How it works:
- Every requirement starts as Not implemented, so your starting score is −203. Mark each one honestly — a requirement only counts if it is fully implemented and documented in your System Security Plan (SSP).
- Each requirement is weighted 1, 3, or 5 points based on its security impact. Unimplemented requirements subtract their weight from 110.
- Two requirements (3.5.3 MFA and 3.13.11 FIPS encryption) allow partial credit. Five remote-access/wireless/mobile requirements can be N/A if the capability doesn't exist in your environment.
- Your score and top gaps update live. Scroll to the bottom for your summary.
Your results
-203
Significant gaps
⚠ No System Security Plan (3.12.4): without an SSP, a Department of War assessment cannot be completed at all and you cannot legitimately submit a score to SPRS. Make this your first priority.
Highest-value gaps to fix first
You know your gaps — now write them up. The SSP Section Generator turns these requirements into assessor-ready System Security Plan language and draft POA&M entries.
Generate my SSP sections →Get your free gap report
Want this assessment as a prioritized remediation roadmap — what to fix first, roughly what it takes, and how it affects your score? Enter your email and we'll send your personalized gap report.
🔒 No spam — just your report.