The range in one paragraph
A contractor starts at 110 if all 110 NIST SP 800-171 requirements are met. Every requirement not met subtracts its weight — 5, 3 or 1 — and two requirements subtract 3 instead of 5 when their partial condition applies. The weights total 313, so the arithmetic floor is 110 − 313 = -203. A negative score therefore does not mean "no security"; it means the deductions exceed the 110-point maximum.
The number is also not a pass/fail result. CMMC Level 2 uses the same 110-point scale, but the 88 line in the regulation is a ratio condition for one status path, not a universal pass mark.
Score bands
| Score | Points missing | What the number means | CMMC Level 2 relevance |
|---|---|---|---|
| 110 | 0 | All 110 requirements are MET, or justified N/A. | The maximum. No POA&M is needed for the score. This is the all-MET path, not a validation of the evidence. |
| 88 – 109 | 1 – 22 | At or above 0.8 of the maximum. | The 0.8 ratio can be met. Conditional Level 2 also requires every open requirement to be POA&M-eligible and on the POA&M, and none of the six excluded requirements to be open. |
| 1 – 87 | 23 – 109 | Below 0.8 of the maximum. | The ratio condition in 170.21(a)(2)(i) is not met on this score. That does not mean nothing is implemented; it means the score is below the line. |
| 0 – -202 | 110 – 312 | Deductions reach or exceed the 110-point maximum. | The ratio condition is also below 0.8. A negative score is common early in a programme and does not change the arithmetic. |
| -203 | 313 | Every point of weight is deducted. | The floor. In the calculator it is what "nothing assessed" produces; in an assessment it would mean every requirement is NOT MET. |
Points missing = 110 − score. The 88–109 band has 1–22 points missing; the 1–87 band has 23–109.
Where 88 comes from
The number is not a quality grade. It is 0.8 × 110. 32 CFR 170.21(a)(2)(i) says a Conditional Level 2 POA&M is permitted only if "the assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8." With 110 requirements, that is 88.
It is one of three conditions in 170.21(a)(2):
- Score ratio: assessment score ÷ 110 ≥ 0.8.
- Point value: no POA&M item may have a point value greater than 1, except SC.L2-3.13.11 at 3 points when encryption is employed but is not FIPS-validated.
- Excluded requirements: none of AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 or PE.L2-3.10.5 may be on the POA&M.
The 0.8 test uses the assessment score, not the after-closeout score. A POA&M is a plan for requirements that are already NOT MET on the assessment date. Closing items later changes the later score; it does not raise today's ratio. That is why a plan that projects 110 after closeout can still fail the entry condition for Conditional Level 2.
It also means 88 is not "the passing score" for CMMC Level 2. The POA&M path produces Conditional Level 2, with a closeout assessment due within 180 days. Final Level 2 follows a passing score under 32 CFR 170.24; the POA&M route is not Final until the closeout is confirmed.
Why the same score can pass or fail the POA&M rules
All four examples below score 88: 22 points missing from 110. The difference is which requirements are open.
| Open requirements at assessment | Score | Can the 170.21 conditions be met? | Why |
|---|---|---|---|
| 22 one-point requirements, none of the six excluded | 88 | Yes, if all are on the list | 22 × 1 = 22; every item is in the 1-point class. |
| 1 five-point requirement + 17 one-point requirements | 88 | No | 5 + 17 = 22, but a 5-point requirement cannot be on the POA&M (3.13.11 has a separate 3-point partial case). |
| 1 three-point requirement + 19 one-point requirements | 88 | No | 3 + 19 = 22, but a 3-point requirement is above the 1-point limit. |
| 3.13.11 partial (2 points) + 20 one-point requirements | 88 | Yes, if all are on the list | 2 + 20 = 22; 3.13.11 may be included at 3 points when encryption is employed but not FIPS-validated. |
The first and fourth rows still require all open one-point requirements to be eligible (not one of the five excluded 1-point requirements) and on the POA&M. A single excluded requirement in the open set turns a "yes" into a "no" at the same score. This is the part a score band alone cannot tell you; the POA&M planner applies the list to your actual answers.
Why the floor is -203
The arithmetic is in the weights, not in a separate penalty:
- 42 fixed 5-point requirements = 210 points.
- 2 partial-capable requirements (3.5.3, 3.13.11) at 5 when not implemented = 10 points.
- 14 three-point requirements = 42 points.
- 51 one-point requirements = 51 points.
- 3.12.4 (System Security Plan) is not scored; its absence stops the assessment instead.
Total: 313. The maximum score is 110, so the floor is 110 − 313 = -203. The method page has the full 110-row table and the export schema.
Compliance background: SPRS, DFARS and CMMC
Three different things get mixed together in this space. Keep them separate:
| Instrument | What it does |
|---|---|
| DFARS 252.204-7012 (MAY 2024) | Requires adequate security for covered contractor information systems, including implementation of NIST SP 800-171, and rapid reporting of cyber incidents (defined as within 72 hours of discovery). |
| DFARS 252.204-7019 (NOV 2023) | To be considered for award, an offeror required to implement NIST SP 800-171 must have a current assessment — not more than 3 years old unless the solicitation says less — with summary level scores posted in SPRS. |
| DFARS 252.204-7020 (NOV 2023) | Defines Basic (contractor self-assessment), Medium and High assessments. A Basic assessment is self-generated and results in a confidence level of "Low"; summary level scores are posted in SPRS. |
| 32 CFR Part 170 | The CMMC programme rule: Level 2 assessment statuses, the 170.21 POA&M conditions, and the 170.24 scoring methodology. |
| DFARS 252.204-7021 (NOV 2025) | The CMMC Level requirements clause, with its own definitions of current status, affirmations and assessment types. |
SPRS is a repository, not an assessment. It holds summary level scores and related assessment data. A SPRS summary score is not a CMMC Level 2 certification, and a CMMC Level 2 status is not the same thing as a NIST SP 800-171 self-assessment score. The CMMC statuses (Conditional and Final, each for Self or C3PAO) are set out in 32 CFR 170.16 and 170.17.
A score in the 88–109 band is therefore necessary for the Conditional Level 2 path, not sufficient for a status. The status depends on the assessment findings, the POA&M list, the closeout and the affirmations — not on the number alone.
What to do with a score
| Situation | Next step |
|---|---|
| Score below 88 | The 0.8 ratio is not met. Use the target-score planner to find the fewest unmet requirements to close; the score will need to rise before a Conditional Level 2 POA&M is possible. |
| Score 88 or above, with an open requirement that is not POA&M-eligible | Conditional Level 2 is not available until that requirement is met. A 5-point, 3-point or excluded item cannot be carried on the POA&M, apart from the 3.13.11 partial case at 3 points. |
| Score 88 or above, all open requirements eligible and on the list | The 170.21 list conditions can be met. The POA&M closeout assessment is due within 180 days; the status is Conditional Level 2 until closeout. |
| No open requirements (110) | There is nothing to put on a POA&M. The all-MET path is the Final Level 2 path, subject to the assessment and affirmation rules. |
Score-range questions
Is 88 a passing SPRS score?
There is no universal passing SPRS number. 88 is 0.8 × 110, the ratio that 32 CFR 170.21(a)(2)(i) requires for a Conditional Level 2 POA&M, and it is only one of three conditions. Final Level 2 follows a passing score under 32 CFR 170.24; the POA&M route produces Conditional Level 2 and requires closeout within 180 days.
Can an SPRS score be negative?
Yes. The 110 requirements carry 313 points, and a score is 110 minus the points for unmet requirements. With every weight deducted the floor is -203, so a negative score is arithmetic, not a separate penalty.
Does a score of 110 mean compliant?
It means all 110 requirements were marked met or justified N/A in the self-assessment. It does not independently validate the evidence, and it is not a CMMC Level 2 certification. Final CMMC status comes from the assessment process under 32 CFR Part 170.
Does a higher score always improve CMMC Level 2 eligibility?
No. The 0.8 ratio is one condition. A score of 88 with one open 5-point requirement fails the POA&M point-value rule, while 88 made up of 22 eligible one-point requirements can pass the list conditions. The composition of the open items matters, not only the total.
How current must a NIST SP 800-171 assessment be?
DFARS 252.204-7019 requires a current assessment, defined there as not more than 3 years old unless the solicitation specifies a shorter period, with summary level scores posted in SPRS. CMMC status has its own currency and affirmation rules under 32 CFR Part 170.
Sources
- NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (PDF) — weights, partial credit, 110 maximum and the 3.12.4 rule. Checked 2026-10-30.
- 32 CFR 170.21 — Plan of Action and Milestones requirements — the 0.8 ratio, point-value limit, excluded requirements and 180-day closeout. Checked 2026-10-30.
- 32 CFR 170.24 — CMMC Scoring Methodology — the 110-point Level 2 scoring scale and the N/A = MET rule. Checked 2026-10-30.
- 32 CFR Part 170 — CMMC statuses, including Conditional and Final Level 2 in 170.16 and 170.17. Checked 2026-10-30.
- DFARS 252.204-7012, 252.204-7019, 252.204-7020 and 252.204-7021 — the safeguarding, assessment, SPRS and CMMC clauses. Checked 2026-10-30.
- NIST SP 800-171 Rev 2 — the 110-requirement standard. Checked 2026-10-30.
All external sources above were opened on 2026-10-30. The arithmetic uses the same weights as assets/data.js: 110 items, 313 points, floor -203.
Related: how the 313-point method works · target-score planner · POA&M current vs after-closeout · CMMC Level 2 assessment guide