Plain-English scoring guide · primary sources
What is a good SPRS score?
A “good” SPRS score depends on the goal. The maximum is 110. There is no minimum number to post and bid — the rules require a current, honest self-assessment, not a particular score. For a Conditional CMMC Level 2 you need at least 88 of 110 with only POA&M-eligible gaps left. For a clean Final certification, aim for 110.
What the numbers actually mean
The score starts at 110 and subtracts a weighted value for every unmet NIST SP 800-171 Rev 2 requirement — 44 worth 5 points, 14 worth 3, 51 worth 1 — for 313 deductible points across the 109 scored requirements, so scores run from 110 down to a floor of −203. There is no single “passing” line; the right target depends on what you are trying to do.
| Score | What it means | Detail |
|---|---|---|
| 110 | Perfect score | All 109 scored NIST SP 800-171 Rev 2 requirements implemented (plus a current SSP for the unscored 3.12.4). This is the target for a clean Final CMMC Level 2 with nothing left on a POA&M. |
| 88–109 | Conditional-eligible (if the gaps qualify) | A score of at least 88 of 110 can earn a Conditional Level 2 at a C3PAO assessment — but only if every open gap is POA&M-eligible (generally 1-point items; 3.13.11 only in its 3-point partial case). All POA&M items must close within 180 days (32 CFR 170.21). |
| Below 88 | Not certifiable on the conditional path | Below 88, or with any never-eligible gap open (3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5), you cannot earn even a Conditional Level 2 — you remediate and re-assess. The number can legitimately be low; the score floor is −203. |
Sources: DoD Assessment Methodology v1.2.1 and 32 CFR 170.24 (scoring, 5/3/1-point deductions, the −203 floor); 32 CFR 170.21 (the 88-point conditional threshold, POA&M eligibility, 180-day closeout). See the scoring methodology for how each point is set.
There is no minimum score to post and bid
This is the part most contractors get wrong. Under the rule as written, what you need to be eligible is a current self-assessment posted to SPRS — not a particular number. DFARS 252.204-7019/7020 require a current assessment, and a prime (per 252.204-7020) must confirm its subcontractors have one, but neither sets a passing threshold to submit. A low score posted honestly, with a credible plan to reach 110, is compliant. An inflated score is not.
That said, the number is visible to the people deciding awards. Contracting officers and primes can see the score you post, so even though it is not a formal gate today, it shapes how competitive you look. Since Phase 1 has been live since November 10, 2025, new DoD solicitations can already require that posted score — and Phase 2 begins November 10, 2026, when a C3PAO-assessed Level 2 becomes the default for contracts involving CUI. The honest number you post now is both a bidding credential and a head start on the third-party assessment.
88 is the number that matters for certification
For certification, the line is sharp. A Conditional Level 2 at a C3PAO assessment requires a score of at least 88 of 110 with every open gap POA&M-eligible — generally only 1-point items, plus 3.13.11 in its 3-point partial case (32 CFR 170.21). But 88 is the edge of the cliff, not a comfortable target:
- •The six never-eligible requirements break the math. If 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, or 3.10.5 is open, no conditional is possible — regardless of your total.
- •The SSP is a hard gate before any of this. Requirement 3.12.4 is unscored, but without a current System Security Plan, no assessment can be completed at all (32 CFR 170.24).
- •The 180-day clock is real. Everything left on the POA&M at a conditional must close within 180 days of the conditional status date, or the status lapses.
So the practical answer to “what’s a good score?” is: high enough that the gaps you carry are all small, deferrable, and closeable inside six months — and ideally, 110 with nothing deferred at all.
Straight answers
Is there a minimum SPRS score to bid on DoD contracts?
Under the rule as written, what you need to bid is a current self-assessment posted to SPRS — not a particular number. DFARS 252.204-7019/7020 obligate a current assessment (and primes must confirm subs have one), but they do not set a passing threshold to submit. A low, honest score with a credible plan to 110 is compliant; an inflated score is not. Contracting officers and primes can see the number you post, so it shapes how competitive you look even when it is not a formal gate.
What score do I need for CMMC Level 2 certification?
For a Conditional Level 2 at a C3PAO assessment you need at least 88 of 110, with every remaining gap POA&M-eligible — generally only 1-point items, plus 3.13.11 in its 3-point partial case (32 CFR 170.21). Six requirements are never POA&M-eligible (3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5), so an open gap on any of them blocks the conditional path regardless of your total. For a Final Level 2 you close every POA&M item within 180 days and reach 110.
Is 88 a "good" SPRS score?
88 is the floor for a Conditional Level 2, not a comfortable target. It means you are carrying up to 22 points of deductions, all of which must be POA&M-eligible and all of which must close within 180 days of the conditional date. If even one of those gaps is a 3-point or 5-point item, or one of the six never-eligible requirements, 88 does not get you a conditional. Treat 88 as the edge of the cliff, not the destination — aim for 110.
Can a negative SPRS score be accurate?
Yes. The score starts at 110 and deducts the weighted value of every unmet requirement — 44 worth 5 points, 14 worth 3, 51 worth 1 — across 313 deductible points, so a contractor early in its NIST SP 800-171 work can legitimately land well below zero, down to a floor of −203. A negative score is not a failure of honesty; it is an accurate picture of work still to do. Posting it honestly is the compliant move.
Should I round my score up to look more competitive?
No. A SPRS score is a representation to the government, and an inaccurate one is False Claims Act exposure — DOJ recorded $6.8 billion in FCA recoveries in FY2025, with cyber-specific settlements exceeding $52 million, the majority DoD-related. Every annual affirmation is a fresh liability event. The conservative, defensible move is to post the score your assessment actually supports and carry a POA&M for the rest. Score down when in doubt.
Scoring figures here cite the DoD Assessment Methodology v1.2.1 and 32 CFR part 170, re-verified June 2026. This is compliance information, not legal advice. A self-assessed SPRS score is a representation to the government — Muster helps you compute and document an honest one; it does not attest to your implementation. For False Claims Act or contract-eligibility questions, consult qualified counsel.
Related guides
CMMC for small business (the no-$100K path)
The self-serve readiness path for small contractors: do the gap assessment, SSP, and POA&M yourself for a fraction of the $14K–40K consultant bill — with the separate, unavoidable C3PAO fee broken out honestly.
Do you need GCC High for CMMC?
The honest scoping answer: the rule requires a FedRAMP-Moderate-equivalent cloud for CUI, never GCC High by name. When export-controlled (ITAR/EAR) data makes GCC High the answer, when it doesn’t, and how a CUI enclave cuts the bill.
NIST 800-171 SSP template
What an SSP must contain per 3.12.4, what assessors flag first, and a free blank template (Markdown or Word) — no email gate.
POA&M template (NIST 800-171)
The 32 CFR 170.21 eligibility rules — 88-point minimum, the never-eligible six, the 180-day clock — plus a worked example and a free blank template.
Tools: SPRS score calculator · scoring methodology · CMMC Phase 2 deadline
Stop guessing your number.
The free Muster Score computes your exact SPRS number with the DoD methodology and shows which gaps are POA&M-eligible and which must be fixed to clear 88 — and then 110.
Get your free Muster ScoreThe free score is live now. Join the waitlist for early access to the done-for-you Level 2 Readiness Sprint and founding-cohort pricing.