Projects / Live

NIST 800-171 SPRS score calculator

Mark each of the 110 NIST SP 800-171 Rev. 2 requirements and get your SPRS score, your remaining gaps ranked by points, and whether you qualify for a conditional CMMC Level 2 POA&M.

Want the story behind it? Read the case study.

Runs entirely in your browser

Your answers never leave this page. Progress is saved only in this browser. This is an estimate to plan remediation, not an official assessment, and it does not submit anything to SPRS.

Requirements

Every requirement starts as Not met. Choose N/A only where the methodology allows it (for example, no remote or wireless access). N/A requirements cost no points. No POA&M marks requirements that must be fully met for conditional status.

3.1.1Authorized access control5 pts

3.1.2Transaction and function control5 pts

3.1.3Control CUI flow1 pt

3.1.4Separation of duties1 pt

3.1.5Least privilege3 pts

3.1.6Non-privileged account use1 pt

3.1.7Privileged functions1 pt

3.1.8Unsuccessful logon attempts1 pt

3.1.9Privacy and security notices1 pt

3.1.10Session lock1 pt

3.1.11Session termination1 pt

3.1.12Control remote access5 pts

3.1.13Remote access confidentiality5 pts

3.1.14Remote access routing1 pt

3.1.15Privileged remote access1 pt

3.1.16Wireless access authorization5 pts

3.1.17Wireless access protection5 pts

3.1.18Mobile device connection5 pts

3.1.19Encrypt CUI on mobile3 pts

3.1.20External connections1 ptNo POA&M

3.1.21Portable storage use1 pt

3.1.22Control public information1 ptNo POA&M

3.2.1Role-based risk awareness5 pts

3.2.2Role-based training5 pts

3.2.3Insider threat awareness1 pt

3.3.1System auditing5 pts

3.3.2User accountability3 pts

3.3.3Event review1 pt

3.3.4Audit failure alerting1 pt

3.3.5Audit correlation5 pts

3.3.6Reduction and reporting1 pt

3.3.7Authoritative time source1 pt

3.3.8Audit protection1 pt

3.3.9Audit management1 pt

3.4.1System baselining5 pts

3.4.2Security configuration enforcement5 pts

3.4.3System change management1 pt

3.4.4Security impact analysis1 pt

3.4.5Access restrictions for change5 pts

3.4.6Least functionality5 pts

3.4.7Nonessential functionality5 pts

3.4.8Application execution policy5 pts

3.4.9User-installed software1 pt

3.5.1Identification5 pts

3.5.2Authentication5 pts

3.5.3Multifactor authentication5 pts (3 partial)

3.5.4Replay-resistant authentication1 pt

3.5.5Identifier reuse1 pt

3.5.6Identifier handling1 pt

3.5.7Password complexity1 pt

3.5.8Password reuse1 pt

3.5.9Temporary passwords1 pt

3.5.10Cryptographically protected passwords5 pts

3.5.11Obscure feedback1 pt

3.6.1Incident handling5 pts

3.6.2Incident reporting5 pts

3.6.3Incident response testing1 pt

3.7.1Perform maintenance3 pts

3.7.2System maintenance control5 pts

3.7.3Equipment sanitization1 pt

3.7.4Media inspection3 pts

3.7.5Nonlocal maintenance5 pts

3.7.6Maintenance personnel1 pt

3.8.1Media protection3 pts

3.8.2Media access3 pts

3.8.3Media disposal5 pts

3.8.4Media markings1 pt

3.8.5Media accountability1 pt

3.8.6Portable storage encryption1 pt

3.8.7Removable media5 pts

3.8.8Shared media3 pts

3.8.9Protect backups1 pt

3.9.1Screen individuals3 pts

3.9.2Personnel actions5 pts

3.10.1Limit physical access5 pts

3.10.2Monitor facility5 pts

3.10.3Escort visitors1 ptNo POA&M

3.10.4Physical access logs1 ptNo POA&M

3.10.5Manage physical access1 ptNo POA&M

3.10.6Alternative work sites1 pt

3.11.1Risk assessments3 pts

3.11.2Vulnerability scan5 pts

3.11.3Vulnerability remediation1 pt

3.12.1Security control assessment5 pts

3.12.2Plan of action3 pts

3.12.3Security control monitoring5 pts

3.12.4System security planrequired, no pointsNo POA&M

3.13.1Boundary protection5 pts

3.13.2Security engineering5 pts

3.13.3Role separation1 pt

3.13.4Shared resource control1 pt

3.13.5Public-access system separation5 pts

3.13.6Network communication by exception5 pts

3.13.7Split tunneling1 pt

3.13.8Data in transit3 pts

3.13.9Connections termination1 pt

3.13.10Key management1 pt

3.13.11CUI encryption (FIPS-validated)5 pts (3 partial)

3.13.12Collaborative device control1 pt

3.13.13Mobile code1 pt

3.13.14Voice over Internet Protocol1 pt

3.13.15Communications authenticity5 pts

3.13.16Data at rest1 pt

3.14.1Flaw remediation5 pts

3.14.2Malicious code protection5 pts

3.14.3Security alerts and advisories5 pts

3.14.4Update malicious code protection5 pts

3.14.5System and file scanning3 pts

3.14.6Monitor communications for attacks5 pts

3.14.7Identify unauthorized use3 pts

Estimated SPRS score

-203

Range −203 to 110

No System Security Plan (3.12.4). You cannot complete an assessment without one. Start there.

0
Met: 0
Partial: 110
Not met: 0
N/A

Gaps by point value

3.1.1Authorized access controlNo POA&M−5
3.1.2Transaction and function controlNo POA&M−5
3.1.12Control remote accessNo POA&M−5
3.1.13Remote access confidentialityNo POA&M−5
3.1.16Wireless access authorizationNo POA&M−5
3.1.17Wireless access protectionNo POA&M−5
3.1.18Mobile device connectionNo POA&M−5
3.2.1Role-based risk awarenessNo POA&M−5
3.2.2Role-based trainingNo POA&M−5
3.3.1System auditingNo POA&M−5
3.3.5Audit correlationNo POA&M−5
3.4.1System baseliningNo POA&M−5
3.4.2Security configuration enforcementNo POA&M−5
3.4.5Access restrictions for changeNo POA&M−5
3.4.6Least functionalityNo POA&M−5
3.4.7Nonessential functionalityNo POA&M−5
3.4.8Application execution policyNo POA&M−5
3.5.1IdentificationNo POA&M−5
3.5.2AuthenticationNo POA&M−5
3.5.3Multifactor authenticationNo POA&M−5
3.5.10Cryptographically protected passwordsNo POA&M−5
3.6.1Incident handlingNo POA&M−5
3.6.2Incident reportingNo POA&M−5
3.7.2System maintenance controlNo POA&M−5
3.7.5Nonlocal maintenanceNo POA&M−5
3.8.3Media disposalNo POA&M−5
3.8.7Removable mediaNo POA&M−5
3.9.2Personnel actionsNo POA&M−5
3.10.1Limit physical accessNo POA&M−5
3.10.2Monitor facilityNo POA&M−5
3.11.2Vulnerability scanNo POA&M−5
3.12.1Security control assessmentNo POA&M−5
3.12.3Security control monitoringNo POA&M−5
3.13.1Boundary protectionNo POA&M−5
3.13.2Security engineeringNo POA&M−5
3.13.5Public-access system separationNo POA&M−5
3.13.6Network communication by exceptionNo POA&M−5
3.13.11CUI encryption (FIPS-validated)No POA&M−5
3.13.15Communications authenticityNo POA&M−5
3.14.1Flaw remediationNo POA&M−5
3.14.2Malicious code protectionNo POA&M−5
3.14.3Security alerts and advisoriesNo POA&M−5
3.14.4Update malicious code protectionNo POA&M−5
3.14.6Monitor communications for attacksNo POA&M−5
3.1.5Least privilegeNo POA&M−3
3.1.19Encrypt CUI on mobileNo POA&M−3
3.3.2User accountabilityNo POA&M−3
3.7.1Perform maintenanceNo POA&M−3
3.7.4Media inspectionNo POA&M−3
3.8.1Media protectionNo POA&M−3
3.8.2Media accessNo POA&M−3
3.8.8Shared mediaNo POA&M−3
3.9.1Screen individualsNo POA&M−3
3.11.1Risk assessmentsNo POA&M−3
3.12.2Plan of actionNo POA&M−3
3.13.8Data in transitNo POA&M−3
3.14.5System and file scanningNo POA&M−3
3.14.7Identify unauthorized useNo POA&M−3
3.1.3Control CUI flow−1
3.1.4Separation of duties−1
3.1.6Non-privileged account use−1
3.1.7Privileged functions−1
3.1.8Unsuccessful logon attempts−1
3.1.9Privacy and security notices−1
3.1.10Session lock−1
3.1.11Session termination−1
3.1.14Remote access routing−1
3.1.15Privileged remote access−1
3.1.20External connectionsNo POA&M−1
3.1.21Portable storage use−1
3.1.22Control public informationNo POA&M−1
3.2.3Insider threat awareness−1
3.3.3Event review−1
3.3.4Audit failure alerting−1
3.3.6Reduction and reporting−1
3.3.7Authoritative time source−1
3.3.8Audit protection−1
3.3.9Audit management−1
3.4.3System change management−1
3.4.4Security impact analysis−1
3.4.9User-installed software−1
3.5.4Replay-resistant authentication−1
3.5.5Identifier reuse−1
3.5.6Identifier handling−1
3.5.7Password complexity−1
3.5.8Password reuse−1
3.5.9Temporary passwords−1
3.5.11Obscure feedback−1
3.6.3Incident response testing−1
3.7.3Equipment sanitization−1
3.7.6Maintenance personnel−1
3.8.4Media markings−1
3.8.5Media accountability−1
3.8.6Portable storage encryption−1
3.8.9Protect backups−1
3.10.3Escort visitorsNo POA&M−1
3.10.4Physical access logsNo POA&M−1
3.10.5Manage physical accessNo POA&M−1
3.10.6Alternative work sites−1
3.11.3Vulnerability remediation−1
3.13.3Role separation−1
3.13.4Shared resource control−1
3.13.7Split tunneling−1
3.13.9Connections termination−1
3.13.10Key management−1
3.13.12Collaborative device control−1
3.13.13Mobile code−1
3.13.14Voice over Internet Protocol−1
3.13.16Data at rest−1
3.12.4System security planNo POA&Mreq.

Export your assessment

Download all 110 requirements with their status and points to use in your own spreadsheet. The file is created in your browser and goes nowhere else.

How the score is calculated. Point values come from Annex A of the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1. Start at 110 and subtract 5, 3 or 1 points for each requirement not met. 3.5.3 (MFA) and 3.13.11 (FIPS-validated cryptography) allow a 3-point partial deduction. 3.12.4 (SSP) carries no points, but without an SSP you cannot complete an assessment.

Conditional status check. 32 CFR 170.21 permits a Level 2 POA&M only when the score is at least 88 (0.8 of 110), every open item is worth 1 point (3.13.11 can stay open only at its 3-point partial value), and none of 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 or 3.10.5 is open. POA&M items must close within 180 days.

This is an estimate to plan remediation. It is not an official assessment, it does not submit anything to SPRS, and it is not legal advice. Your official score is the one you affirm in SPRS, backed by your SSP and evidence.