Your SPRS score, explained: why it runs from −203 to 110.

Where the number comes from

The DoD Assessment Methodology scores your implementation of NIST SP 800-171 Rev. 2. You start at 110 — one point of credit for each requirement — and then subtract a weighted penalty for every requirement you haven't fully implemented.

The weights aren't equal, because the risks aren't equal. Each unimplemented requirement costs 5, 3, or 1 points: five for the controls whose absence exposes the whole environment (think multifactor authentication or boundary protection), three for controls with specific but serious exposure, one for the rest.

Do the math across all 110 requirements and the deductions total 313 — which is why a company with nothing implemented lands at 110 − 313 = −203. Negative scores aren't a special punishment tier; they're just what the arithmetic produces. Most contractors' first honest self-assessment lands somewhere between −100 and +50.

Two controls get partial credit — and one gets none

• 3.5.3 (MFA): if you've deployed multifactor for remote and privileged access but not yet for general users, you lose 3 points instead of 5.
• 3.13.11 (FIPS-validated cryptography): if you encrypt CUI but the modules aren't FIPS-validated, you lose 3 points instead of 5.
• 3.12.4 (System Security Plan): there is no point value here, because without an SSP you are not eligible for a score at all. The methodology treats a missing SSP as "assessment cannot be completed."

Why honesty beats optimism

Your SPRS submission is a representation to the federal government, and the Department of Justice has already pursued False Claims Act cases over inflated cybersecurity attestations. An honest −40 with a dated plan of action is a defensible business position. A hopeful 110 you can't evidence is a liability with your signature on it.

There's a practical angle too: under the CMMC phase-in that began November 10, 2025, applicable new awards require a current self-assessment score in SPRS with an affirmation. Primes are reading those scores. A credible number with visible momentum reads far better than a perfect one that collapses under diligence.

Raising the score fastest

Because the weights are lopsided, sequencing matters more than effort. The pattern we see across engagements:

Move	Typical gaps closed	Points recovered
MFA everywhere (Entra ID conditional access)	3.5.3 and related access controls	5–15
FIPS-validated encryption for CUI at rest / in transit	3.13.11, 3.13.8, 3.8.6	9–15
Centralized logging + alerting (Sentinel)	3.3.x audit family	8–14
Boundary + segmentation cleanup	3.13.1, 3.13.5, 3.1.3	10–15

And before any of that: shrink the boundary. Every control you implement applies to everything in scope, so reducing scope first — see our CUI Scope Reduction Field Guide — makes every subsequent point cheaper.

Want the arithmetic done for you? The free CMMC Calculator scores all 110 controls with the official DoD weights, shows your points-at-risk ranked by impact, and builds a remediation scenario with real timelines.