CMMC SPRS Self-Score Calculator
Work through all 110 NIST SP 800-171 requirements and get your estimated DoD Assessment Methodology score — the number that goes into SPRS. It takes a few minutes, it runs entirely in your browser, and nothing is sent to Linne Consulting unless you choose to send it.
What Your SPRS Score Is
The DoD Assessment Methodology turns NIST SP 800-171 into a single number. You start at 110 — one point for every requirement — and subtract points for every requirement you have not fully implemented. Requirements are weighted 5, 3, or 1 depending on how much risk is left on the table when they are missing. The result is your self-assessment score, and it is what gets posted in the Supplier Performance Risk System.
DFARS 252.204-7019 & -7020
Under DFARS 252.204-7019, a current NIST SP 800-171 self-assessment score must be on file in SPRS before the DoD can award many contracts, and 252.204-7020 gives the government the right to come verify it. Primes increasingly ask their suppliers for the same thing before flowing work down.
An Estimate You Compute Yourself
This page uses the real scoring rules and the real point values. It gives you an honest working estimate in a few minutes, so you know roughly where you stand before you commit a number to a federal system. It is a starting point for a conversation — not a substitute for an assessment.
110 Minus What's Missing
Every requirement you mark Not Met subtracts its point value. Two requirements allow partial credit under the methodology — 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography) — where a partial implementation costs 3 points instead of 5. Those are the only two exceptions, and they are built in.
"Not Sure" Scores As Not Met
If you cannot demonstrate a control with evidence, an assessor scores it as not implemented — so this tool deducts for Not Sure the same way. It also counts them separately and shows you the list. A pile of "not sure" is not a scoring problem, it is a documentation problem, and it is the most common reason a real score comes in lower than expected.
Score Your Environment
Tap a family to expand it. Answer Met, Not Met, or Not Sure for each requirement. Anything you leave blank is not counted — your running score only reflects what you have answered.
If a requirement genuinely does not apply to your environment (no wireless, no remote access, no mobile devices), the methodology treats it as not applicable with no deduction — choose Met, which scores the same way.
Your Results
0 of 110 answered
Answer some requirements above and your read will appear here.
Send Your Result To Steven
Two ways to send it. Fill in the form and Linne Consulting receives your score, your answered count, and the requirements you marked Not Met or Not Sure. Or use the buttons underneath, which open your own email client with the same summary already written into the message and transmit nothing until you press send yourself.
Your answers stay in your browser while you work. Nothing leaves this page unless you submit the form or press send in your own email program. If you submit the form, the email address you type is used to follow up with you about this result — nothing else, and it does not go to anyone outside Linne Consulting.
Email doesn't open on your device? Copy your results with the button above and send them to contact@linneconsulting.com, or use the contact details on the main site. Linne Consulting is a Minnesota-based, SBA-certified Service-Disabled Veteran-Owned Small Business.
This is a self-estimate, not an assessment. The score this page produces reflects only what you clicked. A defensible NIST SP 800-171 score requires a review of actual evidence, a documented System Security Plan describing how each requirement is implemented in your environment, and a Plan of Action & Milestones for anything not yet in place. Scores submitted to SPRS are affirmed by a senior official of your company and are subject to government verification under DFARS 252.204-7020.
Your answers stay in your browser. The scoring runs on your own device and there is no analytics on your answers. The only way any of it reaches Linne Consulting is if you submit the form in the results panel or send the email yourself. If you submit the form, your score summary and the email address you type are sent to Linne Consulting and used to follow up with you about this result.
Point values follow the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020), Annex A. Requirement text is condensed from NIST SP 800-171 Rev 2 for readability — always work from the published source for a formal assessment.
Didn't Like The Number?
Most first scores come back negative. It is the normal starting point, not a verdict on your business. The useful next step is a control-by-control review of what is actually in place, and a roadmap that fixes the highest-weighted gaps first.