What is a CMMC self-assessment?

A CMMC self-assessment is an organization-led review of its cybersecurity requirements for the required CMMC level. For Level 1, it checks the FAR 52.204-21 safeguarding requirements for Federal Contract Information. For Level 2 self-assessment, it checks all 110 NIST SP 800-171 requirements and calculates an SPRS score.

Does CMMC Level 1 have an SPRS score?

No. Level 1 does not use the SPRS point methodology. Level 1 uses a Met or Not Met self-assessment model and annual affirmation. SPRS scoring applies to Level 2, where the score ranges from -203 to 110 under the DoD Assessment Methodology.

Can I use a POA&M for CMMC Level 1 gaps?

No. Level 1 has no POA&M path and no conditional status. If a Level 1 requirement is not met, treat it as a remediation item to close before affirming. POA&M is a Level 2 concept and should not be used to defer Level 1 gaps.

When does Level 2 use SPRS?

Level 2 uses SPRS for self-assessment score reporting under the DoD Assessment Methodology. The score starts at 110 and deducts 1, 3, or 5 points for unmet requirements. Only two requirements have partial-credit treatment in the methodology: MFA and FIPS-validated cryptography.

Should I use a spreadsheet for a CMMC self-assessment?

A spreadsheet can work for a first pass, but it is easy to lose scope, evidence, status definitions, and score history as the assessment grows. If you start in Excel, use a locked practice list and review the import before anything updates your assessment record.

CMMC Self-Assessment Guide: Level 1, Level 2, SPRS

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Self-Assessment Guide: Level 1, Level 2, SPRSRun a defensible CMMC self-assessment: separate Level 1 from Level 2, document scope and evidence, calculate SPRS correctly, and avoid spreadsheet drift.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.