Update — July 13, 2026: CMMC Phase 2 (mandatory C3PAO certification) is suspended pending a 60-day DoD review. Your NIST 800-171, DFARS 7012, self-assessment, and SPRS obligations remain in force. Read what changed →
Every NIST SP 800-171 Rev 2 requirement with its weighted SPRS point value. Starting score is 110. Each unimplemented requirement reduces your score by 1, 3, or 5 points depending on criticality.
SPRS Score Formula:
110 − (5 × [# of 5-pt gaps]) − (3 × [# of 3-pt gaps]) − (1 × [# of 1-pt gaps])
Per DoD Assessment Methodology v1.2.1 — a perfect score is 110; scores can go negative.