What it is
Your NIST SP 800-171 self-assessment score posted to the DoD’s Supplier Performance Risk System.
NerdsToGo DefenseTHE GOVCON CMMC NERDBook a strategy session110
Free NIST SP 800-171 self-assessment toolIs Your SPRS Score
Is Your SPRS Score
Defensible?
Required under DFARS 252.204-7019 / 7020
Most defense contractors guess their score. Some guess high — and that guess is a federal attestation. Calculate your real NIST SP 800-171 self-assessment score in about 10 minutes, free.
Registered Practitioner Organization▪⌖ Alexandria, VA▪Serving the Defense Industrial Base
110Controls in NIST SP 800-171
−203The floor of the scoring range
5 · 3 · 1Point weights per control
3 YRSMax age of a valid score
01
The basics
What is an SPRS score?
Three things every defense contractor should know before touching the calculator.
Why it matters
A current assessment is tied to DoD award eligibility, and an inflated score can create serious exposure.
How it works
Start at 110. Deduct 5, 3, or 1 points for requirements that are not fully implemented.
02
The math
How scoring works
You don’t earn points.
You lose them.
Every assessment starts at 110. Each requirement you cannot prove as fully implemented subtracts its assigned weight. A POA&M documents the plan; it does not restore points.
110−Gaps=Your score
−5High-impact requirements
−3Important requirements
−1Standard requirements
Fully implemented
Every scored requirement is implemented and supported by evidence.
Mid-maturity
Real fundamentals are in place. Focus on the highest-weight gaps first.
High risk
Contract eligibility and prime relationships may be exposed.
Significant exposure
Build a realistic remediation plan before attesting to a score.
03
Free assessment
Calculate your score
Private, browser-based assessmentKnow the number.
Know the number.
Then make it defensible.
Work through all 14 control families in about 10 minutes. Nothing is submitted to SPRS, and your progress stays in this browser.
110requirements
14control families
10minutes
The number is only step one
A score without evidence is just a guess.
“The strongest score isn’t the highest number. It’s the number you can prove.”
04
Keep learning
Build the paper trail
The SPRS Score,
Explained.
A plain-English guide to the number, the methodology, and what comes next.
Read the FAQsIs Your Score
Defensible?
The evidence questions to ask before anything touches SPRS.
Review it with us05
Straight answers
Frequently asked questions
How often must I update my SPRS score?+
Your Basic Assessment generally must be current—less than three years old—at the time of award. Refresh it when your environment or implementation changes materially, and confirm contract-specific requirements.
Is a negative SPRS score real?+
Yes. The methodology begins at 110 and subtracts 1, 3, or 5 points for unmet requirements. The minimum is −203.
Does a POA&M give me points back?+
No. A POA&M documents how and when you will close a gap, but a requirement earns credit only when it is implemented as required by the assessment methodology.
Who sees my score?+
Authorized government personnel use SPRS during acquisition and oversight. Prime contractors may also request evidence of a current score from subcontractors.
What’s the difference between SPRS, NIST 800-171, and CMMC?+
NIST SP 800-171 defines security requirements for protecting CUI. An SPRS score records an assessment against those requirements. CMMC is the DoD program used to verify implementation at the required level.
Can I rely on this calculator as an official assessment?+
No. It is a planning aid. A defensible score depends on scope, implementation, and objective evidence. Review the DoD methodology and obtain qualified help when needed.
Your score is a number.