What Is a Passing Score for CMMC Level 2 and the SPRS?

A passing score for CMMC Level 2 is 110 of 110 for Final status and 88 of 110 for Conditional status. The Supplier Performance Risk System (SPRS) score starts at 110. Each requirement not met subtracts 1, 3 or 5 points. Conditional status also caps the open items and sets a 180-day deadline to close them. Both numbers come from the DoD rule at 32 CFR Part 170.

Key Takeaways

• Final Level 2 status needs all 110 requirements scored MET, which equals a score of 110.
• Conditional Level 2 status needs a score of at least 88, which is 80 percent of 110.
• Each requirement is worth 1, 3 or 5 points, and the rule lists 42 five-point and 14 three-point requirements.
• A Plan of Action and Milestones (POA&M) can hold only 1-point items, and six requirements are barred from it.
• Open items must close within 180 days of the Conditional CMMC Status Date.

What Is a Passing Score for CMMC Level 2?

A passing score for CMMC Level 2 is 110 of 110 for Final status, or 88 of 110 for Conditional status. The Department of Defense (DoD) sets both numbers in 32 CFR 170.24 and 32 CFR 170.21. Conditional status also requires a POA&M that meets strict limits.

Contractors that handle Controlled Unclassified Information (CUI) post this score as part of defense contract compliance under their DoD agreements. Final status requires every Level 2 security requirement to be scored MET. Conditional status is the only route that allows open items.

Both numbers come from one scoring system. Knowing what is a passing score for CMMC Level 2 starts with how the SPRS score works.

How Does the SPRS Score Work?

The SPRS score works by starting at 110 and subtracting a weighted point value for each requirement scored NOT MET. The 110 maximum equals the total number of CMMC Level 2 requirements, according to 32 CFR 170.24. A score of 110 means every requirement is fully implemented.

The 110 requirements come from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2. NIST groups them into 14 families. The CMMC rule at 32 CFR 170.14 makes Level 2 requirements identical to Revision 2.

The score can fall below zero, because 32 CFR 170.24 states that subtracting values may produce a negative result. Contractors post the result in SPRS, the DoD system for supplier performance data. The size of the range is the next question.

What Is the Range of an SPRS Score?

The SPRS score ranges from a high of 110 down to a reported low of -203. PreVeil and ComplianceForge both publish that floor. The rule text states only that the result may be negative.

The -203 floor equals 110 minus every possible deduction added together. A negative score therefore signals open gaps in the heaviest-weighted requirements. Those weights are the next piece of the scoring math.

How Many Points Is Each CMMC Level 2 Requirement Worth?

Each CMMC Level 2 requirement is worth 1, 3 or 5 points. The weight tracks the damage an open gap could cause. The rule at 32 CFR 170.24 lists 42 requirements at five points, made up of 23 basic and 19 derived requirements. It lists 14 at three points, made up of 7 basic and 7 derived.

All other derived requirements carry one point each. NIST labels requirements basic or derived, and the DoD weight follows the effect of a failure. The table below shows the three tiers.

The table shows that 56 requirements carry the heavier 3-point and 5-point weights. The graphic below puts the same counts side by side.

With the weights in view, the calculation becomes a short, repeatable method.

How Is the SPRS Score Calculated?

Calculate the SPRS score by assessing each requirement and subtracting the point value of every requirement scored NOT MET from 110. The self-assessment follows NIST SP 800-171A (June 2018), according to 32 CFR 170.16. The steps run in this order.

1. Assess every requirement against its objectives in NIST SP 800-171A, using evidence in final form.
2. Score a requirement NOT MET when one or more applicable objectives are not satisfied.
3. Subtract 5, 3 or 1 point for each NOT MET requirement from 110.
4. Adjust the two partial-credit requirements, MFA and FIPS-validated encryption.
5. Record the score, the status date and any POA&M in SPRS.

A short worked example shows the math. Consider a contractor with ten open one-point items. Its MFA covers only remote and privileged users, and its encryption is not FIPS-validated. The loss is 10 + 3 + 3 = 16 points, so the score is 94. A structured gap assessment finds those open items before the score is posted.

Partial credit applies to only two requirements, which the next section covers.

Do MFA and Encryption Get Partial Credit?

Yes, multi-factor authentication (MFA) and FIPS-validated encryption are the two requirements where partial implementation lowers the penalty. The rule at 32 CFR 170.24 subtracts 3 points instead of 5 when MFA covers only remote and privileged users. MFA for no users costs 5 points.

Encryption follows the same pattern. Encryption that is employed but not FIPS-validated costs 3 points under requirement SC.L2-3.13.11. No encryption costs 5 points. FIPS stands for Federal Information Processing Standards.

A rollout of multifactor authentication to all users removes the MFA deduction in full. The scoring math also depends on a document, which is the SSP.

Why Does the System Security Plan Come Before the Score?

The System Security Plan (SSP) comes before the score because an assessment cannot be completed without a current SSP. The rule at 32 CFR 170.24 requires the SSP, requirement CA.L2-3.12.4, at the time of assessment. Its absence produces a finding that the assessment could not be completed.

The SSP describes each system in the assessment scope and how each requirement is met. The DoD Assessment Methodology, version 1.2.1 of June 24, 2020, applies the same logic. Scores rest on that description of the environment.

Because the SSP is a gate and not a point deduction, it also appears on the POA&M exclusion list covered below. First, the passing thresholds need a closer look.

What Score Do You Need to Pass CMMC?

The score you need to pass CMMC Level 2 is 110 for Final status and 88 for Conditional status. The 88 figure comes from 32 CFR 170.21, which requires the score divided by the total requirements to be at least 0.8. Eighty percent of 110 is 88, not 80.

A score of 88 allows a loss of no more than 22 points. Every lost point must trace to an item that the rule lets a POA&M carry. The table below maps the score bands to status.

The bands describe eligibility, and the weights decide which items may stay open. The graphic below shows the same ladder from 110 down to 88.

A CMMC contractor support program tracks these bands before any score reaches SPRS. A related benchmark question follows.

What Is a Good NIST 800-171 Score?

A good NIST 800-171 score is 110, because the DoD Assessment Methodology awards 110 when all security requirements are implemented. The CMMC rule sets 88 as the lowest NIST 800-171 score that reaches Conditional status. Any score below 88 sits outside both CMMC statuses.

DFARS 252.204-7019 requires a NIST SP 800-171 DoD Assessment no more than three years old. The summary score is posted in SPRS. The score is the same 110-point scale. Score and status are connected through the Conditional rules.

What Does CMMC Level 2 Conditional Status Mean?

CMMC Level 2 conditional status means the assessment found open requirements. The score and the POA&M meet every limit in 32 CFR 170.21. The rule sets three tests. The score must reach 88, every POA&M item must be worth one point, and no barred requirement may be open.

The one point-value exception is SC.L2-3.13.11. Encryption that is employed but not FIPS-validated is worth 3 points and may sit on a POA&M. No other item above one point may.

The earlier example shows why the tests matter. A score of 94 with MFA only for remote and privileged users has a 3-point MFA gap. That contractor cannot reach Conditional status. A contractor at 89 with only 1-point gaps can. The barred list is next.

Which Requirements Cannot Be on a POA&M?

Six Level 2 requirements cannot be on a POA&M, according to 32 CFR 170.21. Each must be fully implemented before Conditional status is possible. The list covers both technical and physical items.

• AC.L2-3.1.20, External Connections (CUI Data).
• AC.L2-3.1.22, Control Public Information (CUI Data).
• CA.L2-3.12.4, System Security Plan.
• PE.L2-3.10.3, Escort Visitors (CUI Data).
• PE.L2-3.10.4, Physical Access Logs (CUI Data).
• PE.L2-3.10.5, Manage Physical Access (CUI Data).

A POA&M does not replace a completed requirement, and an unimplemented requirement scores NOT MET whether or not a POA&M describes it. Review the POA&M rules before relying on this path. The deadline for those open items is fixed.

How Long Do You Have to Close a POA&M?

You have 180 days to close a POA&M, counted from the Conditional CMMC Status Date. A closeout assessment must confirm the closing within that window. The Conditional status expires when closeout does not finish in time.

The status date is the date results are submitted to SPRS or the CMMC instantiation of eMASS, per 32 CFR 170.4. After a successful closeout, the date stays the same. The status date therefore starts the clock for everything that follows.

For Level 2 (Self), the contractor performs the closeout self-assessment and posts results to SPRS. For Level 2 (C3PAO), a Certified Third-Party Assessment Organization (C3PAO) performs the closeout. DFARS 252.204-7021 treats Conditional status as valid for no more than 180 days. The graphic below shows the sequence.

A closed POA&M still needs a signature, which raises the question of who posts and affirms the score.

Who Posts the SPRS Score and How Often?

The contractor posts its own score for a Basic assessment, and DoD personnel post scores for Medium and High assessments. The DoD Assessment Methodology rates a Basic self-assessment as Low confidence. Medium and High assessments are performed by DoD personnel and carry higher confidence.

The table shows that the same 110-point scale carries different confidence by assessor. The methodology expects an assessment about once every three years. CMMC adds annual affirmations on top of that cycle.

Who Affirms the SPRS Score?

An Affirming Official affirms the score, and that person is the senior representative who has authority over CMMC compliance. 32 CFR 170.22 requires an affirmation after every assessment, including POA&M closeout, and annually afterward. Contractors complete the affirmation in SPRS.

The affirmation names the official and states that the organization has implemented and will maintain all applicable requirements in the assessment scope. The score and the SSP must therefore describe the same environment. Talk to your compliance advisor or attorney about what your affirmation covers.

Does CMMC Level 2 Require an Audit?

No, CMMC Level 2 does not always require an audit, because a Level 2 (Self) status uses a self-assessment. Level 2 (C3PAO) requires a certification assessment by a C3PAO. The contract states which one applies, according to 32 CFR 170.23.

A Level 2 (Self) contractor scores itself, posts results in SPRS and affirms. A Level 2 (C3PAO) assessment scores the same 110 requirements with the same point values. Review assessment day steps to see what assessors request. Current program status shapes which path contractors face.

Is CMMC Level 2 Still Required in November 2026?

Yes, Level 2 (Self) assessments and SPRS scores are still required as of November 2026, while Phase 2 is suspended. The Department of War (DoW) suspended the move to Phase 2 on July 13, 2026. Phase 2 would have made C3PAO certification a condition of award starting November 10, 2026.

Crowell and Moring reports that DoW said Phase 1 self-assessment requirements remain firmly in place. DoW continues to enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. DFARS 252.204-7012 stays in force.

Federal News Network reported a September task force summary. The summary says DoD could restart Phase 2 with a narrower population within 90 days. Sources reviewed through early November 2026 show no new start date. Track the Phase 2 timeline and confirm contract terms with your contracting officer. Scoring rules stay the same either way.

What Else Should You Know About CMMC Scoring?

Can You Self Assess CMMC Level 2?

Yes, a contractor can self assess CMMC Level 2 when the contract requires Level 2 (Self). The self-assessment uses the same 110-point scale and the same POA&M limits. Check the contract data types for CMMC level selection before scoring.

Is a Score of 80 Enough for CMMC Level 2?

No, a score of 80 falls below the 88 minimum for Conditional status. Eighty percent of 110 equals 88. A contractor at 80 has lost 30 points, which is 8 more than the 22-point limit.

Does CMMC Level 3 Use the Same Scoring?

No, Level 3 gives every requirement a value of one point. The maximum equals the number of Level 3 requirements, per 32 CFR 170.24. Level 3 still uses a 0.8 ratio for Conditional status.

How Long Does a CMMC Score Stay Valid?

A Final Level 2 status stays valid for three years under DFARS 252.204-7021, and a Conditional status for 180 days. The annual affirmation continues during that period. A CMMC preparation plan tracks these dates.

Frequently Asked Questions

What Is the Supplier Performance Risk System?

The Supplier Performance Risk System (SPRS) is the DoD system where contractors post assessment scores and affirmations. SPRS holds the level, status date, scope, CAGE codes, score and POA&M status. DoD contracting staff can view these records.

Can an SPRS Score Be Negative?

Yes, an SPRS score can be negative. The rule states that subtracting requirement values from 110 may produce a negative result. PreVeil reports a low of -203.

Does a POA&M Count as Meeting a Requirement?

No, a POA&M does not count as meeting a requirement. An unimplemented requirement scores NOT MET whether or not a POA&M describes it. The POA&M only supports Conditional status within the rule limits.

What Does MET Mean in a CMMC Assessment?

MET means all applicable objectives for a requirement are satisfied by evidence in final form. Drafts, working papers and unapproved policies do not count. One unsatisfied objective makes the requirement NOT MET.

Does Level 2 Scoring Use NIST SP 800-171 Revision 3?

No, Level 2 scoring uses Revision 2. The rule at 32 CFR 170.14 makes CMMC Level 2 requirements identical to NIST SP 800-171 Revision 2. NIST published Revision 3 in May 2024.

How Does Interweave Technologies Help Contractors Prepare for CMMC Level 2 Scoring?

Interweave Technologies helps contractors prepare for CMMC Level 2 scoring by mapping every requirement to its 5, 3 or 1 point value. We are not a C3PAO and do not issue certifications. We build the SSP and POA&M that support the score.

Contractors still asking what is a passing score for CMMC Level 2 can start with a cyber risk review. The review shows which gaps carry the highest point values. Gaps then close in weight order.

Each control needs an owner who checks it on a set schedule. Records then stay accurate for the annual affirmation. Contractors across North Alabama can work with Interweave Technologies to keep that routine running.

Routine monitoring covers patching, access reviews, logging and evidence collection. Each task produces records that support the SSP. Missing records weaken a score during review. A compliance managed service handles that work after the score is posted. Each assessment cycle starts with the SSP and ends with a posted score.

Gaps in MFA, encryption and physical access logs carry weights that change the score. Physical access logs also sit on the POA&M exclusion list, so they must be complete. Our contractor security program keeps the score and the evidence aligned. Call (256) 837-2300 to talk with a compliance specialist. Talk to your compliance advisor, attorney or assessor about your contract terms.