NIST 800-171 SPRS Score Workbook for CMMC Level 2

Score your NIST SP 800-171 self-assessment the way the DoD actually scores it, and know your exact SPRS number before you report it.

This is a working Excel tool, not a guide. You assess each of the 319 NIST SP 800-171A determination statements; the workbook rolls them up to the 110 NIST SP 800-171 (Rev 2) controls and auto-calculates your weighted SPRS score in real time, from 110 down to the -203 floor, using the official DoD Assessment Methodology (v1.2.1, Annex A) point values.

What's inside (6 tabs):

• SPRS Dashboard: live score, controls met / not met, % assessed, points to recover, gap to the 88/110 conditional threshold, and a projected date to reach 110.
• Control Assessment (110): every Rev 2 requirement with its DoD weight; status and points lost calculated automatically.
• Objective Assessment (319): every NIST SP 800-171A objective with Met / Not Met / N/A status, evidence reference, and notes.
• Remediation & Projected Date: every open control in one filterable view.
• Reference: primary sources and the full scoring model.
• Start Here: how it works, in plain English.

Built right:

• Official DoD 1/3/5 weighted scoring, reconciled exactly to the -203 floor.
• Correct partial-credit handling for 3.5.3 (MFA) and 3.13.11 (FIPS): 3 points, not 5.
• 3.12.4 (SSP) treated as the 0-point gate it is, with an on-screen warning when it's missing.
• A control counts as Met only when every one of its objectives is Met, so the score is never inflated.

Who it's for: defense contractors and subcontractors handling CUI, MSPs and consultants prepping clients for CMMC Level 2, and anyone who has to post a NIST 800-171 score to SPRS under DFARS 252.204-7019 / -7020.

Sources cited inside: NIST SP 800-171 Rev 2, NIST SP 800-171A, NIST SP 800-171 DoD Assessment Methodology v1.2.1, 32 CFR Part 170, DFARS 252.204-7012 / -7019 / -7020 / -7021.

Tool, not legal advice. It does not by itself establish compliance, certification, or an official SPRS score; CMMC and SPRS determinations rest with the DoD, DIBCAC, and authorized C3PAOs.