, investigate, and report unauthorized activity.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.2−3
Ensure actions of individual system users can be uniquely traced so they can be held accountable.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.3−1
Review and update logged events.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.4−1
Alert in the event of an audit logging process failure.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.5−5
Correlate audit record review, analysis, and reporting for investigation and response.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.6−1
Provide audit record reduction and report generation to support on-demand analysis.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.7−1
Compare and synchronize internal system clocks with an authoritative source for audit timestamps.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.8−1
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.3.9−1
Limit management of audit logging functionality to a subset of privileged users.
3.3 · Audit and Accountability
unanswered
Notes (no CUI)
3.4.1−5
Establish and maintain baseline configurations and inventories of organizational systems.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.2−5
Establish and enforce security configuration settings for IT products employed in organizational systems.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.3−1
Track, review, approve or disapprove, and log changes to organizational systems.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.4−1
Analyze the security impact of changes prior to implementation.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.5−5
Define, document, approve, and enforce physical and logical access restrictions associated with changes.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.6−5
Employ least functionality by configuring systems to provide only essential capabilities.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.7−5
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.8−5
Apply deny-by-exception (blacklisting) or deny-all, permit-by-exception (whitelisting) for software.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.4.9−1
Control and monitor user-installed software.
3.4 · Configuration Management
unanswered
Notes (no CUI)
3.5.1−5FAR 21
Identify system users, processes acting on behalf of users, and devices.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.2−5FAR 21
Authenticate (or verify) identities of users, processes, or devices before allowing access.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.3−5partial OK
Use multifactor authentication for local and network access to privileged accounts and network access to non-privileged accounts.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.4−1
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.5−1
Prevent reuse of identifiers for a defined period.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.6−1
Disable identifiers after a defined period of inactivity.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.7−1
Enforce a minimum password complexity and change of characters when new passwords are created.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.8−1
Prohibit password reuse for a specified number of generations.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.9−1
Allow temporary password use for system logons with an immediate change to a permanent password.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.10−5
Store and transmit only cryptographically-protected passwords.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.5.11−1
Obscure feedback of authentication information.
3.5 · Identification and Authentication
unanswered
Notes (no CUI)
3.6.1−5
Establish an operational incident-handling capability (prepare, detect, analyze, contain, recover, respond).
3.6 · Incident Response
unanswered
Notes (no CUI)
3.6.2−5
Track, document, and report incidents to designated officials and/or authorities.
3.6 · Incident Response
unanswered
Notes (no CUI)
3.6.3−1
Test the organizational incident response capability.
3.6 · Incident Response
unanswered
Notes (no CUI)
3.7.1−3
Perform maintenance on organizational systems.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.7.2−5
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.7.3−1
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.7.4−3
Check media containing diagnostic and test programs for malicious code before use.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.7.5−5
Require MFA to establish nonlocal maintenance sessions via external networks and terminate when complete.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.7.6−1
Supervise the maintenance activities of maintenance personnel without required access authorization.
3.7 · Maintenance
unanswered
Notes (no CUI)
3.8.1−3
Physically control and securely store system media containing CUI, both paper and digital.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.2−3
Limit access to CUI on system media to authorized users.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.3−5FAR 21
Sanitize or destroy system media containing CUI before disposal or release for reuse.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.4−1
Mark media with necessary CUI markings and distribution limitations.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.5−1
Control access to media containing CUI and maintain accountability during transport outside controlled areas.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.6−1
Implement cryptographic mechanisms to protect CUI stored on digital media during transport unless otherwise protected.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.7−5
Control the use of removable media on system components.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.8−3
Prohibit the use of portable storage devices when such devices have no identifiable owner.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.8.9−1
Protect the confidentiality of backup CUI at storage locations.
3.8 · Media Protection
unanswered
Notes (no CUI)
3.9.1−3
Screen individuals prior to authorizing access to organizational systems containing CUI.
3.9 · Personnel Security
unanswered
Notes (no CUI)
3.9.2−5
Protect systems containing CUI during and after personnel actions such as terminations and transfers.
3.9 · Personnel Security
unanswered
Notes (no CUI)
3.10.1−5FAR 21
Limit physical access to organizational systems, equipment, and operating environments to authorized individuals.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.10.2−5
Protect and monitor the physical facility and support infrastructure for organizational systems.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.10.3−1FAR 21
Escort visitors and monitor visitor activity.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.10.4−1FAR 21
Maintain audit logs of physical access.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.10.5−1FAR 21
Control and manage physical access devices.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.10.6−1
Enforce safeguarding measures for CUI at alternate work sites.
3.10 · Physical Protection
unanswered
Notes (no CUI)
3.11.1−3
Periodically assess risk to operations, assets, and individuals from organizational systems processing CUI.
3.11 · Risk Assessment
unanswered
Notes (no CUI)
3.11.2−5
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities are identified.
3.11 · Risk Assessment
unanswered
Notes (no CUI)
3.11.3−1
Remediate vulnerabilities in accordance with risk assessments.
3.11 · Risk Assessment
unanswered
Notes (no CUI)
3.12.1−5
Periodically assess the security controls in organizational systems to determine if they are effective.
3.12 · Security Assessment
unanswered
Notes (no CUI)
3.12.2−3
Develop and implement plans of action to correct deficiencies and reduce or eliminate vulnerabilities.
3.12 · Security Assessment
unanswered
Notes (no CUI)
3.12.3−5
Monitor security controls on an ongoing basis to ensure continued effectiveness.
3.12 · Security Assessment
unanswered
Notes (no CUI)
3.12.4NArequired to score
Develop, document, and periodically update system security plans describing boundaries, environments, and implementations.
3.12 · Security Assessment
unanswered
3.12.4 is not scored (value NA). If there is no SSP, the methodology says the assessment cannot be completed.
Notes (no CUI)
3.13.1−5FAR 21
Monitor, control, and protect communications at external boundaries and key internal boundaries.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.2−5
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.3−1
Separate user functionality from system management functionality.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.4−1
Prevent unauthorized and unintended information transfer via shared system resources.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.5−5FAR 21
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.6−5
Deny network communications traffic by default and allow by exception (deny all, permit by exception).
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.7−1
Prevent remote devices from simultaneously establishing non-remote connections and split tunneling to external networks.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.8−3
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.9−1
Terminate network connections associated with communications sessions at the end of the sessions or after inactivity.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.10−1
Establish and manage cryptographic keys for cryptography employed in organizational systems.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.11−5partial OK
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.12−1
Prohibit remote activation of collaborative computing devices and provide indication of devices in use.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.13−1
Control and monitor the use of mobile code.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.14−1
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.15−5
Protect the authenticity of communications sessions.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.13.16−1
Protect the confidentiality of CUI at rest.
3.13 · System and Communications Protection
unanswered
Notes (no CUI)
3.14.1−5FAR 21
Identify, report, and correct system flaws in a timely manner.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.2−5FAR 21
Provide protection from malicious code at designated locations within organizational systems.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.3−5
Monitor system security alerts and advisories and take action in response.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.4−5FAR 21
Update malicious code protection mechanisms when new releases are available.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.5−3FAR 21
Perform periodic scans of organizational systems and real-time scans of files from external sources.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.6−5
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)
3.14.7−3
Identify unauthorized use of organizational systems.
3.14 · System and Information Integrity
unanswered
Notes (no CUI)

How to use this number

Export the CSV into your protected environment. This page does not store marks on our servers.
A POA&M does not convert NOT MET to MET under this methodology. CMMC Level 2 POA&M closeout rules (when they apply) are a different scoring path — this worksheet does not apply them.
Pair the arithmetic with the Defensibility Check and the sign-off checklist before anyone affirms a SPRS score.

Full 110-row templates · $199

What this uses

Weights from Annex A of the NIST SP 800-171 DoD Assessment Methodology v1.2.1 (24 Jun 2020)
Short titles condensed from that scoring template — confirm full text in NIST SP 800-171 Rev 2
Floor −203 if every scored requirement is unmet (110 − 313)
3.12.4 (SSP) is not scored; missing SSP means the assessment cannot be completed

After you export

How to calculate your SPRS score
Defensibility Check (optimism / signature risk)
CUI / in-scope system map
Status mapping method
“Can you sign this?” checklist
Pro Pack for SSP / POA&M / objective-level workbook