How to Raise Your SPRS Score Without Inflating It

The email from your prime is short. They're updating supplier records and want your current SPRS score, the date it was posted, and the date you expect to reach 110. Someone in the office remembers a self-assessment from a few years back that landed somewhere around 100. The System Security Plan it was based on lives in a folder called "CMMC stuff OLD."

That number is about to become your problem. Before you go looking for ways to push it higher, get clear on what it actually measures. The quickest way to raise an SPRS score on paper is also the quickest way to get yourself in trouble.

Where the number actually comes from

Your SPRS score is calculated using the NIST SP 800-171 DoD Assessment Methodology. You start at 110, one point for each security requirement in NIST SP 800-171 Revision 2. For every requirement you haven't fully implemented, you subtract its weight. Each requirement is worth 5, 3, or 1 point. Miss enough of them and you go negative. The floor is -203.

(Yes, NIST published Revision 3 in 2024. DoD still assesses against Revision 2.)

Two details catch people every time.

First, a requirement is met or it isn't. Half done earns no credit. Only two requirements get partial scoring: multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11). Everything else is all or nothing, and "met" means every assessment objective for that requirement in NIST SP 800-171A is satisfied, with evidence to show for it.

Second, the SSP. Requirement 3.12.4, the System Security Plan, carries no point value at all. Not because it doesn't matter: without a current SSP, the methodology says the assessment can't be completed. No SSP, no valid score. (Our NIST SP 800-171 page covers what a usable SSP looks like.)

An honest 40 beats an optimistic 95

Your SPRS entry is a representation to the US government. Under CMMC, a senior person at your company, called the Affirming Official, affirms in SPRS that you've implemented the requirements and will keep them in place. That happens after each assessment and annually after that.

The Department of Justice has been using the False Claims Act on cybersecurity misrepresentations since it launched its Civil Cyber-Fraud Initiative in 2021. In 2025, Georgia Tech Research Corporation paid $875,000 to settle allegations that included submitting a score of 98 that, according to DOJ, didn't apply to any actual covered system. In 2024, Penn State paid $1.25 million to settle allegations that included misstating the dates by which it would implement controls it had already reported as missing. These were settlements of allegations, not court findings. But note the Penn State piece: the completion date you post is a claim too.

We're not lawyers. Practically, though, a low score with a believable plan is a conversation you can have with your prime. An inflated score is a liability that sits quietly until someone checks.

What a POA&M can and can't do

A Plan of Action and Milestones lists what isn't done yet and when it will be. Having one is itself a requirement (3.12.2, worth 3 points). It is not a substitute for the work. Under both the DoD methodology and the CMMC rule, anything sitting on your POA&M is still scored as NOT MET.

CMMC Level 2 narrows things further. Under 32 CFR 170.21, you can only reach Conditional status with open POA&M items if:

• Your score is at least 80% of the maximum, which works out to 88 out of 110.
• Every item on the POA&M is a 1-point requirement. The one exception is encryption: if you encrypt CUI but the encryption isn't FIPS-validated (a 3-point deduction), that item can go on the POA&M.
• None of the items are on the never-allowed list, which includes the SSP itself, a few physical access requirements (3.10.3, 3.10.4, 3.10.5), external connections (3.1.20), and control of publicly posted information (3.1.22).
• You close everything out within 180 days. If you don't, the conditional status expires.

So your 5-point and 3-point requirements need to be done before you assess. The POA&M is for the small stuff.

How SPRS and CMMC Level 2 fit together

CMMC Level 2 is built on the same 110 requirements, and the CMMC scoring methodology in 32 CFR 170.24 uses the same 5/3/1 weighting. Level 2 self-assessment results and affirmations go into SPRS. The work that raises your SPRS score is the same work that gets you ready for Level 2.

On timing: CMMC Phase 1 started November 10, 2025. On July 13, 2026, the Department of War suspended Phase 2, which was set to begin bringing in third-party C3PAO assessments in November 2026. For now, solicitations can only call for Level 1 or Level 2 self-assessments, and DoD has said it will enforce 800-171 through self-assessments and select government-led assessments. A reform task force is reviewing the program, so expect more changes.

Don't read the pause as a breather. With no third-party assessor in the loop, the number you post and the affirmation behind it carry more weight, not less. More on where Level 2 stands on our CMMC page.

Where the points actually are

If your score needs to move, here's the order we'd usually work in.

1. Get the SSP written, and scope it honestly. It should describe the environment where CUI really lives, not the one you wish you had. In our experience, bad scores usually start with fuzzy scoping, and sometimes the best move is shrinking scope before fixing anything, for example by moving CUI into a smaller enclave. That only works if the enclave is truly isolated from the rest of your network.

2. Turn on MFA for everyone. No MFA costs you 5 points. MFA only for remote and privileged users costs 3. MFA for all users costs nothing. In a lot of environments the capability is already sitting in the identity platform you pay for, and the real work is rollout and exceptions.

3. Make your encryption FIPS-validated, not just "strong." Requirement 3.13.11 calls for FIPS-validated cryptography to protect the confidentiality of CUI. Check the cryptographic module against NIST's Cryptographic Module Validation Program list and confirm the exact module and configuration you run match what was validated. Older certificates moved to historical status need a case-by-case look. That's worth 3 points if you already encrypt, 5 if you don't.

4. Close the 5-pointers that are mostly process. Several heavy requirements are less about buying tools and more about doing the thing and keeping records: security awareness training (3.2.1) and role-based training (3.2.2), incident handling and incident tracking and reporting (3.6.1, 3.6.2), periodic assessment of your own controls (3.12.1), and baseline configurations and inventory (3.4.1). Each is 5 points, and none needs a big purchase.

5. Then the technical 5-pointers. Audit logging (3.3.1), flaw remediation (3.14.1), malicious code protection (3.14.2), and vulnerability scanning (3.11.2). Most shops do some version of these already. The gaps are coverage and proof: the server nobody patches, the scan reports nobody kept.

6. Leave the 1-pointers for last, but not forever. They make up roughly half the list, and under CMMC they're the only items you can carry on a POA&M.

Once you're done, rescore honestly, update SPRS, and make sure your SSP, POA&M, and posted score all tell the same story.

Want a second set of eyes?

If you're about to post a score or put an executive's name on an affirmation, it helps to have someone check the math against the evidence first. That's what our SPRS support is for: lining up your score with your SSP and POA&M, spot-checking evidence behind the claims that matter most, and getting the affirmation ready. brs is not a C3PAO, and we won't promise you a number. We'll help you post one you can stand behind.