--- title: SPRS (NIST 800-171) Scoring description: Learn how NIST SP 800-171 assessments are scored in FutureFeed, including point deductions, required controls, and POA&M impact on your SPRS score. --- [Skip to content](https://support.futurefeed.co/knowledge-base/hc/en-us/articles/360059232032-sprs-nist-800-171-scoring#main-content) [![FutureFeed-White-Green-SupportCenter](https://support.futurefeed.co/hs-fs/hubfs/FutureFeed-White-Green-SupportCenter.png?width=400&height=99&name=FutureFeed-White-Green-SupportCenter.png)](https://support.futurefeed.co/?hsLang=en) - [HawkAI™ Support Home](https://support.futurefeed.co/) - [Knowledge Base](https://support.futurefeed.co/knowledge-base) - [Submit Ticket](https://support.futurefeed.co/support-forms) - [My Tickets](https://support.futurefeed.co/support?status=all&view=my_tickets&offset=0) Open main navigation Close main navigation - [HawkAI™ Support Home](https://support.futurefeed.co/) - [Knowledge Base](https://support.futurefeed.co/knowledge-base) - [Submit Ticket](https://support.futurefeed.co/support-forms) - [My Tickets](https://support.futurefeed.co/support?status=all&view=my_tickets&offset=0) FutureFeed's Knowledge Base - There are no suggestions because the search field is empty. 1. [FutureFeed Support](https://support.futurefeed.co/knowledge-base?hsLang=en) 2. [Getting started](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en) 3. [Compliance Standards - Background Information](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#compliance-standards-background-information) # SPRS (NIST 800-171) Scoring **Interface Update Notice:** The visuals in this article predate our Q2 2025 *Chocolate Release*. The process remains identical, and updated visuals are forthcoming. The calculation of the NIST 800-171 SPRS Score in FutureFeed is based on the guidance provided in the [NIST SP 800-171 DoD Assessment Methodology, Version 1.2.](https://www.acq.osd.mil/dpap/pdi/cyber/docs/NIST%20SP%20800-171%20Assessment%20Methodology%20Version%201.2%20%206.24.2020.pdf)  The system is complex and weights each control at 1, 3 or 5 points. ![mceclip0-Jul-21-2025-06-02-50-2839-PM](https://support.futurefeed.co/hs-fs/hubfs/mceclip0-Jul-21-2025-06-02-50-2839-PM.png?width=129&height=73&name=mceclip0-Jul-21-2025-06-02-50-2839-PM.png) Scoring is weighted based on the impact on the security of the network and its data, so some requirements have more precedence over others when those requirements are not yet implemented.   Assessments are scored to reflect the net effect of security requirements not yet implemented. You start with a perfect score of 110. For each security requirement not met, the weighted value over the control is subtracted from your organization's score.  If all security requirements are added, a contractor is awarded a score of 110, consistent with the total number of NIST SP 800-171 security requirements.  The lowest possible score is -203. While CMMC requires that all controls be satisfied, the SPRS system allows for POA&M actions, but does require the submission of the projected delivery date for plan completion.  FutureFeed builds both the SSP and the POA&M automatically as the assessment is completed.     ### More Details #### 0-Point REQUIRED Control The contractor must have a system security plan (Basic Security Requirement 3.12.4) in place to describe each covered contractor information system, and a plan of action (Basic Security Requirement 3.12.2) in place for each unimplemented security requirement to describe how and when the security requirement will be met.  Since the NIST SP 800-171 DoD Assessment scoring methodology is based on the review of a system security plan describing how the security requirements are met, it is not possible to conduct the assessment if the information is not available. The absence of a system security plan would result in a finding that ‘an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012.   #### 5 Point Controls Basic Security Requirements with a value of 5 points include 3.1.1, 3.1.2, 3.2.1, 3.2.2, 3.3.1, 3.4.1, 3.4.2, 3.5.1, 3.5.2, 3.6.1, 3.6.2, 3.7.2, 3.8.3, 3.9.2, 3.10.1, 3.10.2, 3.12.1, 3.12.3, 3.13.1, 3.13.2, 3.14.1, 3.14.2, and 3.14.3. Derived Security Requirements with a value of 5 points include 3.1.12, 3.1.13, 3.1.16, 3.1.17, 3.1.18, 3.3.5, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.5.10, 3.7.5, 3.8.7, 3.11.2, 3.13.5, 3.13.6, 3.13.15, 3.14.4, and 3.14.6. #### 3 Point Controls Basic Security Requirements with a value of 3 points include 3.3.2, 3.7.1, 3.8.1, 3.8.2, 3.9.1, 3.11.1, and 3.12.2. Derived Security Requirements with a value of 3 points include 3.1.5, 3.1.19, 3.7.4, 3.8.8, 3.13.8, 3.14.5, and 3.14.7.   #### 1-Point Controls All remaining Derived Security Requirements, if not implemented, have a limited or indirect effect on the security of the network and its data.   #### Partial Credit - Two Special Controls Multi-factor authentication (MFA) (Security Requirement 3.5.3) is typically implemented first for remote and privileged users (since these users are both limited in number and more critical) and then for the general user, so 3 points are subtracted from the score of 110 if MFA is implemented only for remote and privileged users; 5 points are subtracted from the score of 110 if MFA is not implemented for any users. FIPS validated encryption (Security Requirement 3.13.11) is required to protect the confidentiality of CUI. If encryption is employed, but is not FIPS validated, 3 points are subtracted from the score of 110; if encryption is not employed, 5 points are subtracted from the score of 110.           - [CMMC Program - Regulation Guidance](https://support.futurefeed.co/knowledge-base/cmmc-program-regulation-guidance?hsLang=en#main-content) - [CMMC Program](https://support.futurefeed.co/knowledge-base/cmmc-program-regulation-guidance?hsLang=en#cmmc-program) - [Product Information](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#main-content) - [Basic Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#basic-pricing) - [Advanced and Volume Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#advanced-and-volume-pricing) - [Features](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#features) - [Additional Details](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#additional-details) - [CMMC Express Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#cmmc-express-pricing) - [How-to's](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#main-content) - [How-to... Build and Manage Projects in "Your FutureFeed"](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-build-and-manage-projects-in-your-futurefeed) - [How-to... Deliverables](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-deliverables) - [Other Features](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#other-features) - [How-to... Manage Tools, Services, and Documentation](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-tools-services-and-documentation) - [How To... Onboarding Rocket](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-onboarding-rocket) - [How-to... Big Picture](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-big-picture) - [How to... Work in the Assess Subway Stop](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-work-in-the-assess-subway-stop) - [How-to.... Manage People and Users](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-people-and-users) - [How To... Complete the SSP](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-complete-the-ssp) - [How to ... Manage a Marketplace Listing](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-a-marketplace-listing) - [How To.... Recurring Tasks](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-recurring-tasks) - [Terminology](https://support.futurefeed.co/knowledge-base/terminology?hsLang=en#main-content) - [Glossary](https://support.futurefeed.co/knowledge-base/terminology?hsLang=en#glossary) - [Getting started](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#main-content) - [Navigation](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#navigation) - [Subscription Management](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#subscription-management) - [Platform Access](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#platform-access) - [Compliance Standards - Background Information](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#compliance-standards-background-information) - [Manage Compliantly](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#main-content) - [Technology Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#technology-subway-stop) - [Company Profile](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#company-profile) - [Deliverables Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#deliverables-subway-stop) - [Your FutureFeed Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#your-futurefeed-subway-stop) - [SSP Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#ssp-subway-stop) - [Webinars and Features](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#main-content) - [NIST SP 800-171 R3](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#nist-sp-800-171-r3) - [2023 User Webinars](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#2023-user-webinars) - [Features](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#features) - [CMMC Program](https://support.futurefeed.co/knowledge-base/cmmc-program?hsLang=en#main-content) - [CMMC Program - Regulation Guidance](https://support.futurefeed.co/knowledge-base/cmmc-program?hsLang=en#cmmc-program-regulation-guidance) - [FutureFeed Support](https://support.futurefeed.co/knowledge-base/futurefeed-support?hsLang=en#main-content) - [Product Information](https://support.futurefeed.co/knowledge-base/futurefeed-support?hsLang=en#product-information) - [Frameworks](https://support.futurefeed.co/knowledge-base/frameworks?hsLang=en) - [Tools and Services](https://support.futurefeed.co/knowledge-base/tools-and-services?hsLang=en) - [Hawk AI](https://support.futurefeed.co/knowledge-base/hawk-ai?hsLang=en) - [CMMC Fundamentals](https://support.futurefeed.co/knowledge-base/cmmc-fundamentals?hsLang=en#main-content) - [SPRS & Compliance Reporting](https://support.futurefeed.co/knowledge-base/cmmc-fundamentals?hsLang=en#sprs-compliance-reporting) [![FutureFeed-White-Green-SupportCenter](https://support.futurefeed.co/hs-fs/hubfs/FutureFeed-White-Green-SupportCenter.png?width=300&height=74&name=FutureFeed-White-Green-SupportCenter.png "FutureFeed-White-Green-SupportCenter")](https://support.futurefeed.co/?hsLang=en) FutureFeed Footer – Newest ## Footer [1-844-725-8252](tel:14105605602) [support@futurefeed.co](mailto:support@futurefeed.co) - [Facebook](http://facebook.com/FutureFeedCompliance/) - [X (Twitter)](https://x.com/futurefeedco/) - [LinkedIn](https://www.linkedin.com/company/futurefeed/) Attain. Maintain. Prove It Anytime. ### Resources - [15-Min with FutureFeed](https://zoom.us/meeting/register/WKkYTumjR6OOUjNRwZi91A#/registration) - [User - Schedule a Training](https://futurefeed.co/schedule-training/) - [Partner - Schedule a Training](https://futurefeed.co/schedule-training/) - [Download the Everything Book](https://futurefeed.co/cmmc_guide/) ### Legal - [Terms of service](https://futurefeed.co/terms/) - [Privacy policy](https://futurefeed.co/privacy/) - [Security](https://futurefeed.co/security/) - [Legal](https://futurefeed.co/legal/) © FutureFeed.co. All rights reserved. Disclaimer: The appearance of U.S. Department of Defense (DoD) visual information does not imply or constitute DoD endorsement.