SPRS Scoring Method (v1.2.1)

The method in one paragraph

Start at 110. Every requirement marked not met subtracts its weight — 5, 3 or 1. Two requirements subtract 3 instead of 5 when their defined partial condition applies. The 110 requirements carry 313 points in total, so a contractor with every requirement met or justified N/A scores 110 and a contractor with every requirement not met scores -203. The calculator uses the same arithmetic: score = points earned − 203.

See the 44 five-point controls listed in one table, grouped by family.

The only difference between the two lines is bookkeeping. The total weight is 313, so earned − 203 and 110 − deductions always produce the same number.

Version, scope and the two legal instruments

The DoD methodology is the document the DFARS assessment clauses link to. CMMC Level 2 scoring is a separate legal instrument at 32 CFR 170.24. The arithmetic is the same; the governance is not. A SPRS summary score and a CMMC Level 2 assessment status are different things, even when the number behind them is calculated the same way.

Where 313 comes from

The 3.12.4 row is not a 1-point item. The methodology marks it NA and says its absence would result in a finding that an assessment could not be completed. That is a different failure mode from losing a point.

The two partial-credit rules, exactly

The methodology is not designed to credit partial implementation except in these built-in cases (Section 5(a) and 5(e)). 32 CFR 170.24(c)(2)(i)(B)(4) names the same two requirements. Every other requirement is met or not met; the calculator disables the Partial button on the other 108 rows for that reason.

A rollout percentage is not a partial finding by itself. The methodology's own example: if the initial rollout of 3.5.3 is 75% complete and a plan of action is still being implemented, 3.5.3 is considered not implemented. The 3-point condition is about which users have MFA, not what percentage of a project is finished.

N/A, and the one requirement that can stop an assessment

An N/A finding is not automatically a way to keep the points. The methodology's Annex A names five cases where its comment says not to subtract points:

• 3.1.12 and 3.1.13 — remote access is not permitted.
• 3.1.16 and 3.1.17 — wireless access is not permitted.
• 3.1.18 — connection of mobile devices is not permitted.

For CMMC scoring, 32 CFR 170.24(b)(3) states that an N/A finding is equivalent to the same objective being MET. Other N/A claims need a documented justification; they are not a way to skip a requirement you have not implemented. The calculator's N/A button is available on every row, but only those five rows carry the N/A ok marker.

3.12.4 (System Security Plan) has no point value in Annex A. Its absence does not cost 1, 3 or 5 points; it produces a finding that "an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012." A missing SSP is therefore a gate, not a deduction.

How to reproduce a score by hand

1. Take the 110 requirement IDs and their weights from the table below.
2. Give each requirement one finding: met, not met, N/A, or — only for 3.5.3 and 3.13.11 — partial.
3. Deduct 0 for met or justified N/A, 3 for the two partial cases, and the full weight for not met.
4. Subtract the deductions from 110.
5. Cross-check: earned points minus 203 must equal the same score.

Score: 110 − 14 = 96. Cross-check: earned points = 313 − 14 = 299; 299 − 203 = 96. Both routes agree.

What the CSV and JSON exports contain

The calculator has two data exports. They carry the same findings but not the same fields: the CSV includes a weight on every row, while the JSON does not. Here is the exact schema, taken from the export code the site runs.

CSV

Header: Requirement,Family,Weight,Status, followed by 110 data rows.

The CSV always has 110 data rows. An unanswered requirement is written as unassessed, which earns 0 points — the same arithmetic effect as not met, but a different label. There is no score, date, or method-version column; the score must be recomputed from Weight and Status.

JSON

Shape of a real export after four clicks, with every other requirement still unassessed:

{
  "score": -200,
  "assessed": 4,
  "answers": {
    "3.1.1": "not",
    "3.1.3": "not",
    "3.5.3": "partial",
    "3.8.7": "not"
  }
}

There is no weight, title, family, evidence, timestamp, or schema-version field. The JSON is a snapshot of answers, not a self-contained report: to recompute the score you need /assets/data.js.

Recompute the exported score

Run this from a directory containing assets/data.js and the exported cmmc-sprs-assessment.json:

const fs = require('fs');
global.window = {};
eval(fs.readFileSync('assets/data.js', 'utf8'));
const exp = JSON.parse(fs.readFileSync('cmmc-sprs-assessment.json', 'utf8'));

const earned = window.CMMC_DATA.reduce((n, it) => {
  const s = exp.answers[it.id];
  return n + (s === 'met' || s === 'na' ? it.w
            : s === 'partial' ? it.partial.value : 0);
}, 0);

console.log(earned - window.CMMC_SUM + 110, exp.score); // both numbers must match

The same check works by hand on the CSV: add the Weight of every row whose Status is not or unassessed, add 3 for partial on 3.5.3 or 3.13.11, then subtract the total from 110. Because the CSV includes all 110 rows, the total is complete without consulting the JSON.

Points by family

This is the same 313 points grouped by the 14 NIST SP 800-171 families. The 5-pt count includes 3.5.3 and 3.13.11, the two partial-capable requirements.

All 110 requirements, weights and special rules

The titles below are the calculator's labels; the weights are the values in the methodology's Annex A. 3.12.4 is the only non-scored row. The five rows marked with an N/A note are the cases Annex A names explicitly.

What the method does and does not determine

The next two pages apply the same weights to planning: the target-score planner finds the fewest unmet requirements to close, and the POA&M planner separates today's score from the score after listed items close.

Common scoring errors

Why do some sources say 42 weight-5 requirements while the total implies 44?

The fixed 5-point lists contain 42 requirements. Two more, 3.5.3 and 3.13.11, deduct 5 points when they are not implemented at all and 3 points when the defined partial condition applies. That gives 44 requirements capable of a 5-point deduction: 42 × 5 + 2 × 5 + 14 × 3 + 51 × 1 = 313. Folding the two partial-capable requirements into the 1-point bucket gives 42 × 5 + 14 × 3 + 54 × 1 = 306 and a floor of -196, which does not match the 313-point arithmetic or the -203 floor.

Can any requirement other than 3.5.3 and 3.13.11 get partial credit?

No. The DoD methodology defines partial deduction for only those two requirements, and 32 CFR 170.24(c)(2)(i)(B)(4) names the same two. A 75% rollout is not partial credit unless it matches the defined condition.

Does marking a requirement N/A keep its points?

Under 32 CFR 170.24(b)(3), an N/A finding is equivalent to MET in the CMMC scoring methodology. Annex A of the DoD methodology says not to subtract points for 3.1.12 and 3.1.13 when remote access is not permitted, 3.1.16 and 3.1.17 when wireless access is not permitted, and 3.1.18 when mobile device connections are not permitted. Other N/A claims need a documented justification.

Does putting a requirement on a POA&M stop the deduction?

No. The score reflects what is NOT MET on the assessment date. 32 CFR 170.24(c)(2)(i)(B)(6) says a POA&M is not a substitute for a completed requirement. POA&M completion changes the later score, not the score at assessment.

Does 3.12.4 reduce the score?

3.12.4 has no point value in Annex A. It is marked NA, not 5, 3 or 1. Its absence instead produces a finding that an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012.

A 75% MFA rollout is in progress. Is that partial credit?

Not by itself. 3.5.3 gets the 3-point partial deduction when MFA is implemented for remote and privileged users but not the general user. The methodology's own example says a 75% rollout with a plan of action still in progress is assessed as not implemented.

Sources

• NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (PDF) — June 24, 2020. Used for the 5/3/1 rules, the 42- and 14-item lists, the two partial-credit conditions, the N/A comments and the 3.12.4 rule. Checked 2026-10-30.
• 32 CFR 170.24 — CMMC Scoring Methodology — used for the CMMC Level 2 scoring scale, the N/A = MET treatment and the two partial-credit requirements. Checked 2026-10-30.
• 32 CFR 170.21 — Plan of Action and Milestones requirements — used for the POA&M eligibility boundary. Checked 2026-10-30.
• DFARS 252.204-7019 and 252.204-7020 (current clause text) — the clauses that link to the v1.2.1 methodology and require a current assessment. Checked 2026-10-30.
• NIST SP 800-171 Rev 2 — the 110-requirement standard the methodology scores. Checked 2026-10-30.

All external sources above were opened on 2026-10-30. The weights in the table match assets/data.js and the arithmetic in VERIFICATION.md: 110 items, 313 points, floor -203.