Two scores that both land in SPRS.

The methodology described below is Version 1.2.1, June 24, 2020, which DFARS 252.204-7019 and 252.204-7020 name. DoD's September 2026 class deviation changes which clauses some contracts carry, as the section on the class deviation explains. ³

The DoD assessment methodology score

Version 1.2.1 awards 110 when every NIST SP 800-171 security requirement is implemented, matching the total number of those requirements. Each requirement not met subtracts its value from 110. The score can go negative. Requirements whose failure could lead to significant exploitation of the network, or exfiltration of DoD CUI, subtract 5. Requirements with a specific and confined effect subtract 3. The remaining derived requirements subtract 1. ³

Two requirements can be partial. If multifactor authentication (3.5.3) is implemented only for remote and privileged users, subtract 3. If it is not implemented for any users, subtract 5. If encryption is employed for 3.13.11 and it is not FIPS validated, subtract 3. If encryption is not employed, subtract 5. The methodology is not designed to credit other partial implementation. ³

There are three assessment levels, and the level is about confidence. A Basic assessment is the contractor's self-assessment, based on review of the system security plan, conducted in accordance with NIST SP 800-171A and section 5 and Annex A of the methodology. Basic results in a confidence level of Low because it is a self-generated score. A Medium assessment is conducted by trained DoD personnel and reviews the system security plan's description of how each requirement is met. Medium results in a confidence level of Medium. A High assessment is an on-site or virtual verification by trained DoD personnel using NIST SP 800-171A, and it results in a confidence level of High. The methodology says a virtual High assessment will not fully cover every NIST SP 800-171 requirement. ³

If there is no system security plan, the methodology says an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012. A plan of action for an unimplemented requirement is not a substitute. The requirement is assessed as not implemented. Temporary deficiencies that are addressed in plans of action with deficiency reviews, milestones, and progress are assessed as implemented. Isolated enduring exceptions, when described with mitigations in the system security plan, are assessed as implemented. ³

What 7019 and 7020 require in SPRS

DFARS 252.204-7019 (Nov 2023) says that, in order to be considered for award, an offeror required to implement NIST SP 800-171 shall have a current assessment for each covered contractor information system relevant to the offer, contract, task order, or delivery order. Current means not more than 3 years old unless the solicitation specifies less. The offeror verifies that summary level scores of a current assessment are posted in SPRS. The summary score is the total, for example 95 out of 110, not the individual value for each requirement. If no current summary score is posted, the offeror may conduct and submit a Basic Assessment for posting. Medium and High summary scores are posted by DoD. ¹

DFARS 252.204-7020 (Nov 2023) defines Basic as the contractor's review of its system security plan, conducted under the methodology, with a confidence level of Low. The clause points to the same methodology PDF. ²

The CMMC score

32 CFR 170.24 scores CMMC Level 2 the same way in structure. The maximum score equals the total number of CMMC Level 2 security requirements. Each NOT MET requirement subtracts 5, 3, or 1, and the score may be negative. Partial credit is limited to IA.L2-3.5.3 and SC.L2-3.13.11, on the same 3-point and 5-point pattern. An assessment objective marked not applicable is treated as MET. Enduring exceptions described, with mitigations, in the system security plan are MET. Temporary deficiencies addressed in operational plans of action are MET. Absence of an up-to-date system security plan means an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012. A plan of action and milestones does not turn an unimplemented requirement into a MET requirement. ⁴

For a Level 2 self-assessment, the company submits the results in SPRS. The inputs include the level, the status date, the assessment scope, the industry CAGE codes, the overall score (the rule's example is 105 out of 110), and plan of action and milestones usage if it applies. The self-assessment is repeated every three years. An affirmation goes into SPRS at the assessment and annually after that. Conditional status still has to be closed within 180 days. ⁵

For a Level 2 certification assessment, the C3PAO uploads results to the CMMC instance of eMASS, which provides automated transmission to SPRS. The company still submits an affirmation of compliance into SPRS. Hashed artifacts are retained by the company for six years. A NOT MET requirement may be re-evaluated during the assessment and for 10 business days after the active assessment period if additional evidence shows it is MET, the change does not limit other MET requirements, and the assessment findings report has not been delivered. ⁶

DFARS 252.204-7021 (Nov 2025) defines "current" for a CMMC status. A conditional Level 2 status is not older than 180 days. A final Level 2 status is not older than 3 years. An affirmation of continuous compliance for a final status is not older than 1 year. That clause is the CMMC contract clause. It is separate from the NIST SP 800-171 assessment summary in 7019 and 7020. ⁷

The class deviation

DoD's Revolutionary FAR Overhaul class deviation, 2026-O0025 Revision 3 (September 3, 2026), tells contracting officers to use a revised DFARS part 240 in place of the codified text. In that revision, section 240.370-5 prescribes 252.204-7008, 252.204-7009, 252.204-7012, and 252.240-7997, the NIST SP 800-171 DoD Assessment Requirements clause (FEB 2026). It prescribes no counterpart to the 252.204-7019 provision. Under 252.240-7997, Medium and High assessments use the methodology in 32 CFR 170.24, DoD posts their summary scores to SPRS, and you get 14 business days after an assessment to add information or rebut findings before the score is posted. When DCMA conducts an assessment, its result takes precedence over any other assessment. The codified DFARS on acquisition.gov still shows 252.204-7019 and 252.204-7020 (Nov 2023), so check which one your contract carries. ^{9, 2}

The suspension and your SPRS posting

Since July 13, 2026, the Department of War says it will enforce NIST SP 800-171 Revision 2 through Level 1 and Level 2 self-assessments and select government-led assessments, and DFARS 252.204-7012 remains in effect. Program offices may designate only Level 1 (Self) or Level 2 (Self), not Level 2 (C3PAO) or Level 3 (DIBCAC). ^{10, 11}

Compare tools for CMMC Level 2, with each published price and the date it was checked.

Sources checked October 16, 2026. Not legal advice.