NIST 800-171 SPRS score: how it is calculated

What the NIST 800-171 SPRS score is and who must post one

When a solicitation or subcontract requires a current assessment with a summary score in the Supplier Performance Risk System (SPRS), the number you post is the first thing a contracting officer checks. The score starts at 110, the number of Rev. 2 requirements that the DoD Assessment Methodology scores, and the methodology subtracts a weighted value for each requirement you have not fully implemented, so the result can fall below zero. Your organization owns the score it posts, and it is responsible for the accuracy of the systems, scope and evidence behind it. Under DFARS 252.204-7019, an offeror that must implement SP 800-171 needs a current assessment with summary scores posted for each relevant covered system before it can be considered for award, and DFARS 252.204-7020 applies the same posting expectation to subcontractors.

The number is not one figure for the whole company. Each covered system, and each system security plan (SSP) that describes one, can carry its own score, and the score moves with the scope you declare and the requirements that apply to it. Confirm with your contracting office which systems the solicitation treats as covered before you post, because a narrower scope with an accurate score is usually easier to defend than a broad scope with unsupported claims. Only a DoD assessment or an independent CMMC assessment is an external check on that score. An implementation partner can prepare systems, policies and evidence, and it can help you walk through the methodology, but it does not post the score on your behalf and does not stand in for the assessor.

How the weighted deductions work

The DoD Assessment Methodology starts every score at 110 and subtracts a weight for each requirement that is not fully implemented. The weight depends on how much damage a gap could cause, so three tiers of deduction sit on top of one another. Read the cards in order, because the lowest tier is the default and the score has no floor.

The 5-point group

Forty-two requirements carry a 5-point deduction. The methodology assigns this weight to requirements whose absence could lead to significant exploitation or exfiltration of CUI, such as 3.1.1 (limiting system access to authorized users) and 3.8.7 (controlling removable media). A single gap here costs the most, so check these first when reviewing an SSP. Multi-factor authentication under 3.5.3 and FIPS-validated encryption under 3.13.11 can drop to 3 points under the partial credit rules.

The 3-point group

Fourteen requirements carry a 3-point deduction because their absence has a confined effect on CUI. Requirement 3.8.2, which limits access to CUI on media to authorized users, is the example the methodology uses. Gaps here still lower the score, but they cost less than a missing core access or exfiltration control. Teams sometimes focus only on the high-weight items and leave these open, which adds up quickly across a full assessment.

The 1-point default

Every requirement not placed in the 5-point or 3-point group carries a 1-point deduction. This default covers the remaining requirements in the Rev. 2 set of 110, so the count of 1-point items is what remains after the other two groups are removed. Because each one is small, many unimplemented 1-point requirements can still move the score noticeably. Confirm the exact list against the methodology document before you total a score.

Scores can go negative

The methodology does not stop subtraction at zero, so a score can be negative when many high-weight requirements are unimplemented. Negative scores still post to SPRS as calculated. Contracting officers read the figure alongside the assessment date and the expected date for a score of 110, so a deeply negative result signals a large gap that needs a credible remediation timeline. Ask your assessor to walk through the arithmetic line by line before submission.

Partial credit, exceptions and not-applicable requirements

Requirement 3.5.3 asks for multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. The methodology lets an organization subtract 3 points instead of 5 when multifactor authentication covers only remote and privileged users. That reduced deduction applies only when the coverage gap is exactly that narrow. Local, non-privileged access without a second factor does not qualify, so the score must reflect that gap.

Coverage must be stated precisely: Document which login paths enforce a second factor, such as VPN, remote desktop and administrator consoles, and which do not.
Remote and privileged only: Partial credit depends on the uncovered population being neither remote nor privileged. Check directory groups, not only documentation.
Test the enforcement: Attempt a non-privileged local login and a remote login from an unmanaged device. Keep the screenshots or logs.
Score the gap, not the intent: A planned rollout does not earn credit. A plan of action does not count as implementation.
Record the date: Coverage changes as accounts are added, so tie the score to the assessment date.

Confirm the exact wording of 3.5.3 in SP 800-171 Rev. 2 and the methodology before you apply the reduced deduction to your environment.

Why a plan of action does not raise the score

A plan of action and milestones does not count as implementation in the SPRS score. Under the DoD Assessment Methodology, a requirement that is not fully implemented scores as not implemented whether or not a plan exists. The deduction is the same. A POA&M records what you intend to do and when, but the scoring formula only credits controls that are in place at the time of assessment. Treat the plan as a remediation record for your own governance, not as a way to lift the posted number.

Two specific cases catch organizations out. First, a missing plan of action makes requirement 3.12.2 not implemented, so the absence of the document costs points on its own. Second, a missing system security plan means no assessment can be completed at all, so there is no score to post. Confirm that your SSP is current and that every open gap has a named owner, a target date and a remediation step before you submit. Check the current wording of the methodology and the applicable DFARS clause with your contracting officer, since posting rules differ by assessment level.

The organization must own the plan and its dates. Your executive sponsor should approve the milestones, and the people who run the affected systems should accept them. A partner can help draft the plan, sequence the work and build the evidence trail, but planning help does not change how the score is counted. Ask any implementation partner to show which gaps they will close, which ones remain open, and who signs off each change. An assessor will test whether the controls actually work, not whether the plan reads well.

How the score is posted and when it goes stale

This sequence turns a self-assessment into a current SPRS record that a contracting officer can check before award and that stays valid for subcontract flow-down. Each step names the owner, the record it produces and the check that confirms it is complete.

Complete the Basic self-assessment against the SSP
The organization, through its own assessor or staff, scores each of the 110 Rev. 2 requirements against its system security plan using the DoD Assessment Methodology, version 1.2.1. Requirements not fully implemented score as not implemented, whether or not a plan of action exists. The step is done when every requirement has a documented status and the SSP covers each system that handles CUI. Confirm that the SSP exists first, because a missing SSP means no assessment can be completed.
Record each SSP and its CAGE codes
Identify each system security plan that covers a relevant covered system, and list the CAGE codes tied to each one. A Basic Assessment posting depends on this mapping, so an SSP with no CAGE code or a CAGE code with no SSP leaves the record incomplete. The output is a list that matches each SSP to its CAGE codes and to the systems it describes. Check the list against the current system inventory before posting.
Calculate and confirm the summary score
Apply the weighted deductions in the methodology: 5 points for each high-impact requirement not implemented, 3 for each confined-effect requirement and 1 for each remaining one, with partial credit for multi-factor authentication and FIPS-validated encryption where the rules allow it. The result is a summary score, which can be negative, for example 95 out of 110 in the methodology's illustrative case. Have a second person re-check the arithmetic and the partial-credit decisions before the score is posted.
Post the assessment record to SPRS
Enter the record in the Supplier Performance Risk System, including the SP 800-171 version assessed, the organization that performed the assessment, each SSP with its CAGE codes, the assessment date, the summary score and the date a score of 110 is expected. The posting is complete when the SPRS record displays each required field. Keep a copy of the submitted record with the assessment file, since the posting is what the contracting officer reviews.
Set a reassessment date within the three-year window
Track the assessment date from the posting. A current assessment must be not more than 3 years old unless the solicitation sets a shorter period, so the record goes stale on that date even if controls have not changed. Set a reminder for the reassessment and for any earlier date the solicitation sets. The check is a dated calendar entry that names the solicitation terms that apply.
Respond to a Medium or High assessment within 14 business days
If DoD conducts a Medium or High assessment, the contractor has 14 business days after the assessment to provide more information or rebut findings. Under the September 2026 deviation, DCMA results take precedence over other assessments, and summary scores are posted after the rebuttal window. Assign one owner to the response and collect the artifacts that support each contested finding. The step is done when the rebuttal or supporting evidence is filed within the window.
Verify subcontractor assessments before flow-down
Before awarding any subcontract subject to SP 800-171, confirm the subcontractor has completed at least a Basic Assessment within the last 3 years. Ask for the subcontractor's SPRS posting or assessment record, and check the date and the assessed version. The check is complete when each subcontract file holds a dated record that meets this rule. Repeat the check when a subcontractor's assessment reaches the three-year limit.

How CMMC scoring and the September 2026 DFARS deviation change the number

The 110-point score is not only a DFARS artifact. CMMC Level 2 uses the same scoring pattern, requires SPRS entries with POA&M status, and sets a conditional threshold, while the September 2026 class deviation changes which assessment results count and who posts them. Confirm the current deviation terms with your contracting officer before relying on any of these rules.

Same 110-point pattern in CMMC

32 CFR 170.24 applies the same scoring logic to CMMC Level 2. The maximum score is 110, one for each Level 2 requirement, and 5, 3 or 1 points are subtracted for each requirement marked NOT MET. Multi-factor authentication and FIPS-validated encryption can earn partial credit. Check that your internal scoring worksheet uses the CMMC deductions, not only the DFARS self-assessment values, when you prepare for a CMMC assessment.

SPRS entry with POA&M status

32 CFR 170.16 requires Level 2 self-assessment results to be entered in SPRS, including the overall score and whether a plan of action and milestones is open. The entry repeats every three years, with annual affirmations in between. Confirm who in your organization holds the SPRS account, who signs affirmations, and how a POA&M closeout will be reflected in the next posting.

The 88-point conditional threshold

32 CFR 170.21 sets 88 of 110 as the minimum score for Conditional status. A score at or above that line lets an organization pursue a conditional certification while it closes remaining gaps, but it is not a passing grade. Compare your current score with the threshold, identify the requirements that carry the most points, and confirm with your CMMC assessor how open items must be closed within the conditional window.

Government assessments take precedence

Class Deviation 2026-O0025, Revision 3 names NIST SP 800-171 Revision 2 and adds clause 252.240-7997. Under that clause, Medium and High DoD assessments conducted by DCMA take precedence over any other assessment. DoD posts the summary scores to SPRS after giving the contractor 14 business days to rebut findings. Ask your contracting officer which version of the deviation applies to your solicitation and when the rebuttal window opens.

Which assessment level produces which score

This table compares the three NIST SP 800-171 DoD Assessment levels by who performs them, what the posted score represents and how much confidence it carries. Read it to see which score a buyer or contracting officer is likely to rely on, and how often each assessment is anticipated.

Assessment level	Who performs it	What the posted score represents	Confidence and cadence
Basic	The organization, as a self-assessment	A summary score the organization reports to SPRS, starting from 110 and reduced by weighted deductions	Low confidence; anticipated once every three years
Medium	DoD reviews the system security plan	A summary score that reflects the SSP review by DoD	Medium confidence; anticipated once every three years
High	DoD, on site or virtually, using SP 800-171A procedures	A summary score based on DoD's examination of implementation	High confidence; anticipated once every three years
Posting requirement	The organization posts a Basic score for each covered system	Includes SSP, CAGE codes, assessment date and expected date for a score of 110	Required before award under DFARS 252.204-7019
Response window	The contractor responds after a Medium or High assessment	Contractor has 14 business days to provide information or rebut findings	Applies under DFARS 252.204-7020
Confirm with your contracting officer	Contracting officer or prime contractor	Which assessment level and version the solicitation requires	Confirm the currency limit, which is three years unless the solicitation sets less

Questions buyers ask about the SPRS score

Can a NIST SP 800-171 SPRS score be negative?

Yes. The DoD Assessment Methodology starts at 110, the number of Rev. 2 requirements, and subtracts a weighted value for each requirement that is not implemented. Requirements worth 5 points cover the controls whose absence could lead to significant exploitation or exfiltration of CUI, requirements worth 3 points have a confined effect, and the remaining requirements are worth 1 point. Because a few unimplemented high-weight requirements can push the total below zero, the score should be read alongside the list of unimplemented requirements, not as a percentage. Check your own SSP and assessment worksheet to see which requirements drive the deductions.

Does a plan of action raise the SPRS score?

No. A plan of action and milestones does not count as implementation. A requirement that is not fully implemented scores as not implemented, whether or not a plan exists. A missing plan of action also makes requirement 3.12.2 count as not implemented, so an incomplete plan can cost points twice. Plans of action are useful for tracking remediation and for explaining timing to a contracting officer, but the score reflects only what is in place today. Review your open items with your assessor before posting, and confirm how your contract treats open items with the contracting officer.

Who can post the SPRS score, and can a consultant do it?

The organization's own representative posts the summary score and the related information in SPRS for each covered system, and the organization remains responsible for its accuracy. An outside consultant can help prepare the system security plan, collect evidence, run the scoring worksheet and document findings, but a consultant should not be treated as the party that certifies the result. Confirm with your contracting officer which role your contract expects for the Basic Assessment posting and whether any Government assessment has already been scheduled. Ask any outside party to show how each deduction was derived from your evidence.

How long does a posted SPRS score stay valid?

A Basic Assessment posting is only valid for a defined period. Under DFARS 252.204-7019, an offeror must have a current assessment, not more than three years old unless the solicitation sets a shorter period, with summary scores posted for each relevant covered system before award. Scores also become stale when systems, boundaries or controls change, so a score that is within three years can still misstate your current position. Track the assessment date, the date a score of 110 is expected, and any change to the SSP that would alter the scope, and reassess when those change.

What must we gather before a Medium or High assessment?

Start with a current system security plan for each covered system, because a missing SSP means no assessment can be completed. Then gather evidence that matches each requirement's assessment objectives under SP 800-171A, including policies, configuration baselines, access reviews, audit log samples, incident response records, vulnerability scan results, and the plan of action with dated milestones. Assemble a network and data flow diagram, a list of CAGE codes tied to each SSP, and a record of any DoD adjudications of alternative controls. Run an internal scoring pass first so that you can answer questions and submit rebuttal material within the 14 business days allowed after the assessment. Confirm the exact package with the assessing body before the visit.

Which items should we confirm with the contracting officer when the deviation applies?

Ask which version of SP 800-171 the contract requires, since the 3 September 2026 class deviation names Revision 2 explicitly while the proposed FAR rule would move contractors to Revision 3. Confirm whether the contract requires a Basic Assessment posting, a Government Medium or High assessment, or both, and whether results from a DCMA assessment will be posted by DoD. Ask how the 14 business day rebuttal window will be communicated, which SSP and CAGE codes are in scope, and how the contract handles open plan of action items. Get the answers in writing and keep them with your assessment records.

Can we reduce the SPRS score by narrowing the scope of CUI systems?

Scope determines which systems receive a score, not the deduction for each requirement. Limiting the systems that store, process or transmit CUI can reduce the number of SSPs and scores you must maintain, which lowers the workload but does not change the weights. Narrowing scope only works when the boundary is defensible, so document how CUI is isolated and how out-of-scope assets are separated. Confirm the boundary with your contracting officer and your assessor before you change it, because an incorrect boundary can invalidate the posted score.

Common mistakes that lower or invalidate the score

Most SPRS problems do not come from missing controls. They come from paperwork that does not match the systems, scores that claim more than the evidence supports, and deadlines that pass unnoticed. Each card below names one common mistake and the check that prevents it.

SSP that does not match scope

The score is only as good as the system security plan it describes. If the SSP omits a system that stores, processes or transmits CUI, or describes an enclave boundary the network does not actually enforce, the assessed scope and the posted score both fall apart. Before posting, walk the SSP against current network diagrams, asset inventories and cloud accounts, and confirm each CAGE-linked system appears in it. Fix: reconcile the SSP with the live environment at every change and at least before each assessment.

Claiming partial credit without evidence

The methodology gives partial credit in two places: multi-factor authentication that covers only remote and privileged users, and encryption that is used but not FIPS-validated. Teams often take the higher score without proof of which users or modules are covered. An assessor who finds the gap will lower the score or question the whole submission. Fix: keep a dated record for each partial-credit claim showing the users, systems and validated module certificates it covers.

Counting a plan of action as implementation

A plan of action and milestones records what you intend to fix, not what is fixed. Under the methodology, a requirement that is not fully implemented scores as not implemented whether or not a plan exists. A missing plan of action also makes requirement 3.12.2 not implemented. Teams that list open items as complete inflate the score and create a false record. Fix: score each requirement as implemented only when every part of its assessment objectives is met, and list open items separately with owners and dates.

Leaving CAGE codes or systems off the posting

A Basic Assessment posting must name each system security plan with its CAGE codes, and a summary score must be posted for each relevant covered system before award. A system left off the posting can mean a score that does not describe the environment where CUI actually sits. Check CAGE code coverage against your contracts and subcontracts, and confirm the posting lists every relevant SSP. Fix: tie each SSP to its CAGE codes in a register and review that register whenever a facility, entity or contract changes.

Letting the assessment age out

A current assessment must be not more than three years old unless a solicitation sets a shorter period, and subcontract awards require at least a Basic Assessment within the last three years. Organizations often track the posting date but not the assessment date, or they change systems after assessment without reassessing. Set a calendar reminder tied to the assessment date and reassess after significant changes to the covered environment. Fix: record the assessment date and the currency window in your compliance register, and confirm both against each solicitation.

Missing the 14 business day rebuttal window

After a Medium or High assessment, the contractor has 14 business days to provide more information or rebut findings. Under the deviation in effect as of October 2026, DoD offers the same window before posting its summary scores to SPRS for assessments conducted by DCMA. Missing it means the findings stand as written. Assign a named owner to receive assessment notices, and prepare evidence packages before the clock starts. Fix: route assessment correspondence to a monitored mailbox and prepare rebuttal evidence within the first few days.

Who owns the score and who can only prepare it

The organization owns its SPRS score. It owns the controls behind the score, the system security plan that describes them, and the decision to post or update an entry in the Supplier Performance Risk System. An implementation partner such as DeployOpen can help prepare the systems, configurations, policies and evidence that the score depends on, and can check the scoring logic against that evidence before anyone reports a result. That preparation work does not change who is accountable for the figure. Before any entry is made, the organization should confirm who on its side signs off on the SSP, who approves each deduction and partial credit decision, and who answers for accuracy if a contracting officer asks questions later.

Only the assessing body produces the assessment result. Under the DoD Assessment Methodology, that means DoD itself for Medium and High assessments, DCMA for the Government assessments that carry the most weight in the revised deviation, or an independent CMMC assessor where the CMMC program applies. Under current DoD rules, the summary score that appears in SPRS comes from the assessment, not from a consultant's worksheet. A partner can tell an organization that a requirement looks implemented, but it cannot make that call on the Government's behalf or promise a result. Any proposal that guarantees a particular score, or that describes a partner as posting scores or issuing reports, should be treated as a warning sign. Ask the partner in writing which parts of the work it performs, which parts the organization performs, and which parts only the assessing body can decide.

How DeployOpen prepares systems and evidence for a score you can defend

DeployOpen prepares the systems, controls and evidence behind a NIST 800-171 SPRS score, working inside your own infrastructure under a written, fixed scope. We do not calculate the score for you or issue any assessment result; the score you post must reflect what your organization has actually implemented and can show.

How we scope

We confirm which systems store, process or transmit CUI and which are in scope for the SSP and the SPRS posting.
We map the in-scope systems against the Rev. 2 requirements that DoD assessments currently use, and flag any Rev. 3 gaps for planning.
The written scope lists systems, deliverables, responsibilities and timelines before any work starts, and engagements are fixed-scope.

How we build

We implement and harden the open-source platforms your environment runs, such as identity, logging, configuration baselines and encryption, inside your own accounts or data centers.
We configure controls so each requirement has a documented owner, a repeatable procedure and a system setting that can be checked.
We test the configured controls against the SP 800-171A determination statements and record gaps honestly, without counting planned fixes as implemented.

How we hand over

We deliver the system security plan, configuration baselines, policies and procedures, and an evidence register that maps artifacts to requirements.
We document how the self-assessment score was derived from the evidence, so your assessing official can reproduce each deduction and partial credit.
Your team receives runbooks and training so the SSP, plan of action and evidence stay accurate after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, which help keep the posted score current as systems change.
We can re-check controls after changes to scope, cloud providers or remote access so the SPRS posting does not drift from reality.
Confirm with your contracting officer and your independent assessor which assessment level and version your contract requires before engaging.

NIST 800-171 SPRS score