Your SPRS self-assessment score is arithmetic, not a guess

CMMC Phase 2 - the tranche that would have required third-party C3PAO certification for Level 2 contracts - was suspended by DoD on 13 July while a CMMC Reform Task Force reviews cost and assessor capacity. Checked as of this post's publish date: no resumption date has been announced, and none should be assumed. What did not pause: Phase 1 self-assessments in applicable solicitations, DFARS 252.204-7012's safeguarding requirement, NIST SP 800-171 Rev 2's 110 practices, the SPRS score posting itself, and the annual affirmation a company official signs. For a defense contractor, the third-party date moved. The number you post to SPRS yourself did not go anywhere, and neither did the signature under it.

That number is worth understanding as arithmetic, because most of what gets written about it treats it as a mystery score instead of a sum anyone can check.

The formula

The DoD Assessment Methodology (Version 1.2.1, Annex A) starts every contractor at 110 and subtracts a fixed value for every one of the 110 NIST SP 800-171 practices that is not fully implemented. A practice marked "not applicable" costs nothing. A practice that's implemented costs nothing. Everything else - not started, in progress, at risk, failing - costs its full Annex A value. There is no floor at zero: a system with nothing implemented scores -203, and that negative number is exactly what DoD expects to see reported, not an error state.

The split that most calculators get wrong

Annex A doesn't weight every requirement the same, and the split isn't a round number. CMDash's own scoring module - the same function (sprsWeightTally()) that runs both the in-product SPRS score and the free public calculator at /tools/sprs-calculator - tallies it as:

• 42 requirements worth 5 points each
• 14 requirements worth 3 points each
• 51 requirements worth 1 point each
• 2 requirements that are normally worth 5 but carry a documented partial-credit exception (below)
• 1 requirement that carries no point value at all (also below)

That's 42 + 14 + 51 + 2 + 1 = 110 requirements accounted for, and 42×5 + 2×5 + 14×3 + 51×1 = 313 deductible points - which is where 110 − 313 = -203 comes from. This is worth stating explicitly because a wrong table can look completely plausible: a table this project shipped until it was corrected in September tallied 37 five-point / 17 three-point / 56 one-point requirements - 292 deductible points, floor -182 - and passed every test that only checked "does this run," because a test that pins the wrong numbers proves nothing about whether they're the right numbers. A contractor running an assessment through a calculator built on the wrong split could land tens of points away from what DoD's own methodology produces, in either direction.

The two exceptions that aren't in the round numbers

Two requirements get partial credit instead of the full deduction when a specific condition holds, at Math.ceil(weight / 2) - three points instead of five:

• 3.5.3 (multifactor authentication): deducts 3 instead of 5 when MFA is implemented for remote and privileged access but not for general, non-privileged local access.
• 3.13.11 (cryptographic protection): deducts 3 instead of 5 when cryptography protects CUI but the cryptographic module isn't FIPS-validated.

Both are common half-finished states, not edge cases - an organization that rolled out MFA for VPN and admin accounts but hasn't reached every workstation, or one running strong encryption through a library that was never FIPS-validated, is exactly who these two lines exist for. Getting credit for the partial state instead of eating the full 5-point deduction requires knowing the exception exists in the first place.

The one requirement that isn't a point value at all

3.12.4 - the system security plan - carries no weight in Annex A because it isn't scored like the other 109. If there's no system security plan, the assessment methodology says the assessment cannot be completed, and no score may be reported to SPRS at all. It doesn't cost points; it stops the whole exercise. If you're missing an SSP, that's not a line item to schedule for later in the POA&M - it's the thing that has to exist before any other number here means anything.

What this is actually useful for

Knowing the real weight split changes how you'd triage a gap list. Fifty-one of the 110 requirements are worth exactly 1 point if you haven't implemented them - useful to close, but individually they don't move the number much. Forty-two are worth 5, and those are where an unfinished assessment actually goes negative fast. A remediation plan built without knowing which column a gap falls in is optimizing against the wrong ledger.

The free calculator at /tools/sprs-calculator runs this exact function against all 110 practices, client-side, with nothing sent anywhere - it's the same arithmetic the product runs for a tenant's live self-assessment, not a simplified public version of it. The persona page for defense contractors, /for/defense-contractors, walks through the practice-by-practice CMMC level view, the evidence the score is computed from, and the self-assessment and POA&M export - the parts of this that come after you know what the number actually is.

Whatever the CMMC Reform Task Force eventually reports, the arithmetic behind a self-assessment score won't change with it; only the certification tranche around it might. Getting the 313 points right is work you can do today, independent of what DoD decides about Phase 2.