SPRS Score Calculator for Engineering & Technical Services Firms
Score CMMC / NIST SP 800-171 readiness for SPRS — for engineering and technical-services contractors handling CUI.
Engineering and technical-services firms produce and handle design data, analyses, and controlled technical information across many programs and clients — most of which is CUI, placing the firm in CMMC Level 2 (NIST SP 800-171) scope.
Because the work spans clients, scope per environment that stores or transmits CUI and segregate program data so unrelated systems can stay Out-of-Scope. Document the boundary in your SSP and network diagram, then assess at the objective level.
What's typically in scope for Engineering & Technical Services
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| Design/analysis workstations and engineering file shares | CUI | Hold CTI/CUI — assessed against all Level 2 requirements. |
| Document-management / collaboration systems with program data | CUI | In scope as CUI Assets. |
| A managed IT/security provider for the CUI environment | Security Protection | Assessed against the capability it provides. |
| General business systems segregated from program CUI | Out-of-Scope | Out of scope with a justified, documented separation. |
Where Engineering & Technical Services teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Per-program segregation so one client's CUI doesn't widen scope
- Access control and MFA on engineering systems
- FIPS-validated encryption for design data in transit
- A current SSP + network diagram of the CUI boundary
- Configuration and change management across toolchains
Which CMMC level you need
Most engineering firms handling CUI are at Level 2; self-assessment vs C3PAO depends on whether the CUI is in the DoD OIG. Confirm per contract.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- What CUI do engineering firms handle?
- Design data, analyses, and controlled technical information across programs — typically CUI, which places you in Level 2 scope.
- We work across many clients — how do we scope?
- Scope per environment that stores or transmits CUI; segregating program data can keep other systems Out-of-Scope. Document it in your SSP and network diagram.
- Self-assessment or certification?
- It depends on whether your CUI is in the DoD OIG. Many engineering firms self-assess at Level 2, but confirm against your contract.
- Does using the client's systems keep us out of scope?
- If CUI only ever lives on the client's systems and never lands on yours, your scope can be limited — but you must justify and document it. The moment CUI touches your laptops or file shares, those are in scope.
- How do we handle many small contracts at once?
- Scope to the environment(s) that hold CUI, not per contract. A single well-segregated CUI enclave can cover many programs; keep the SSP current as the CUI footprint changes.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.