Every defense contractor that handles Controlled Unclassified Information (CUI) has a number attached to its CAGE code in a DoD database.
That number ranges from -203 to a perfect 110 and most organizations that calculate it honestly for the first time land somewhere they would rather not advertise.
This guide covers how CMMC scoring works: where the number comes from, what counts as a passing score at each CMMC level, how to calculate and submit a score in SPRS, and where Plans of Action and Milestones (POA&Ms) fit in.
What Is CMMC Scoring?
CMMC 2.0 is the Department of Defense program for verifying that companies in the Defense Industrial Base (DIB) actually protect Federal Contract Information (FCI) and CUI, rather than simply attesting that they do. The program rule, 32 CFR Part 170, took effect in December 2024, and the acquisition rule that inserts CMMC requirements into contracts via DFARS 252.204-7021 began phasing in from November 2025. Phase 2, which makes third-party certification the default for contracts involving CUI, arrives in November 2026.
CMMC scoring is the quantitative layer underneath all of this. At Level 2, the score measures implementation of the 110 security requirements of NIST SP 800-171, the standard that has applied to contractors handling CUI since DFARS 252.204-7012 made it mandatory. CMMC did not invent new controls at Level 2; it created a verification and scoring regime around controls contractors were already obligated to implement.
The score matters for three practical reasons. It determines contract eligibility, because solicitations now specify a required CMMC status and contracting officers check SPRS before award. It drives prime contractor flow-downs, since primes must verify subcontractor scores before passing CUI down the supply chain. And it creates legal exposure: a senior official affirms the score, and a knowingly inflated number is a False Claims Act problem, not a paperwork problem.
Understanding the SPRS Scoring System
The Supplier Performance Risk System (SPRS) is the DoD’s authoritative source for supplier risk information. For cybersecurity purposes, it stores the results of NIST SP 800-171 assessments and CMMC statuses against each contractor’s CAGE code. Contracting officers, programme offices, and DCMA personnel query it routinely; prime contractors can verify that a subcontractor has a current assessment on file.
SPRS does not perform the assessment. It is a reporting database. Self-assessment scores are entered directly by the contractor through the Procurement Integrated Enterprise Environment (PIEE). Results of third-party certification assessments are entered by the C3PAO into the CMMC instance of eMASS, which then populates SPRS automatically.
The relationship between an SPRS score and CMMC certification is straightforward: same methodology, different assessor. The self-assessment score is your own claim about your posture. A CMMC Level 2 certification is the same 110 requirements scored by a Certified Third-Party Assessment Organization (C3PAO), with the result carrying formal status under the programme rule. A contractor whose self-reported 110 collapses to 60 under C3PAO scrutiny has a credibility problem on the record.
The CMMC Scoring Methodology Explained
The methodology comes from the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, now codified for CMMC in 32 CFR 170.24. Every organisation starts at the maximum of 110 points. For every requirement scored NOT MET, a weighted value of 1, 3, or 5 points is subtracted.
The weighting reflects security impact. Five-point requirements are those whose absence exposes the network or CUI directly. Three-point requirements have a specific, meaningful effect on security. One-point requirements have a limited or indirect effect. Because total possible deductions add up to 313, the floor is -203. Negative scores are common on a first honest assessment, and they are not a clerical curiosity: a deeply negative number visible to a contracting officer signals an organisation years away from certification.
There is no partial credit. A requirement that is 90 percent implemented deducts its full point value, exactly like one that was never started. The only two exceptions are multi-factor authentication (3.5.3), which deducts 3 points instead of 5 if MFA covers remote and privileged users but not all users, and FIPS-validated encryption (3.13.11), which deducts 3 points instead of 5 if encryption is in place but not FIPS-validated. Everything else is binary.
One further prerequisite catches people out: a System Security Plan (3.12.4) must exist at the time of assessment. Without an SSP describing how each requirement is met, the assessment cannot be completed at all, and the absence is treated as non-compliance with DFARS 252.204-7012 rather than as a scoring deduction.
CMMC Score Requirements by Level
Scoring works differently at each of the three CMMC levels, and the term passing score means something different at each.
Level 1
Level 1 sits apart from both Level 2 and Level 3: it requires an annual self-assessment of just 15 basic safeguarding requirements, carries no numeric score, permits no POA&Ms, and requires only an annual affirmation. There is no minimum number to hit because the assessment is pass/fail on each individual requirement.
Level 2
At Level 2, the 110-point methodology applies in full. A score of 110 earns Final Level 2 status. A score of at least 88, where every unmet requirement is POA&M-eligible under 32 CFR 170.21, earns Conditional Level 2 status — but only as a temporary bridge to the full 110. At
Level 3
Level 3, the bar rises further: organizations must first hold Final Level 2 status from a C3PAO assessment, then undergo a DIBCAC-led assessment against the 24 enhanced requirements drawn from NIST SP 800-172 requirements, each worth a single point.
The Level 2 thresholds deserve emphasis because they are widely misread. A score of 88 does not mean you passed. It means you are eligible for Conditional Level 2 status, and only if every unmet requirement is one the rule allows on a POA&M.
Conditional status starts a 180-day clock. Final Level 2 status requires the full 110, achieved either at the initial assessment or at the POA&M closeout assessment.
How to Calculate Your CMMC Score
The most reliable way to calculate your score is to work through all 110 requirements at the assessment-objective level using NIST SP 800-171A, the companion publication assessors use. A single requirement can contain a dozen objectives, and one failed objective fails the requirement. Conducting a NIST SP 800-171 gap assessment at this level of granularity is what separates a defensible score from an optimistic one.
Once gaps are identified, map each NOT MET requirement to its point value using Annex A of the DoD Assessment Methodology. Tag every gap with its 1, 3, or 5 point weight, applying the two partial-scoring rules for 3.5.3 and 3.13.11 where relevant. Then document implementation status in the SSP: for each requirement, the SSP should state how it is implemented, where, and by what mechanism. Requirements that are technically enforced but undocumented are routinely scored NOT MET in third-party assessments, because the assessor scores what can be evidenced, not what exists in theory.
Finally, sum the deductions and subtract from 110. An organization missing two 5-point, three 3-point, and four 1-point requirements scores 110 minus 23, or 87, one point short of Conditional eligibility, which is exactly the kind of margin that makes the weighting worth understanding before an assessment rather than after.
Pro Tip: Score Yourself
Score yourself against the assessment objectives in NIST SP 800-171A, not the requirement text in 800-171. Self-assessments done at the requirement level run optimistic because a control that is "mostly there" feels met. Assessors work objective by objective, and the CMMC Level 2 Assessment Guide shows precisely how they will score you. Using the same lens removes the gap between your number and theirs.
How to Submit Your CMMC Score in SPRS
Submission runs through PIEE. Register an account, request the SPRS Cyber Vendor role for your CAGE code, and wait for your Contractor Administrator to approve it. Once inside SPRS, the NIST SP 800-171 assessment entry asks for a defined set of fields: the assessment date, the summary score, the scope (enterprise, enclave, or contract-specific), the CAGE codes covered, the SSP name and version the assessment was performed against, and a planned date by which a score below 110 will reach 110.
The supporting documentation does not get uploaded. The SSP, the assessment workpapers, and the POA&M stay with you, but they must exist and they must reconcile with the submitted number — because they are exactly what DIBCAC reviews if your score is ever checked under a medium or high assessment.
Keep the record current. A score must be refreshed at least every three years to remain valid, the senior official’s affirmation of continuing compliance recurs annually under 32 CFR 170.22, and a material change to the environment — such as a cloud migration or a new system handling CUI — means recalculating and resubmitting rather than waiting for the cycle.
The Role of POA&Ms in CMMC Scoring
A Plan of Action and Milestones is a time-bound remediation plan for requirements scored NOT MET: what the deficiency is, what will fix it, who owns it, and by when. Under CMMC, its use is far narrower than most contractors assume. 32 CFR 170.21 permits POA&Ms only to reach Conditional status, and only when all of the following hold: the assessment score is at least 88, every POA&M item is a 1-point requirement, and none of the specifically prohibited requirements appear on the plan.
The 180-day window is rigid. The clock starts on the Conditional status date, and every POA&M item must be closed and verified through a POA&M closeout assessment within it. For a certification assessment, the closeout is performed by a C3PAO. If items remain open at day 180, the Conditional status expires, the organisation becomes ineligible for awards requiring that status, and the entire assessment must be repeated.
Insider note: There is exactly one situation in which something heavier than a 1-point item can sit on a POA&M — FIPS-validated encryption (3.13.11), and only in its partial state. If encryption is deployed but not FIPS-validated, the 3-point deduction is POA&M-eligible. If no encryption is in place at all, the full 5-point deduction applies, and the requirement cannot be deferred. In practice, this makes cryptographic module validation the single most consequential procurement question in a Level 2 readiness project.
Common CMMC Scoring Mistakes to Avoid
Overstating the self-assessment. When DIBCAC has reviewed self-reported scores under medium and high assessments, independently verified numbers have frequently come in dramatically below what contractors submitted. The gap is rarely fraud; it is requirement-level scoring, charitable interpretation, and confusing planned with implemented. The POA&M trap sits here too: a requirement on a plan of action is still NOT MET and still deducts its full point value.
An SSP that does not match reality. Assessors triangulate the submitted score, the SSP, and observable evidence. When the SSP describes controls that interviews and technical testing cannot confirm, the requirement fails — and the credibility of every other claim in the document drops with it.
Arithmetic and weighting errors. Treating partially implemented requirements as met, missing the two partial-scoring exceptions, or working from an outdated copy of the methodology all produce a number that will not survive verification.
Letting the POA&M go stale. Milestones without owners and dates, or items that quietly slip past their completion dates, convert a Conditional status into an expired one. The 180-day closeout is not extendable.
Pro Tip: The annual affirmation under 32 CFR 170.22
The annual affirmation under 32 CFR 170.22 is signed by a named senior official, and the Department of Justice has pursued False Claims Act cases against contractors over misrepresented cybersecurity compliance through its Civil Cyber-Fraud Initiative. An optimistic score is no longer a private estimate; it is a federal representation with a signature on it.
How to Improve Your CMMC Score
Sequence remediation by weight, not by ease. Closing five 1-point documentation gaps moves the score five points; closing one 5-point technical control moves it the same distance and removes a requirement that can never sit on a POA&M. The 5-point population — which includes boundary protection, access control enforcement, flaw remediation, and audit logging — is where both the score and the actual security risk concentrate.
Next, close the documentation layer. A meaningful share of NOT MET findings in otherwise capable organisations are evidence failures: the control runs, but no policy requires it, no procedure describes it, and no artefact proves it. Fixing this is cheap relative to its scoring impact.
Finally, treat the score as a maintained asset. Configuration drift, expired FIPS certificates after patching, and new systems entering scope all erode a score between assessments. Continuous monitoring tied to the SSP, with the score recalculated whenever the environment changes materially, keeps the SPRS record defensible and avoids a scramble before the next triennial cycle.
Self-Assessment vs. Third-Party Assessment Scoring
The methodology is identical in both paths; what changes is who applies it, how evidence is tested, and what the result is worth contractually.
In a self-assessment, the contractor scores its own environment, enters the result in SPRS, and a senior official affirms it. This satisfies the requirement for contracts that specify only the basic DFARS 252.204-7012 reporting obligation or a CMMC Level 1 or Level 2 self-assessment status. The score is the contractor’s own claim, and it carries the legal weight of that affirmation.
In a third-party assessment, a Certified Third-Party Assessment Organization (C3PAO) applies the same 110-requirement methodology with independent evidence testing — document review, interviews, and technical observation — across the defined assessment scope. The result is entered into eMASS and flows to SPRS as a formal certification status rather than a self-reported number. For Level 3, the assessor is DIBCAC rather than a C3PAO, and the additional 24 requirements from NIST SP 800-172 are scored on top of a confirmed Final Level 2 foundation.
Level 1 sits apart from both: a simple annual self-assessment of 15 requirements with no numeric score, no POA&Ms, and an annual affirmation. Organisations that completed a Joint Surveillance Voluntary Assessment (JSVA) with DIBCAC before the rule took effect were able to convert a perfect result into early certification standing, which is why JSVA alumni dominate the first wave of certified companies.
CMMC scoring rewards organizations that measure themselves the way an assessor would: objective by objective, evidence first, weighted gaps prioritized, and a POA&M used as a short runway rather than a parking lot.
The contractors who struggle are almost never the ones with the worst security; they are the ones whose number was built on assumptions instead of assessment.
Frequently Asked Questions
What is the minimum SPRS score for CMMC Level 2?
Final Level 2 status requires 110. A score of at least 88 can earn Conditional Level 2 status, but only if every unmet requirement is POA&M-eligible under 32 CFR 170.21 and all items close within 180 days.
How often do I need to submit my SPRS score?
A score is valid for three years, but the senior official’s affirmation of continuing compliance is annual, and any material change to the assessed environment requires recalculating and resubmitting before the cycle ends.
What happens if my SPRS score is negative?
Nothing automatic, but it is visible to contracting officers and primes as a clear signal of non-implementation, and it places Conditional eligibility (88) far out of reach. First honest assessments commonly land negative; the response is a weighted remediation plan, not a resubmission.
Can I bid on DoD contracts with a low SPRS score?
Where only the self-assessment reporting requirement applies, a current score of any value can satisfy the letter of the rule. Once a solicitation specifies a CMMC status under DFARS 252.204-7021, the required status is an eligibility condition, and a low score means no award.
How long is my SPRS score valid?
Three years from the assessment date, subject to the annual affirmation and to resubmission if the environment changes materially.
What is the difference between an SPRS score and a CMMC certification?
The SPRS score is a self-reported number under the DoD Assessment Methodology. A CMMC Level 2 certification is a formal status — Conditional or Final — resulting from an assessment by a C3PAO at Level 2 or DIBCAC at Level 3, using the same scoring rules. The first is a claim; the second is a verified credential.
Who has access to my SPRS score?
SPRS is not public. DoD personnel — including contracting officers, program offices, and DCMA/DIBCAC — can view it, and prime contractors can confirm whether a subcontractor holds a current assessment when verifying flow-down compliance.
