HPC Tier Module

CMMC / NIST 800-171 SPRS Score

Your NIST 800-171 SPRS self-assessment score by exact integer math over published DoD weights, each cited.

See it run - a worked example, 100% in this browser tab

The problem

Defense contractors handling CUI must post a SPRS self-assessment score under DFARS 252.204-7019/-7020 and justify each deduction. Tracking 110 controls and their 5/3/1 weights by hand is error-prone and hard to defend to a prime or an assessor.

The local-first solution

This plugin computes the SPRS score by exact integer arithmetic over the published DoD point weights, citing each control by NIST SP 800-171 Rev. 2 requirement number and producing an ordered gap list, all in your browser with no CUI uploaded.

What it does

SPRS score starting at 110 with each not-met control subtracting its DoD-assigned 5, 3, or 1 point weight

Partial credit for the multifactor-authentication (3.5.3) and FIPS-crypto (3.13.11) controls per the published rules

Gap list of every not-met control with requirement number, point value, and NIST family, ordered highest-weight-first

POA&M / CMMC Level 2 readiness readout against the entered POA&M completion date (DFARS 252.204-7012(b))

Methodology version surfaced as a dated input so revised weights are never silently applied

Exact integer arithmetic with every control and weight citing its source

Honest scope

This is the self-assessment score you post to SPRS under DFARS 252.204-7019/-7020, not a C3PAO assessment or a CMMC certificate. The arithmetic is exact and every weight cites the DoD Assessment Methodology v1.2.1, but the per-control weights are a best-effort mapping that must be confirmed against the official DoD scoring template (an honest discrepancy gives a floor of -198 here vs the official -203), the control catalog is grouped and abbreviated rather than reproducing NIST text, and the methodology version is a dated input.

Authorities cited

NIST SP 800-171 Rev. 2 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (the 110 security requirements; control text).
NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (the assessment objectives).
DoD Assessment Methodology, NIST SP 800-171, Version 1.2.1 (Nov 2022) - the 5/3/1 point weights, the official 110-to--203 scoring range, and the partial-credit rules for 3.5.3 and 3.13.11. The authoritative per-control weights live in the official scoring template; confirm against it.
32 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program (Level 2 = NIST SP 800-171; POA&M closeout conditions).
DFARS 252.204-7012 - Safeguarding covered defense information and cyber incident reporting (the NIST SP 800-171 requirement; POA&M at (b)).
DFARS 252.204-7019 / 252.204-7020 - NIST SP 800-171 DoD Assessment Requirements (post the self-assessment summary score to SPRS).
DFARS 252.204-7021 - Contractor compliance with the CMMC level requirement (C3PAO assessment for certification).

Score your self-assessment

Compute the score in your browser and route the gap list and POA&M readout into a Sandbox workspace, a Worklog case file, or a Gate client portal. No CUI is uploaded to anyone's cloud.

Try it live inside GDBS Open a free Standard account

GDBS by VaultSync Solutions Inc. - Verifiable Computation. gdbs.getvaultsync.com