--- title: "NIST SP 800-171 scoring in SPRS: how the 110-point method works" canonical: "https://teamingindex.com/knowledge/nist-800-171-sprs-scoring" lastReviewed: "2026-11-08" markdown_url: "https://teamingindex.com/knowledge/nist-800-171-sprs-scoring.md" topic: "CMMC & cybersecurity" summary: "How the DoD Assessment Methodology turns the 110 NIST SP 800-171 requirements into a score from 110 down to -203, how Basic, Medium and High assessments differ, and what is posted to SPRS." --- # NIST SP 800-171 scoring in SPRS: how the 110-point method works > How the DoD Assessment Methodology turns the 110 NIST SP 800-171 requirements into a score from 110 down to -203, how Basic, Medium and High assessments differ, and what is posted to SPRS. - Topic: CMMC & cybersecurity - Last reviewed: 2026-11-08 - Canonical URL: https://teamingindex.com/knowledge/nist-800-171-sprs-scoring If your company handles Controlled Unclassified Information for DoD, your cybersecurity posture is summarized in one number: your **NIST SP 800-171 DoD Assessment score**, recorded in the Supplier Performance Risk System (SPRS). DFARS 252.204-7012 requires you to implement the 110 security requirements of NIST SP 800-171 on systems that handle covered defense information. DFARS 252.204-7019 and 252.204-7020 require an assessment of that implementation, scored with the **DoD Assessment Methodology** and posted to SPRS. CMMC Level 2 uses the same scoring approach (32 CFR 170.24). ## How the score is calculated The method is simple subtraction: 1. Start at **110**, one point for each NIST SP 800-171 requirement. 2. For every requirement that is **not fully implemented**, subtract its weight: **5, 3 or 1 point**, depending on how much the gap would hurt the protection of CUI. 3. A requirement on a plan of action still counts as not implemented until it is actually done. Because the weights add up to more than 110, the score can go negative. The lowest possible score is **-203**, when nothing is implemented. Two requirements allow partial credit under the methodology: multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11), where a partial implementation subtracts fewer points than none at all. | Situation | Score | | --- | --- | | All 110 requirements implemented | 110 | | One 5-point requirement not implemented | 105 | | Two 3-point and four 1-point requirements not implemented | 100 | | One 5-point, one 3-point and two 1-point requirements not implemented | 100 | | Nothing implemented | -203 | One requirement works differently: you cannot score an assessment at all without a **system security plan** (requirement 3.12.4). The SSP describes your system boundary, environment and how each requirement is implemented, and assessors work from it. ## Basic, Medium and High assessments DFARS 252.204-7020 defines three assessment types, which differ in who performs them and how much confidence DoD can place in the result: | Type | Performed by | What happens | Confidence | | --- | --- | --- | --- | | Basic | The contractor | A self-assessment using the methodology | Low | | Medium | DoD (DCMA's DIBCAC) | A review of your Basic assessment, SSP and supporting description | Medium | | High | DoD (DCMA's DIBCAC) | An on-site or virtual assessment that examines, interviews and tests | High | Most companies post Basic assessments. Medium and High assessments are initiated by DoD, and DFARS 252.204-7020 requires you to give the Government access to your facilities, systems and personnel when it does one. ## What gets posted to SPRS For a Basic assessment, SPRS records summary information, not your detailed results: - The standard assessed (NIST SP 800-171) and who performed the assessment - The CAGE codes covered by each system security plan - The date the assessment was completed - The summary score (for example, 95 out of 110) - The date by which you expect to implement every requirement, based on your plans of action An assessment is considered current for **three years** from its completion date unless a solicitation specifies a shorter period (DFARS 252.204-7019). See [keeping your assessment current](https://teamingindex.com/knowledge/dfars-252-204-7019-assessment-currency) for the renewal calendar. ## Improving your score - **Fix 5-point gaps first.** They protect the most and move the score the most. Typical examples are access control, multifactor authentication and incident response capabilities. - **Look for quick 1-point wins** in documentation and configuration, but do not let them crowd out high-weight work. - **Keep the SSP and plans of action honest and current.** They are the evidence behind the number. - **Re-assess and re-post when you improve.** A new Basic assessment can be posted whenever your implementation changes; a better, current score helps at every award. - **Scope deliberately.** A well-defined enclave for CUI can be easier to secure and assess than an entire enterprise network, provided CUI really stays inside it. ## Common pitfalls > **Pitfall:** Rounding up. Posting a score that your SSP and evidence cannot support is a misrepresentation to the Government. Misstated cybersecurity compliance has been the basis of False Claims Act settlements, and a Medium or High assessment can expose the gap. - **Counting planned work as done.** Implemented means implemented today, not scheduled. - **Ignoring partial credit rules.** Multifactor authentication and encryption have specific partial-credit conditions; read the methodology instead of estimating. - **Forgetting system changes.** A new cloud service, merger or network redesign can change the scope your score describes. - **Treating the score as the goal.** The score summarizes your protection of CUI. Primes and assessors will look at the underlying evidence. ## Who sees your score SPRS is a Government system: your score is visible to your company and to authorized Government users, not to other contractors browsing the system. Many subcontractors treat the exact number as sensitive competitive information and share it with a prime only under a non-disclosure agreement. That tension, primes needing assurance and subcontractors wanting privacy, is why TeamingIndex publishes [blind SPRS brackets](https://teamingindex.com/knowledge/blind-sprs-brackets) instead of exact scores. ## How TeamingIndex helps - Record your summary score, assessment date and assessment type privately on your [compliance dashboard](https://teamingindex.com/dashboard/compliance). Never upload your SSP or POA&M: TeamingIndex stores verification metadata only. - Your profile shows the thresholds you meet (for example, "SPRS ≥ 85"), the assessment date, the assessment type and whether the assessment is still current. The exact score is shown only if you make it public, to your own organization, to platform admins, or to a partner after a mutual NDA is recorded. - Primes can filter for partners by minimum bracket in the [directory](https://teamingindex.com/directory), with verified credentials only if they choose. ## Official sources - [DFARS 252.204-7020: NIST SP 800-171 DoD Assessment Requirements](https://www.ecfr.gov/current/title-48/section-252.204-7020) - [DFARS 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements](https://www.ecfr.gov/current/title-48/section-252.204-7019) - [DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting](https://www.ecfr.gov/current/title-48/section-252.204-7012) - [32 CFR 170.24: CMMC Scoring Methodology](https://www.ecfr.gov/current/title-32/section-170.24) Not legal advice. TeamingIndex guides are general information to help you plan, not legal advice. Regulations, clauses and program rules change and solicitations can tailor them: always work from the current regulation and the clauses in your solicitation, and confirm decisions with your contracting officer or counsel.