SPRS Score and CMMC: What It Is and How It’s Calculated

By Shaheer Malik · Updated Oct 28, 2026

An SPRS score is the NIST SP 800-171 assessment score recorded in DoD’s Supplier Performance Risk System. It starts at 110, one point per requirement, and the value of each requirement you don’t meet (1, 3 or 5 points) is subtracted, so it can go below zero. CMMC uses the same method, and every CMMC status, self-assessed or certified, ends up in SPRS.^[1][2]

How the score is calculated

“If all security requirements are implemented, a contractor is awarded a score of 110… For each security requirement not met, the associated value is subtracted from 110,” which “may result in a negative score.”^[2] CMMC Level 2 scoring works the same way, with values of 1, 3 or 5 tied to whether NIST designates a requirement as basic or derived.^[1]

What goes into SPRS for CMMC

• Level 1 (Self): level, status date, assessment scope, CAGE codes and result, plus the affirmation, every year.^[1]
• Level 2 (Self): your self-assessment result and affirmation; the status lasts three years.^[1]
• Level 2 (C3PAO) and Level 3: the assessor enters results in the CMMC eMASS, which passes them to SPRS; you add affirmations.^[1]

Each system gets a CMMC Unique Identifier, and contracting officers check SPRS by those identifiers before award and before exercising options.^[3]

SPRS score vs CMMC certification

A score is a number; a CMMC status is a pass state at a named level. A Final status needs every requirement MET; a Conditional Level 2 needs at least 80 percent of the maximum (88 of 110) with only eligible items on a POA&M.^[1] See POA&M rules.

The Basic Assessment in 2026

Many guides still say every DFARS 252.204-7012 contract needs a self-assessed “Basic” score in SPRS. The revised DFARS part 240 that contracting officers have used by class deviation since 2026 contains 252.240-7997, which covers government Medium and High assessments; the old Basic Assessment provision, 252.204-7019, does not appear in it.^[3] Check which clauses your own contract carries. Your SPRS access is through the system itself.^[4]

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

What is a good SPRS score?

110 means every NIST SP 800-171 requirement is implemented. For a CMMC Conditional Level 2 status you need at least 88 (80 percent); a Final status needs all 110.

Can an SPRS score be negative?

Yes. Each unmet requirement subtracts 1, 3 or 5 points from 110, so a system missing many high-value requirements scores below zero.

Is an SPRS score the same as CMMC certification?

No. The score is a number; CMMC is a status at a named level. Certification at Level 2 comes from a C3PAO, which enters results that flow into SPRS.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
2. NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020) (checked Oct 28, 2026)
3. Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
4. Supplier Performance Risk System (SPRS) (checked Oct 28, 2026)

More on the rules behind cmmc

• CMMC vs NIST SP 800-171: The Difference, and Rev 3
• Which DFARS Clause Establishes CMMC? 7021, 7025 and 7012
• FCI vs CUI in CMMC: What Each Is and Why It Matters
• CMMC and ITAR: Does One Satisfy the Other?