Upload your NIST SP 800-171 Rev 2 control statuses and see your Supplier Performance Risk System score, gaps, and CMMC Level 2 eligibility — instantly, privately, free.
Upload your control status CSV and see your SPRS score instantly — 100% private, calculated in your browser.
Drop your CSV here or click to upload
Columns: control_id, status
Status values: met / not_met / partial / not_applicable
The Supplier Performance Risk System (SPRS) score is the numerical output of a NIST SP 800-171 self-assessment. DoD contractors must submit their score to the SPRS portal at sprs.apps.mil before bidding on contracts that involve Controlled Unclassified Information (CUI). A score of 110 means all controls are met. Each unimplemented control reduces the score by its DoD-assigned weight (1, 3, or 5 points).
+110
Maximum score
All 110 NIST SP 800-171 Rev 2 controls fully implemented.
88
Conditional cert floor
Minimum score for CMMC Level 2 conditional certification (with POA&M for eligible controls).
−203
Minimum score
Every control with maximum weight is unimplemented. Most contractors score well above this.
Prepare your CSV
Create a two-column CSV with your NIST SP 800-171 Rev 2 control IDs and implementation status. Use our sample to get started.
Upload or paste
Drop the file, click to upload, or paste directly. The calculator accepts met, not_met, partial, and not_applicable.
See your score instantly
Your SPRS score, gap list, family-by-family breakdown, and conditional eligibility are calculated entirely in your browser.
Aegis Firma turns this one-time calculation into a live compliance programme. Track control status, generate your System Security Plan, manage POA&Ms, and prepare for your CMMC Level 2 assessment — all in one place.
Does anything get uploaded?
No. All calculation happens client-side in JavaScript. Your control statuses never leave your device.
Which version of NIST SP 800-171 does this use?
Rev 2. DoD Class Deviation 2024-O0013 locked CMMC 2.0 assessments to Rev 2 — Rev 3 is not yet applicable to DFARS 7012 obligations.
What is a "conditional certification" score?
Under 32 CFR Part 170, contractors who score ≥ 88 and have a POA&M for their gaps (excluding prohibited controls) may receive a conditional CMMC Level 2 certification for up to 180 days while they remediate.
Which controls cannot be in a POA&M?
3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5, and 3.12.4. These must be fully met before certification.
What does Aegis Firma do beyond this calculator?
Aegis Firma is a full CMMC/EU AI Act compliance platform. It tracks your SPRS over time, generates your System Security Plan, manages POA&Ms, handles DPIA workflows, and prepares your organisation for assessments.