What a self-assessment actually is
You assess your own environment against the 110 NIST SP 800-171 requirements, work out a score, and — if required — submit that score in the DoD's Supplier Performance Risk System (SPRS). The score is a summary: 110 down to -203, calculated from the requirements you do and do not meet.
The output is not the number. The output is three documents: a system security plan, a POA&M, and evidence for each requirement. The number is what falls out of them.
The five steps, in order
1. Scope before scoring
Write down every system, cloud service and person that touches CUI. Most contractors over-scope and then drown, or under-scope and then fail an assessment when the assessor finds CUI on a laptop nobody mentioned. The SSP (3.12.4) starts here, not at the end.
2. Score honestly, item by item
The methodology is binary. A requirement is met or it is not. Two exceptions allow partial credit: 3.5.3 (MFA) and 3.13.11 (FIPS-validated cryptography) give 3 of 5 points when partially implemented. Everything else is all or nothing.
This is where most scores get inflated. "We have antivirus" is not 3.14.2 unless it is managed, updated and monitored. Mark the gap, then fix it.
3. Turn every gap into a POA&M line
Each unmet requirement needs: what is missing, who owns it, the target date, and the estimated cost. A POA&M without dates is treated as no POA&M at all.
4. Collect evidence while you fix things
Evidence has a shelf life. A screenshot from six months ago proves nothing about today. Prefer exports with timestamps: configuration dumps, MDM reports, ticket histories, policy documents with revision tracking.
5. Re-score before you submit
Between the first pass and submission, controls change. Re-run the score the week you submit, not the month you started.
The most expensive mistake: overstating the score. A high score that does not survive a C3PAO assessment is worse than a low one, because it signals the programme was not real. Assessors read the SSP, the POA&M and the evidence — they do not read the number first.
Self-assessment vs certification — what actually differs
| Self-assessment | C3PAO certification | |
|---|---|---|
| Who assesses | You | Certified third party |
| Output | SPRS score | Certification, valid 3 years |
| Typical duration | 2–4 weeks to first score | 4–8 weeks on site, after remediation |
| What it proves | That you have looked | That someone else looked and agreed |
| Failure mode | Optimistic scoring | Evidence that does not match the SSP |
Run the score now
Fifteen minutes, 110 requirements, no signup. You will see your score, your point gap, and which families are costing you most.
Open the calculatorCommon questions
How long is a self-assessment valid?
An assessment older than three years is no longer considered current. Most contractors re-run annually, and again whenever the system boundary changes materially.
Can I mark requirements as not applicable?
Yes, with a documented justification. The five most commonly marked N/A are 3.1.12, 3.1.13, 3.1.16, 3.1.17 and 3.1.18 — all tied to remote access and wireless. "We didn't get round to it" is not a justification.
Do I need to submit the score myself?
Yes. The score is submitted by the contractor in SPRS. No third-party tool can submit it for you, including this one.
Related: The 110-point checklist · Level 2 assessment guide · Software that tracks the 110