Free tool · 110 NIST 800-171 practices

Free SPRS Score Calculator

Estimate your Supplier Performance Risk System score from the same 110 NIST SP 800-171 practices used for DFARS 252.204-7012 / 7019 and CMMC Level 2.

Start at 110. Subtract 5, 3, or 1 for each unimplemented control. This table sums to 346 points, so the computed range is -236 to 110.

Start the calculatorView Policy Packs

What SPRS is and why contractors need a score

The Supplier Performance Risk System is where the Department of Defense collects contractor NIST 800-171 basic assessment scores. If you process, store, or transmit Covered Defense Information, DFARS 252.204-7012 requires you to implement NIST 800-171, and DFARS 252.204-7019 requires you to post a current score in SPRS.

Contracting officers and primes look at that score before award. A missing or stale SPRS entry can stall a bid even when the technical work is ready. Use this calculator to know the number before you enter the government system.

For the submission workflow itself, read our guide on SPRS submission and annual affirmation.

How the DoD Assessment Methodology works

  • Every assessment starts at 110 for 110 practices (17 Level 1 + 93 Level 2).
  • Each unimplemented practice subtracts a published weight of 5, 3, or 1. Default weight is 3 unless the methodology lists 5 or 1.
  • Implemented controls deduct nothing. Not sure is treated as not implemented.
  • Live unanswered items stay optimistic: no deduction until you answer, with progress shown as X/110.
  • This weight table totals 346, so all-unimplemented equals -236.

Who should use it

Prime contractors, defense subcontractors, and any company on a CMMC Level 2 path that must report a NIST 800-171 basic assessment. Level 1-only FCI work is a smaller subset; this tool scores the full 110-practice SPRS table.

Score range on this table

Perfect implementation is 110. A complete set of unimplemented controls is -236. The official conversation sometimes cites −203; we display the actual sum of the Tracker weights, 346.

What to do after the score

Download the PDF, then close gaps with the Complete Policy Pack and the templates on Free Resources. Pair the number with a living System Security Plan.

Need the broader context? See the CMMC Level 1 compliance guide, the 12 essential security policies, and the NIST 800-171 Rev. 3 transition guide.

Interactive tool

Score all 110 NIST 800-171 practices

Answers stay in this browser only. Unanswered controls do not reduce the live score yet. "Not sure" is treated as not implemented, matching a conservative SPRS estimate.

Live SPRS score

110

Progress: 0/110

Range -236 to 110 · 0 pts deducted

0 implemented0 not implemented0 not sure110 unanswered
AC 0/22AT 0/3AU 0/9CM 0/9IA 0/11IR 0/3MA 0/6MP 0/9PS 0/2PE 0/6RA 0/3CA 0/4SC 0/16SI 0/7

Related policy: Access Control Policy

AC.L1-3.1.1 Authorized Access Control

AC.L1-3.1.1

Authorized Access Control

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Weight 5
AC.L1-3.1.2 Transaction & Function Control

AC.L1-3.1.2

Transaction & Function Control

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Weight 3
AC.L1-3.1.20 External Connections

AC.L1-3.1.20

External Connections

Verify and control/limit connections to and use of external information systems.

Weight 3
AC.L1-3.1.22 Public Information Control

AC.L1-3.1.22

Public Information Control

Control information posted or processed on publicly accessible information systems.

Weight 1
AC.L2-3.1.3 Control CUI Flow

AC.L2-3.1.3

Control CUI Flow

Control the flow of CUI in accordance with approved authorizations.

Weight 5
AC.L2-3.1.4 Separation of Duties

AC.L2-3.1.4

Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Weight 3
AC.L2-3.1.5 Least Privilege

AC.L2-3.1.5

Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

Weight 5
AC.L2-3.1.6 Non-Privileged Account Use

AC.L2-3.1.6

Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions.

Weight 3
AC.L2-3.1.7 Privileged Functions

AC.L2-3.1.7

Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Weight 3
AC.L2-3.1.8 Unsuccessful Logon Attempts

AC.L2-3.1.8

Unsuccessful Logon Attempts

Limit unsuccessful logon attempts.

Weight 3
AC.L2-3.1.9 Privacy & Security Notices

AC.L2-3.1.9

Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules.

Weight 3
AC.L2-3.1.10 Session Lock

AC.L2-3.1.10

Session Lock

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Weight 3
AC.L2-3.1.11 Session Termination

AC.L2-3.1.11

Session Termination

Terminate (automatically) a user session after a defined condition.

Weight 3
AC.L2-3.1.12 Remote Access Control

AC.L2-3.1.12

Remote Access Control

Monitor and control remote access sessions.

Weight 5
AC.L2-3.1.13 Remote Access Confidentiality

AC.L2-3.1.13

Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight 3
AC.L2-3.1.14 Remote Access Routing

AC.L2-3.1.14

Remote Access Routing

Route remote access via managed access control points.

Weight 3
AC.L2-3.1.15 Privileged Remote Access

AC.L2-3.1.15

Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information.

Weight 3
AC.L2-3.1.16 Wireless Access Authorization

AC.L2-3.1.16

Wireless Access Authorization

Authorize wireless access prior to allowing such connections.

Weight 3
AC.L2-3.1.17 Wireless Access Protection

AC.L2-3.1.17

Wireless Access Protection

Protect wireless access using authentication and encryption.

Weight 3
AC.L2-3.1.18 Mobile Device Connection

AC.L2-3.1.18

Mobile Device Connection

Control connection of mobile devices.

Weight 3
AC.L2-3.1.19 Encrypt CUI on Mobile

AC.L2-3.1.19

Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms.

Weight 3
AC.L2-3.1.21 Portable Storage Use

AC.L2-3.1.21

Portable Storage Use

Limit use of portable storage devices on external systems.

Weight 3

Results and gap list

Current estimate: 110 out of 110. Gaps below include not implemented and not sure answers, grouped by family with the related TalonPoint policy.

No deducted controls yet. Mark a practice as not implemented or not sure to build your gap list.

Email-gated PDF report

Get a branded PDF of this estimate, including score, counts, and gaps by family.

No spam. Unsubscribe anytime. Your answers stay in this browser.

Close the gaps

Use the Complete Policy Pack to map these families to editable policies, then track them in CMMC Tracker when it ships.

Complete Policy Pack $299CMMC Tracker Coming Soon

This is a self-assessment estimate using the DoD Assessment Methodology weights; not an official SPRS submission.

SPRS calculator FAQ

Straight answers on scoring, DFARS reporting, and CMMC

What is an SPRS score?

SPRS is the Supplier Performance Risk System. DoD contractors that handle Covered Defense Information must assess their NIST 800-171 implementation and report a score. The score starts at 110 and subtracts the published DoD weight for each unimplemented practice.

How does this SPRS calculator work?

You answer Implemented, Not implemented, or Not sure for each of the 110 NIST 800-171 practices. Implemented controls do not reduce the score. Not implemented and Not sure deduct that control's 5, 3, or 1 point weight. Unanswered controls are left optimistic so the live score does not drop until you answer.

Why is the lowest score -236 instead of -203?

This calculator uses the same DoD Assessment Methodology weight table as TalonPoint CMMC Tracker. Those 110 weights sum to 346, so a fully unimplemented assessment is 110 − 346 = -236. We show the computed range rather than a rounded official talking point.

Is this an official SPRS submission?

No. This is a self-assessment estimate. Official SPRS submissions are made in the government SPRS application under DFARS 252.204-7019. Use this page to prepare, identify gaps, and brief leadership before you enter a basic assessment.

Who should use a NIST 800-171 SPRS calculator?

Prime contractors, subcontractors in the DIB, and companies on a CMMC Level 2 path. If a contract includes DFARS 252.204-7012 or 7019, you need a current NIST 800-171 self-assessment score.

Does a high SPRS score mean I am CMMC certified?

No. SPRS is a self-assessment score. CMMC Level 2 certification is a separate third-party assessment against the same 110 practices. A strong SPRS estimate is a readiness signal, not a certificate.

How do I close SPRS gaps after I get my score?

Each gap is mapped to a TalonPoint policy name. The Complete Policy Pack gives you editable policies for those families. CMMC Tracker, coming soon, is the desktop app for evidence, POA&Ms, and ongoing scoring.

Turn the gap list into policies

The Complete Policy Pack is $299 and maps these families to editable Word documents. CMMC Tracker is coming soon for ongoing scoring and evidence.

Complete Policy Pack $299CMMC Tracker Coming Soon