The DoD Basic Assessment starts every contractor at 110 and subtracts a weighted deduction for each of the 110 NIST SP 800-171 requirements that is not fully implemented — 42 cost 5 points, 14 cost 3, and 51 cost 1. 2 more (3.5.3 and 3.13.11) cost 5, or 3 when partly in place, and 1 (3.12.4, the system security plan) carries no point value at all. The deductions total 313, so the lowest score the methodology can produce is -203. Mark each one below and the score updates as you go.
This runs the same scoring function CMDash uses for a signed-in tenant’s real SPRS score — the values are transcribed from Annex A of the DoD NIST SP 800-171 Assessment Methodology v1.2.1 (June 2020), reconciled requirement by requirement, and anyone submitting a score to DoD should verify them against current DoD guidance. Nothing you mark here is sent anywhere unless you choose to send it.
Browse the 110 practicesCMMC Level 2 readiness checklist
Every practice starts unmarked and unmarked scores as not met, because SPRS subtracts from 110 — “not assessed” and “not in place” are the same number to DoD.
Estimated SPRS Basic Assessment score
-203 / 110
0 of 110 practices marked · 0 met · 110 not met · 0 N/A · −313 points deducted
Assessment could not be completed: The DoD Assessment Methodology does not score a system that has no system security plan. NIST SP 800-171 requirement 3.12.4 carries no point value in Annex A: if the SSP is absent, the assessment cannot be completed and no SPRS score may be reported to DoD. Document the system security plan and mark 3.12.4 implemented (or not applicable, with a rationale), then re-run the assessment.
Annex A allows half credit on two requirements — 3.5.3 (multifactor authentication covering remote and privileged but not general local access) and 3.13.11 (cryptography in use but not FIPS-validated). A met / not met / N.A. marking cannot express “partially”, so this calculator never applies it — a real assessment of those two may score up to 4 points higher than the number here.
Track these practices in CMDashSave this result as a PDF, and send us a copy so we can follow up with what to do about it. The PDF is drawn by your browser — nothing is emailed to you.
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.