SPRS Score

Your SPRS score is the single number that summarizes CMMC Level 2 readiness. Learn how it's calculated, why controls are weighted, and how to raise it fastest.

The SPRS score (Supplier Performance Risk System) is the number the DoD uses to gauge how well a contractor meets NIST SP 800-171. It runs from a perfect 110 down to −203, and it's the headline metric of your CMMC Level 2 readiness. DIBFI calculates it live from your assessment, so it moves as you implement controls and record evidence.

Your current score appears on your dashboard and your compliance path. It updates automatically — there's nothing to recompute by hand.

Key concepts

How the score is built

You start with a perfect 110 — one point for each of the 110 Level 2 practices. For every control that isn't fully met, DoD's methodology subtracts that control's point value. There is no artificial floor: if enough high-value controls are unmet, the score is negative (the DoD methodology bottoms out at −203).

The score is a subtraction game. You don't "earn" points by doing work — you start at 110 and stop losing points as you close gaps.

Weighted controls

Not every control costs the same. DoD weights each 800-171 control by how much risk it carries, so a missing multifactor-authentication control hurts far more than a minor documentation one.

Point value	What it means
5 points	Highest-impact controls — the ones that matter most to protecting CUI
3 points	Significant controls
1 point	Baseline controls

One control — documenting your System Security Plan — is a gating requirement: it's worth 0 points toward the number, but you cannot be considered compliant without it. DIBFI tracks it like any other requirement even though it doesn't move the score.

When does a control count as "met"?

A CMMC practice is made up of one or more objectives. A control counts toward your score only when every one of its in-scope objectives is met. That has two consequences worth remembering:

A control that is only partially implemented still counts as not met — it deducts its full point value, exactly as if nothing were done. And any objective you haven't assessed yet counts as not met until you record its status. "In progress" earns nothing until it's complete.

Using your score

Raise it the fastest way

Open your gaps

Your open gaps are the controls that aren't fully met. DIBFI ranks them by point value — the biggest score wins first.

Work the highest-value gaps

Implement the 5-point controls before the 1-point ones. Closing a single 5-point gap raises your score five times more than a 1-point gap for similar effort.

Finish every objective in the control

Because a control only counts when all its objectives are met, don't leave one objective unassessed — you'll get zero score credit until the last one is done.

Record evidence

Mark each objective's status and attach the evidence that proves it. As controls flip to fully met, your score climbs in real time.

Understand a negative score

A negative score isn't a bug — it's the DoD methodology working as designed. It means enough high-value controls are unmet that the deductions exceed 110. As you implement controls, the score climbs back toward 110.

Permissions

Your SPRS score is visible to every role — it's a read-only rollup. Changing it means doing the underlying work (assessing objectives, implementing controls, adding evidence), which follows those features' own permissions.

How it works

The calculation, in plain terms

DIBFI takes your in-scope controls, checks whether each one is fully met, and subtracts the DoD point value of every control that isn't. The result is your score. Because the weighting and the "all objectives must be met" rule come straight from the DoD Assessment Methodology, the number you see is the number you'd report — reproduced from your real data, not an estimate.

What's in scope

Objectives you've marked Not Applicable (with a justification) are excluded from the calculation, so an irrelevant control never counts against you. Everything else that applies to your environment is included.

POA&Ms and your score

Putting an unmet control on a POA&M does not restore its points — the control still counts as not met until the remediation is complete and the objectives are satisfied. A POA&M is a plan to recover those points, not a substitute for the work. (CMMC also limits which controls may be on a POA&M and for how long.)

Always current

Every change you make — a status update, a new piece of evidence, an objective marked applicable or not — is reflected in the score immediately. There's no nightly batch and no manual recalculation.

Assessments

Record objective status — the work that drives the score.

POA&M

Plan the remediation of unmet, score-costing controls.

Evidence Locker

Prove each objective is met.

Self-Assessment

Work through your CMMC objectives one at a time, record a determination and narrative for each, and watch your SPRS score update live as you go.

Systems & Objectives

Catalog the systems in your CUI environment, categorize each by its role in scope, and work every control objective against them — the day-to-day compliance work that drives your assessment, SPRS score, and SSP.