Score your own system with the free CMMC Pal SPRS calculator, which uses these weights. For the arithmetic and partial-credit rules, see the SPRS scoring method.
Compiled by CMMC Pal from the same 110-requirement dataset the calculator uses. Weights are the DoD assessment weights for NIST SP 800-171, not our own ranking.
The shape of the scale
The SPRS score starts at 110. Every requirement you mark "not met" subtracts its weight. The 110 requirements carry 313 points in total, so a contractor with nothing in place scores -203.
| Weight | Controls | Points | Share of the scale |
|---|---|---|---|
| 5 pts | 44 | 220 | 70.3% |
| 3 pts | 14 | 42 | 13.4% |
| 1 pt | 51 | 51 | 16.3% |
| 0 pts | 1 | 0 | 0.0% |
| Total | 110 | 313 | 100% |
44 controls carry 5 points each. That is 220 of 313 points — 70.3% of the entire scale — concentrated in 40.0% of the requirements.
Where the points sit, by control family
| Family | Points | Controls |
|---|---|---|
| Access Control | 54 | 22 |
| System and Communications Protection | 42 | 16 |
| Configuration Management | 33 | 9 |
| System and Information Integrity | 31 | 7 |
| Identification and Authentication | 27 | 11 |
| Media Protection | 23 | 9 |
| Audit and Accountability | 19 | 9 |
| Maintenance | 18 | 6 |
| Physical Protection | 14 | 6 |
| Security Assessment | 13 | 4 |
| Awareness and Training | 11 | 3 |
| Incident Response | 11 | 3 |
| Risk Assessment | 9 | 3 |
| Personnel Security | 8 | 2 |
Access Control alone carries 54 points. If your gap analysis is organised by document order rather than by weight, you will spend the same effort for fewer points.
All 44 five-point controls
Sorted by requirement number so you can tick them off against your SSP.
| # | Requirement | Family | Title |
|---|---|---|---|
| 1 | 3.1.1 | AC | Limit system access to authorized users, processes, devices |
| 2 | 3.1.2 | AC | Limit access to permitted transactions and functions |
| 3 | 3.1.12 | AC | Monitor and control remote access sessions |
| 4 | 3.1.13 | AC | Cryptographic protection of remote access sessions |
| 5 | 3.1.16 | AC | Authorize wireless access prior to connection |
| 6 | 3.1.17 | AC | Protect wireless access using authentication and encryption |
| 7 | 3.1.18 | AC | Control connection of mobile devices |
| 8 | 3.2.1 | AT | Security awareness of risks |
| 9 | 3.2.2 | AT | Role-based security training |
| 10 | 3.3.1 | AU | Create and retain system audit logs |
| 11 | 3.3.5 | AU | Correlate audit review, analysis and reporting |
| 12 | 3.4.1 | CM | Establish baseline configurations and inventories |
| 13 | 3.4.2 | CM | Establish and enforce security configuration settings |
| 14 | 3.4.5 | CM | Access restrictions for changes |
| 15 | 3.4.6 | CM | Least functionality |
| 16 | 3.4.7 | CM | Restrict nonessential programs, ports, protocols, services |
| 17 | 3.4.8 | CM | Application blacklisting/whitelisting policy |
| 18 | 3.5.1 | IA | Identify users, processes, devices |
| 19 | 3.5.2 | IA | Authenticate users, processes, devices |
| 20 | 3.5.3 | IA | Multifactor authentication (partial=3) |
| 21 | 3.5.10 | IA | Store and transmit only protected passwords |
| 22 | 3.6.1 | IR | Operational incident-handling capability |
| 23 | 3.6.2 | IR | Track, document, report incidents |
| 24 | 3.7.2 | MA | Controls on maintenance tools and personnel |
| 25 | 3.7.5 | MA | MFA for nonlocal maintenance; terminate when done |
| 26 | 3.8.3 | MP | Sanitize or destroy media before disposal/reuse |
| 27 | 3.8.7 | MP | Control use of removable media |
| 28 | 3.9.2 | PS | Protect CUI during personnel actions (termination/transfer) |
| 29 | 3.10.1 | PE | Limit physical access |
| 30 | 3.10.2 | PE | Protect and monitor physical facility |
| 31 | 3.11.2 | RA | Scan for vulnerabilities |
| 32 | 3.12.1 | CA | Periodically assess security controls |
| 33 | 3.12.3 | CA | Monitor security controls continuously |
| 34 | 3.13.1 | SC | Monitor, control, protect communications at boundaries |
| 35 | 3.13.2 | SC | Secure architecture and engineering principles |
| 36 | 3.13.5 | SC | Subnetworks for publicly accessible components |
| 37 | 3.13.6 | SC | Deny network traffic by default |
| 38 | 3.13.11 | SC | FIPS-validated cryptography (partial=3) |
| 39 | 3.13.15 | SC | Protect authenticity of communications sessions |
| 40 | 3.14.1 | SI | Identify, report, correct system flaws timely |
| 41 | 3.14.2 | SI | Protection from malicious code |
| 42 | 3.14.3 | SI | Monitor security alerts and advisories |
| 43 | 3.14.4 | SI | Update malicious code protection |
| 44 | 3.14.6 | SI | Monitor systems to detect attacks |
The three special lists
Partial credit (2)
These award 3 of 5 points when partially implemented. If you marked them "not met" because they are not perfect, you are leaving 4 points on the table.
| Requirement | Family | Title |
|---|---|---|
| 3.5.3 | IA | Multifactor authentication (partial=3) |
| 3.13.11 | SC | FIPS-validated cryptography (partial=3) |
Can be marked not applicable (5)
N/A requirements keep their full points — that is correct treatment, but only if you can justify it. If you cannot write the justification in one line, it applies.
| Requirement | Family | Title |
|---|---|---|
| 3.1.12 | AC | Monitor and control remote access sessions |
| 3.1.13 | AC | Cryptographic protection of remote access sessions |
| 3.1.16 | AC | Authorize wireless access prior to connection |
| 3.1.17 | AC | Protect wireless access using authentication and encryption |
| 3.1.18 | AC | Control connection of mobile devices |
Level 1 requirements (17)
3.1.1, 3.1.2, 3.1.20, 3.1.22, 3.5.1, 3.5.2, 3.8.3, 3.10.1, 3.10.3, 3.10.4, 3.10.5, 3.13.1, 3.13.5, 3.14.1, 3.14.2, 3.14.4, 3.14.5
Eligible for a POA&M (47)
A POA&M changes what you can submit and when. It does not change the arithmetic: a requirement on a POA&M still costs you its points today.
3.1.3, 3.1.4, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.14, 3.1.15, 3.1.21, 3.2.3, 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.3, 3.4.4, 3.4.9, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.5.11, 3.6.3, 3.7.3, 3.7.6, 3.8.4, 3.8.5, 3.8.6, 3.8.9, 3.10.6, 3.11.3, 3.13.3, 3.13.4, 3.13.7, 3.13.9, 3.13.10, 3.13.11, 3.13.12, 3.13.13, 3.13.14, 3.13.16
How to use this table
- Take your current assessment and list every 5-point requirement marked "not met". That list is your real gap — everything else is detail.
- Inside that list, separate policy-and-configuration fixes from things you have to buy. Do the cheap ones first; that is usually where the next 20 points are.
- Check 3.5.3 and 3.13.11 specifically. Partial credit is normal for both, and worth 3 points each.
- Only then work down to 3-point and 1-point items.
- Re-score after each pass. If the number did not move, you fixed something that was already met.
The full 110-requirement checklist with live scoring is at cmmcpal.com — it applies these weights in the browser, shows which families are costing you the most, and does not upload anything.
Weights and flags are read from the assessment dataset on 2026-10-31. If your assessment was done under a different CUI scope, the arithmetic holds but the inputs change.