How the Scoring Works

You start at 110. Each of the 110 NIST SP 800-171 requirements is worth 1, 3, or 5 points depending on security impact. If a requirement is fully implemented, you keep its points. If it is not implemented, you lose those points. Partial implementation gets partial credit in a limited set of cases. The math can push you below zero, down to -203, if enough high-value controls are missing.

Why Deductions Are 1, 3, or 5

The values are not a continuous range. Controls with the largest security impact deduct 5 points (MFA for privileged accounts, FIPS-validated cryptography for CUI). Medium-impact controls deduct 3. Hygiene-level controls deduct 1. This means a single missing MFA implementation hits harder than several missing awareness training activities.

Confidence Levels

• Basic (Self): The contractor runs the assessment. This is the default under DFARS 252.204-7019.
• Medium (DIBCAC paper review): DIBCAC reviews your documentation and interviews staff. No on-site verification.
• High (DIBCAC on-site): DIBCAC visits and verifies implementation technically.

Submitting to SPRS

The score goes into SPRS with three fields: the numeric score (-203 to 110), the date of the assessment, and the target date for reaching 110 if you are not there yet. Scores expire after three years, so plan a reassessment cadence. Authorized company representatives access SPRS through PIEE (Procurement Integrated Enterprise Environment).

DoDAM vs CMMC

Both evaluate the same 110 NIST 800-171 practices. DoDAM produces a number. CMMC produces a pass/fail certification. You need DoDAM-compliant scores in SPRS under DFARS 252.204-7019 regardless of CMMC status. Once CMMC is fully rolled out, a new contract with 252.204-7021 will also require the certification.