location
SPRS Score Calculator for California Defense Contractors
Self-score CMMC / NIST SP 800-171 before SPRS — for California's aerospace, space, and technology defense base.
California's aerospace, space-launch, and advanced-technology firms form a major part of the defense industrial base, from Southern California's aviation primes to the Bay Area's software and electronics base.
The scoring methodology is federal and applies to California contractors the same as anywhere; what varies is the breadth of CUI-handling sectors. Companies that process CUI need an objective-level self-assessment and a SPRS score that holds up — scope first.
What you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
DFARS 252.204-7012
DFARS 252.204-7019
DFARS 252.204-7021
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Are CMMC or SPRS requirements different in California?
- No. CMMC and the NIST SP 800-171 / SPRS scoring methodology are federal and apply the same way to California contractors as anywhere else. What varies is your contract's clauses and whether you handle FCI or CUI — not your location.
- Do California defense contractors have to be in SPRS?
- If your contract includes DFARS 252.204-7019/7020, you must have a current NIST SP 800-171 assessment posted in SPRS to be eligible for award — regardless of where in California you operate.
- Do I need Level 1 or Level 2?
- If you only handle Federal Contract Information (FCI), Level 1 (FAR 52.204-21) is the floor. If you handle Controlled Unclassified Information (CUI), Level 2 (the 110 NIST SP 800-171 requirements) is the minimum.
- Where should a California contractor start?
- The same first steps apply in California as everywhere, because the methodology is federal: run the level-determination wizard, scope to the systems that actually handle CUI, then run a free objective-level self-assessment to see your real score.
- Can a provider in California get us compliant?
- An MSP, MSSP, or C3PAO can help with remediation and certification, but the obligation stays yours — you still need a current SPRS self-assessment. Browse providers in the marketplace, and self-assess first so you know your real gaps.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.
How to Calculate Your SPRS Score (NIST SP 800-171)A step-by-step guide to the SPRS score: the DoD Assessment Methodology, how the 1/3/5 point weights work, why your score can go negative, and how MFA and FIPS partial credit are scored.Read guide CMMC Level 1 vs Level 2: Which Do You Need?FCI vs CUI, FAR 52.204-21 vs NIST SP 800-171, and the NARA Registry / DoD OIG test that decides whether Level 2 needs a self-assessment or a C3PAO certification.Read guide What Is a POA&M? (And Which Gaps Are Eligible)A Plan of Action and Milestones lets you reach a Conditional Level 2 status with a few open gaps — but not every gap qualifies. Here are the 32 CFR 170.21 eligibility rules and the 180-day clock.Read guide How to Prepare for a CMMC / SPRS Self-AssessmentA practical, in-order walkthrough: define your scope, confirm your SSP, assess at the objective level, build your POA&M, affirm, and enter your summary in SPRS.Read guide