Free, browser-based SPRS self-assessment for defense contractors. Check off which of the 110 NIST SP 800-171 Rev 2 requirements you have implemented and the page computes your score live, using the same math as the DoD Assessment Methodology (v1.2.1).
Use it here: https://sprs-score-calculator.vercel.app/ (also mirrored on GitHub Pages)
Most "SPRS calculators" are just a count of checkboxes. This one implements the actual methodology:
- Every requirement carries its real weight (5, 3, or 1 point), starting from 110 with a floor of −203
- Partial credit exists for exactly two requirements, and both are handled: 3.5.3 (MFA implemented for remote and privileged users only subtracts 3 instead of 5) and 3.13.11 (encryption in place but not FIPS-validated subtracts 3 instead of 5)
- 3.12.4 (the System Security Plan) is treated as what it is: a prerequisite with no point value. No current SSP means the assessment cannot be completed, so the calculator gives you no score until you can answer yes
- A gap report sorted by recoverable points, printable to PDF
Everything runs in your browser. Answers are saved to localStorage so you can come back later. No backend, no analytics, no cookies, nothing transmitted.
It is a static page, so just open index.html in a browser. No build step, no dependencies.
Run the scoring tests with:
node test/score.test.js
index.html/styles.css/app.js— the whole appcontrols-data.js— all 110 requirements with their DoD point valuestest/score.test.js— 23 tests covering the floor, the partial-credit rules, and the SSP gate
The links in the closing section are set at the top of app.js (CONFIG).
This is a self-assessment aid, not legal advice and not a certification. It is not affiliated with or endorsed by the Department of Defense. Requirement text comes from NIST SP 800-171 Rev 2; scoring follows the DoD Assessment Methodology v1.2.1 and 32 CFR 170.
Built by Nick Ghuneim. If this saved you an afternoon, the full CMMC Level 2 documentation kit this grew out of is Cleared2 (SSP scaffold, 14 policies, POA&M tracker, and the auto-scoring workbook).
MIT