CMMC level finder and SPRS score calculator

CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect Federal Contract Information and Controlled Unclassified Information. It is set out in 32 CFR Part 170, and the contract clauses that apply it are in the DFARS (48 CFR) rule that took effect on 10 November 2025. Level 1 covers FCI, Level 2 covers CUI with the 110 requirements of NIST SP 800-171, and Level 3 adds 24 selected requirements from NIST SP 800-172 (32 CFR 170.14 and 170.18).

The Supplier Performance Risk System (SPRS) holds the score you post from a NIST SP 800-171 self-assessment. You start at 110, one point per requirement, and subtract a weight of 5, 3 or 1 for each requirement not met, using the DoD Assessment Methodology. If every requirement fails the score is -203. In this tool, 42 requirements are worth 5 points, 14 are worth 3, 51 are worth 1, and two (3.5.3 multifactor authentication and 3.13.11 FIPS-validated cryptography) can lose 5 or 3 depending on how far you got. The system security plan requirement (3.12.4) carries no points, but without one no valid score exists.

The only threshold in the CMMC rule itself is for Conditional Level 2 status: at least 80 percent of the requirements, which is 88 of 110 points, with every open gap on a plan of action and milestones (POA&M) limited to 1-point items, plus the 3-point FIPS-validated cryptography exception. Six requirements may never be on a POA&M. A POA&M must be closed out within 180 days (32 CFR 170.21). A perfect score is 110.

Level 1 has 15 requirements from FAR 52.204-21 (17 entries in the 32 CFR 170.15 table) for Federal Contract Information, assessed by yearly self-assessment with an affirmation in SPRS and no POA&M allowed. Level 2 has the 110 requirements of NIST SP 800-171 Rev. 2 for CUI. Depending on the contract, Level 2 is a self-assessment or a third-party assessment by a C3PAO.

Phase 1 began on 10 November 2025. Phase 2 was scheduled for 10 November 2026, when Level 2 certification by a C3PAO would expand. A Department of War press release ("Forging the Arsenal of Freedom", dated 13 July 2026 per press coverage) says the Department suspended the transition to Phase II and pending and future CMMC milestones in solicitations and contracts, and set up a CMMC Reform Task Force with a 60-day review. Law-firm reports say no replacement date had been published as of late October 2026. We read the release text through a republished copy because the war.gov page blocked our fetch, so check war.gov and dodcio.defense.gov/cmmc before planning around any date.

No. CMMC assesses a contractor’s own environment that handles FCI or CUI. FedRAMP authorizes cloud services sold to federal agencies. They meet where a contractor uses a cloud service to store, process or transmit CUI: DFARS 252.204-7012 requires the contractor to ensure the provider meets security requirements equivalent to the FedRAMP Moderate baseline.

Use it to rehearse and find gaps. The point values were taken from 32 CFR 170.24, but the official posted score comes from your own assessment against NIST SP 800-171A objectives, signed off by an officer of the company. Requirement wording here is a short paraphrase.

No. The scoring runs in your browser and nothing is sent anywhere.