HPC Tier Module

CMMC / NIST 800-171 SPRS Score

Your NIST 800-171 SPRS self-assessment score by exact integer math over published DoD weights, each cited.

This tool runs inside GDBS HPC. What it computes and the authorities it applies are below.

The problem

Defense contractors handling CUI must post a SPRS self-assessment score under DFARS 252.204-7019/-7020 and justify each deduction. Tracking 110 controls and their 5/3/1 weights by hand is error-prone and hard to defend to a prime or an assessor.

The local-first solution

This plugin computes the SPRS score by exact integer arithmetic over the published DoD point weights, citing each control by NIST SP 800-171 Rev. 2 requirement number and producing an ordered gap list, all in your browser with no CUI uploaded.

What it does

SPRS score starting at 110 with each not-met control subtracting its DoD-assigned 5, 3, or 1 point weight

Partial credit for the multifactor-authentication (3.5.3) and FIPS-crypto (3.13.11) controls per the published rules

Gap list of every not-met control with requirement number, point value, and NIST family, ordered highest-weight-first

POA&M / CMMC Level 2 readiness readout against the entered POA&M completion date (DFARS 252.204-7012(b))

Methodology version surfaced as a dated input so revised weights are never silently applied

Exact integer arithmetic with every control and weight citing its source

Honest scope

This is the self-assessment score you post to SPRS under DFARS 252.204-7019/-7020, not a C3PAO assessment or a CMMC certificate. The arithmetic is exact and every weight cites the DoD Assessment Methodology v1.2.1, but the per-control weights are a best-effort mapping that must be confirmed against the official DoD scoring template (an honest discrepancy gives a floor of -198 here vs the official -203), the control catalog is grouped and abbreviated rather than reproducing NIST text, and the methodology version is a dated input.

Authorities cited

NIST SP 800-171 Rev. 2 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (the 110 security requirements; control text).
NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (the assessment objectives).
DoD Assessment Methodology, NIST SP 800-171, Version 1.2.1 (Nov 2022) - the 5/3/1 point weights, the official 110-to--203 scoring range, and the partial-credit rules for 3.5.3 and 3.13.11. The authoritative per-control weights live in the official scoring template; confirm against it.
32 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program (Level 2 = NIST SP 800-171; POA&M closeout conditions).
DFARS 252.204-7012 - Safeguarding covered defense information and cyber incident reporting (the NIST SP 800-171 requirement; POA&M at (b)).
DFARS 252.204-7019 / 252.204-7020 - NIST SP 800-171 DoD Assessment Requirements (post the self-assessment summary score to SPRS).
DFARS 252.204-7021 - Contractor compliance with the CMMC level requirement (C3PAO assessment for certification).

Get an email when these rules change

Tables, thresholds and deadlines in Compliance & Risk change every year. Leave your email and we will tell you when the ones behind tools like this one move, at most once a month.

We email you once to confirm. After that, unsubscribe from any issue in one click. Your address goes to VaultSync only (privacy).

Related tools

GDPR Data Retention Period Calculator Pro
SOX 404 Control Testing Sample Size Calculator Pro
Topology Optimization (SIMP) HPC
AML Transaction Threshold Monitor Pro
Background reading: Compliance and risk

Score your self-assessment

Compute the score in your browser and route the gap list and POA&M readout into a Sandbox workspace, a Worklog case file, or a Gate client portal. No CUI is uploaded to anyone's cloud.

Try it live inside GDBS See HPC pricing

GDBS by VaultSync Solutions Inc. - Verifiable Computation. gdbs.getvaultsync.com