CMMC SPRS Score: How Scoring and Affirmations Work

The Supplier Performance Risk System (SPRS) is where contractors submit NIST SP 800-171 / CMMC assessment results and affirmations that DoD contracting officers check. For Level 2, the maximum score is 110 (one point per NIST SP 800-171 Rev 2 requirement, with standard DoD scoring methodology for partials historically used under 7019/7020 workflows).

Related: CMMC hub · Level 2 · POA&M · DFARS 7019/7020.

Score ≠ security theatre: Entering 110 without MET evidence creates False Claims Act risk. Affirmations must match the SSP you would hand an assessor.

Cadence

Level 2 assessment results: typically every 3 years
Annual affirmation that requirements remain met
Results and affirmations submitted to SPRS
Maximum Level 2 score: 110

Conditional Scoring Reminder

Where Conditional CMMC status is used for Level 2, programme rules require a minimum of 88 of 110 (80%) plus critical requirements MET per §170.21, with POA&M closeout in 180 days.

How CyberSilo Helps

CSA readiness views that mirror requirement-level scoring status
Evidence packs that make annual affirmation defensible
We do not submit SPRS on your behalf unless engaged for that operational support under your accounts

Affirm Only What You Can Defend

Keep requirement-level evidence current so SPRS scores and annual affirmations match operational reality.

Talk to CyberSilo CMMC Automation

Frequently Asked Questions

What is the maximum SPRS score for Level 2?

110 — aligned to the 110 NIST SP 800-171 Rev 2 requirements.

How often must Level 2 be reassessed?

Assessment every 3 years with annual affirmation.

Does Level 1 use the same 110 scale?

No. Level 1 is 15 FAR basic safeguarding requirements with its own self-assessment/affirmation workflow — not the 110-point 800-171 score.

CMMC hub · Assessment process · Checklist · Timeline · CSA

CMMC SPRS Score: How Scoring and Affirmations Work

Cadence

Conditional Scoring Reminder