Projects / Case study
NIST 800-171 SPRS Score Calculator
A free tool that turns a 110-requirement spreadsheet exercise into a five-minute self-check, without collecting any assessment data.
- Role
- Designer, developer, and compliance subject matter expert
- Stack
- HTML, CSS, vanilla JavaScript (no framework, no backend)
- Status
- Live
- Year
- 2026
- NIST 800-171
- CMMC
- SPRS
- DFARS
- Free Tool
The problem
The math is simple. The rules around it are not.
Every defense contractor that handles Controlled Unclassified Information must score itself against NIST SP 800-171 and post that score to the Supplier Performance Risk System (SPRS). The score starts at 110 and drops by 5, 3, or 1 points for each requirement not met, down to a floor of −203.
- Two requirements (MFA and FIPS-validated encryption) allow partial credit.
- The System Security Plan carries no points, yet without it the assessment cannot be completed.
- CMMC Level 2 conditional status requires a score of at least 88, and only 1-point requirements can sit on a POA&M. Six named requirements can never be deferred.
Small contractors usually work this out in a spreadsheet, or pay a consultant to do it. Most free calculators online stop at the number. They don't tell you which gaps block conditional status, and many ask for an email before they show you anything.
What I built
A single-page calculator
The page:
- Lists all 110 requirements by family, with the official point value next to each
- Updates the score live as you mark each requirement Met, Not met, N/A, or Partial
- Ranks the remaining gaps by points, so the highest-value fixes come first
- Checks conditional-status eligibility against 32 CFR 170.21 and explains why you pass or fail
- Splits a copyable gap report into "fix before assessment" and "POA&M candidates"
- Exports all 110 requirements with status, points, and POA&M eligibility as CSV or JSON for your own spreadsheet
Key decisions
Choices that shaped the build
Answers never leave the browser.
A contractor's list of unmet controls is a map of its weaknesses. The calculator runs entirely client-side and saves progress only in the visitor's own browser. The CSV and JSON exports are built in the browser and download straight to the visitor's device.
No gate in front of the result.
The score and report are free and immediate, with nothing to sign up for.
Every point value is traceable.
Weights come from Annex A of the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1. I validated the data set before release: 110 requirements, 44 worth 5 points, 14 worth 3, 51 worth 1, plus the unscored SSP, totaling 313 points of possible deductions.
No framework.
One HTML file with no dependencies loads fast, is easy to audit, and has nothing to patch.
Verification
Tested against known outcomes before launch
| Scenario | Expected | Result |
|---|---|---|
| All requirements not met | −203 | −203 |
| All requirements met | 110 | 110 |
| MFA for remote and privileged users only | 107 | 107 |
| 3.13.11 partial plus one 1-point gap | Conditional eligible | Eligible |
| Same, plus 3.10.3 open | Not eligible | Not eligible |
What I'd do next
Next steps
- Add NIST SP 800-171 Rev. 3 scoring once DoD publishes a methodology for it
- Add a printable report for SSP and POA&M working sessions
Sources
Where the rules come from
- NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 (June 24, 2020), Annex A
- 32 CFR 170.21, Plan of Action and Milestones requirements
- 32 CFR 170.24, CMMC Scoring Methodology
This calculator gives an estimate for planning. It is not an official assessment and does not submit anything to SPRS.