How to Calculate and Submit Your SPRS Score (NIST 800-171 DoD Assessment)

Formula and Range

Score = 110 − Σ(Annex A deduction values for each Not Met requirement)

• Official range: −203 to 110
• Ceiling 110 — all 110 Rev 2 requirements implemented (Methodology §5)
• Floor −203 — when every Annex A weight is deducted: total deduction pool 313 → 110 − 313 = −203. The methodology states scores may be negative; the floor follows from Annex A sums
• Deduction weights: 5, 3, or 1 by risk impact
• Generally no credit for partial implementation

Explicit Partial-Credit Exceptions

1. 3.5.3 MFA — if MFA covers remote and privileged users but not general users: deduct 3 instead of 5
2. 3.13.11 FIPS-validated cryptography — if encryption is used but not FIPS-validated: deduct 3 instead of 5

Submit to SPRS

Enter Basic, Medium, or High assessment results into SPRS per DFARS 252.204-7019 / 7020. Keep your SSP and POA&M aligned to the posted score. Summary scores are posted (for example, “95 out of 110”), not per-requirement values.

How CyberSilo Helps

• Compliance Standards Automation — Met / Not Met mapped to evidence
• Keep POA&M dates honest so SPRS does not drift from reality

Frequently Asked Questions

Does a low SPRS score fail CMMC automatically?

SPRS is the DoD assessment score. CMMC Level 2 is a separate certification path. Both care about 800-171 Rev 2 implementation.

Can I invent deduction weights?

No. Use Annex A of the DoD Assessment Methodology. Each unmet requirement has a pre-assigned 5, 3, or 1 value.

Does Rev 3 change SPRS math today?

Current public DoD methodology is built around 110 Revision 2 requirements. Do not apply Rev 3 counts to SPRS yet.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM