SPRS Score Calculator for Electronics Manufacturers
Prepare CMMC / NIST SP 800-171 scoring for SPRS — for defense electronics manufacturers handling CUI.
Electronics manufacturers handle controlled designs, schematics, and export-controlled technical data for defense systems — CUI that places them in CMMC Level 2 (NIST SP 800-171) scope. ITAR/EAR registration is separate from, not a substitute for, CMMC.
Scope the systems holding controlled designs and categorize production/test equipment under §170.19, then self-assess at the objective level. Test gear that can't be hardened is typically a Specialized Asset reviewed via the SSP.
What's typically in scope for Electronics Manufacturers
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| EDA/PLM and file shares with controlled designs | CUI | Assessed against all Level 2 requirements. |
| Engineering and quality workstations with program data | CUI | In scope as CUI Assets. |
| ATE / test equipment that can't be fully secured | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| Business systems separated from controlled designs | Out-of-Scope | Out of scope with justified separation. |
Where Electronics Manufacturers teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Protecting controlled designs (access, MFA, encryption)
- Categorizing ATE/test equipment correctly
- Media protection + marking of designs
- Configuration management of EDA/PLM
- Supplier flow-down for assemblies
Which CMMC level you need
Controlled designs put you at Level 2; self vs C3PAO depends on the CUI category. Confirm per contract.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Are electronics designs CUI?
- Controlled designs and export-controlled technical data for defense systems are CUI, so you are in Level 2 scope.
- We are ITAR-registered — is that the same as CMMC?
- No. ITAR governs the export of defense articles and data; CMMC / NIST SP 800-171 governs how you protect CUI on your systems. You likely need both.
- Where do we begin?
- Scope the systems holding controlled designs, confirm your SSP, then self-assess at the objective level.
- Is our test lab in scope?
- Automated test equipment that holds program data but can't be fully secured is typically a Specialized Asset reviewed via the SSP, rather than assessed against all 110 requirements.
- Level 1 or Level 2?
- Any controlled or export-controlled design data is CUI → Level 2. FCI-only work is Level 1.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.