Every DoD contractor handling CUI must post a NIST 800-171 self-assessment score in SPRS — from a perfect 110 down to -203. Estimate yours in about 2 minutes, then get a prioritized roadmap to raise it. Rate how far along each control family is; the score updates live.
Default is "Partial" — adjust each family to match your shop. Weights follow the DoD SP 800-171 Assessment Methodology (1/3/5 points per control).
Your prioritized fix list — weakest control families first, mapped to what an assessor checks. It appears right here on this page, and we'll send the vendor vetting checklist plus practical CMMC guidance to your inbox.
This estimator is for planning only. Your official SPRS score requires assessing all 110 controls individually per the DoD Assessment Methodology; your C3PAO makes the final call.
Your SPRS score is your NIST SP 800-171 self-assessment result, posted in the DoD Supplier Performance Risk System. Every DoD contractor that handles Controlled Unclassified Information has to compute one and keep it current in SPRS — no more than three years old — under DFARS 252.204-7019 and -7020. It's the first number a prime sees when they weigh your bid.
The math is subtraction. You start at a perfect 110 and lose points for every one of the 110 controls you haven't fully implemented — 5 points for the heaviest controls, 3 or 1 for the rest — so the scale bottoms out at -203. That weighting is why a single missed control can cost five points, and why most unprepared shops score negative on their first honest pass. The estimator above approximates this at the control-family level; your official score requires assessing all 110 controls individually.
Higher is better, and there's no official "passing" number under today's self-assessment regime — what's required is a score that's current, accurate, and honest. A positive score near 110 signals real readiness to a prime; a negative score signals significant unimplemented controls. An inflated score carries False Claims Act risk, so accuracy beats optimism.
Run a Basic (self) Assessment against all 110 controls using the DoD Assessment Methodology, then enter your score, assessment date, and covered systems in the SPRS module via the DoD PIEE portal. Keep it under three years old. This tool is a planning estimate, not an official submission.
Yes. DoD suspended CMMC Phase 2 (the C3PAO third-party mandate) on July 13, 2026, but NIST 800-171 self-assessment and SPRS scoring under DFARS 252.204-7019/-7020 remain fully in effect. You still need a current, accurate SPRS score. What the suspension changes →
Want the mechanics behind the scoring — why one control costs five points and what primes read into a negative number? Read SPRS Score Explained, or see where you stand across every control family with the estimator above.