Once you run a self-assessment, you get a single number — your SPRS score — and the obvious next question is "is that good?" The honest answer surprises people: there's really only one fully compliant score, and it's 110. But the range, the thresholds, and the math are worth understanding so you know how far you have to go and where to spend your effort.
The short answer
SPRS scores run from −203 to +110. A perfect, fully compliant score is 110 — every one of the 110 NIST SP 800-171 controls implemented. Higher is always better, but for CMMC Level 2 the destination is 110; any number below it represents open requirements you'll need to close or carefully place on a POA&M.
Why the range is −203 to 110
The math is subtractive. You start at 110 (all controls met) and subtract the point value of each unmet control. Controls are weighted 1, 3, or 5 points based on how much they reduce risk. Because the weighted deductions across all 110 controls total 313, the lowest possible score is 110 − 313 = −203.
| Score | What it means |
|---|---|
| 110 | Fully compliant — every control implemented. The goal. |
| 88–109 | Most controls met; remaining gaps may qualify for a conditional path under POA&M rules. |
| Below 88 | Significant gaps; generally below the conditional threshold — real remediation needed. |
| Negative | Many high-weight controls unmet. A starting point, not a stopping point. |
See how the scoring math works for the full point-weight breakdown.
Is there a "passing" number?
There's no universal contract cutoff, but the CMMC POA&M rules effectively set a floor. To earn a conditional Level 2 status, you generally must:
- Meet at least 88 of the 110 controls (about 80%),
- Place only certain 1-point items on a POA&M — higher-weight controls and specific requirements cannot be deferred, and
- Close every POA&M item within 180 days to convert to a full certification.
In other words: 88 isn't a comfortable target — it's the edge of the cliff. The real goal is 110, with a short, rules-compliant POA&M only if you genuinely need it. (Details in what is a POA&M.)
How to raise your score fastest
Because controls are weighted, not all fixes are equal. A 5-point control moves your score five times as much as a 1-point one — so sequence your work by point value, not by control number.
- Fix 5-point controls first. The usual high-value gaps: multifactor authentication, FIPS-validated encryption, audit logging, and configuration baselines. See the 5-point controls to fix first.
- Scope tightly. Fewer systems in scope means fewer places a control has to be true — the highest-leverage move of all. See asset scoping.
- Keep it current. Your score is affirmed annually — a stale number carries real risk. See the annual affirmation.
See your number — and exactly what's costing you points
The free SPRS calculator scores you against all 110 controls and ranks your gaps by how many points each one is worth, so you fix the right things first. No signup.
Calculate your SPRS score free →Good SPRS score — frequently asked
What is a good SPRS score?
The only fully compliant score is 110 — all 110 controls met. The range is −203 to 110; below 110 means open requirements to close or carefully POA&M.
What does −203 to 110 mean?
You start at 110 and subtract 1, 3, or 5 points per unmet control. The weighted deductions total 313, so the minimum is 110 − 313 = −203. It's not a percentage.
Is there a minimum score to win work?
No universal cutoff, but the POA&M rules set a practical floor: roughly 88/110 for a conditional path, only 1-point items deferrable, closed within 180 days, with some controls not deferrable at all.
How do I raise it fastest?
Fix 5-point controls first and scope tightly — both move your score far more than chasing 1-point items. A free calculator shows which gaps cost the most.