Check your SPRS score against the controls that move it most
SPRS, the Supplier Performance Risk System, is where your NIST SP 800-171 self-assessment score and your CMMC Status are recorded (32 CFR 170.4 and 170.16). A score submitted once does not update itself. A quick way to test whether yours still holds up is to recompute it against the controls that carry the most weight.
How the SPRS score works
The NIST 800-171 score starts at 110 and subtracts points for every control you do not meet, weighted 5, 3, or 1 (CMMC Scoring Methodology, 32 CFR 170.24(c)(2)). Miss enough high-weight controls and the number goes negative; subtracting every weight in that list gives a floor of -203. That is why two contractors with the same number of open gaps can have very different scores: it depends entirely on which controls are open.
Why the number on file may be wrong
A self-attested SPRS score is a snapshot of a single moment. It does not update when a configuration drifts, when the person who set up MFA leaves, or when a new cloud tool quietly enters scope. The gap between the score on file and the score an assessor would compute today is what matters, and it surfaces when a prime or contracting officer asks for current evidence.
Check yours in 10 questions
The gap check asks 10 questions about controls that move the score most and returns your likely exposure instantly. It is a directional self-assessment, not an official SPRS score, and it is clearly labeled as such. A full 110-control score also deducts for every other control that is not met, so it can land lower than this read.
Check your SPRS score free
The free gap check gives you a directional read from 10 questions. The $999 CMMC Level 2 Readiness Snapshot maps your connected-cloud findings and intake answers against the 110-control baseline and returns a directional estimate from your read-only cloud evidence, naming the resource behind every finding, PDF in minutes. Your framework target is your choice: NIST SP 800-171 Rev. 2 (110 requirements, 320 assessment objectives; required and scored) by default, or NIST SP 800-171 Rev. 3 (97 requirements, 422 assessment objectives; emerging, no DoD score exists), selected at intake or from your workspace. CMMC Level 2 is bound to NIST SP 800-171 Rev. 2 today: 32 CFR 170.14(c)(3) states that the CMMC Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2.
Common questions
What is a good SPRS score?
The maximum is 110, which means every control is met. The floor is -203. For a Level 2 C3PAO assessment the bar is meeting the controls themselves, so the practical goal is a score at or near 110 backed by evidence, not just a number on file.
Can my SPRS score be negative?
Yes. The score starts at 110 and subtracts 5, 3, or 1 points per unmet control, down to a floor of -203. Environments that have never been hardened against NIST 800-171 can compute lower once measured.
Is this check an official SPRS score?
No. The free gap check is a directional self-assessment built from your own answers, clearly labeled as such. Your official score is the one you submit to the DoD's Supplier Performance Risk System. The gap check gives you a directional read on whether that number would hold up under measurement.
Enclave AI™ is AI-native Agent-as-a-Service (AaaS) for CMMC Level 1 and Level 2 readiness and compliance operations. We are not a C3PAO and we will not seek C3PAO authorization, that separation is permanent. The free gap check is a directional self-assessment and is not an official SPRS score, not a C3PAO pre-assessment, and not a measurement of your systems. Patent Pending. ElasticD3M, LLC, Texas.