For small DoD contractors who need a rough NIST SP 800-171 DoD Assessment score before posting to SPRS: tick what you have actually implemented across the 110 controls and get a live score, the points you are losing by family, and the shortest path to 88.
Your SPRS score starts at 110. For each NIST SP 800-171 requirement you have not met, subtract its value of 5, 3 or 1 points. The score can go negative, down to −203. Apart from a narrow exception for temporary deficiencies, a plan of action for a missing requirement earns no points.
How it scores: every control starts as not implemented (score −203). Ticking a control adds back its Annex A value: 5 significant exploitation risk · 3 specific, confined effect · 1 everything else. 3.5.3 (MFA) and 3.13.11 (FIPS crypto) have a partial state worth 3 back. A control that sits on a POA&M counts as not implemented — the methodology gives no credit for plans.
If remote access, wireless or mobile devices are prohibited outright in your environment, the methodology lets you treat 3.1.12/3.1.13, 3.1.16/3.1.17 and 3.1.18 as not applicable (no deduction) — tick them here and document the justification in your SSP.
Estimate below is out of date — it updates automatically in a moment.
| Gap | Requirement | Points off |
|---|---|---|
| No MFA for any user | 3.5.3 | 5 |
| Encryption on, not FIPS-validated | 3.13.11 (partial) | 3 |
| No audit logs | 3.3.1 | 5 |
| External connections not controlled | 3.1.20 | 1 |
Result: 110 − 14 = 96.
MFA for remote and privileged users only still costs 3 points.
Rules are moving. Get one email when CMMC or SPRS rules change, plus new free GovCon tools.
Get the email updates →Turn this estimate into a scored assessment, SSP draft and POA&M. SPRS Score Coach walks each of the 110 requirements with assessment objectives, builds the System Security Plan and the Plan of Action, and produces the exact entries for your SPRS posting.
Go further: SPRS Score Coach builds your SSP, POA&M and affirmation calendar ($1,290/yr)