SPRS Score Calculator for Logistics & Supply Chain Contractors
Score CMMC / NIST SP 800-171 readiness for SPRS — for logistics and supply-chain contractors supporting DoD.
Logistics and supply-chain contractors handle shipment, inventory, and program data tied to defense contracts. When that data is CUI, the systems holding it fall under CMMC Level 2 (NIST SP 800-171); FCI-only handlers fall to Level 1.
Because logistics systems often span many customers, scope to the systems that store or transmit program CUI and segregate them where possible. Categorize handheld/IoT devices under §170.19 and self-assess at the objective level.
What's typically in scope for Logistics & Supply Chain Contractors
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| TMS/WMS/ERP holding program logistics data (CUI) | CUI | Assessed against all Level 2 requirements. |
| Systems transmitting CUI shipment / manifest data | CUI | In scope as CUI Assets. |
| Handheld scanners / IoT that can't be fully secured | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| General commercial-logistics systems with no CUI | Out-of-Scope | Out of scope with justified separation. |
Where Logistics & Supply Chain Contractors teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Identifying which logistics data is actually CUI
- Segregating program data from commercial systems
- Access control + MFA on program systems
- Categorizing handheld / IoT devices
- Encryption of CUI in transit between partners
Which CMMC level you need
CUI logistics data → Level 2; FCI-only → Level 1. Self vs C3PAO depends on the CUI category.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Is logistics data CUI?
- Shipment, inventory, and program data tied to defense contracts can be CUI. If it is, you are in Level 2 scope.
- We mostly move goods — are we really in scope?
- If your systems store or transmit CUI, such as program-specific logistics data, yes. Scoping identifies exactly which systems are in scope.
- What if we only handle FCI?
- FCI-only handlers need Level 1 (FAR 52.204-21, 15 requirements), not the full Level 2 set.
- How do we tell FCI from CUI in logistics data?
- FCI is non-public contract information not marked as CUI; program-specific data marked or qualifying as CUI raises you to Level 2. When unsure, treat marked data as CUI and confirm with the prime.
- Are our scanners and IoT devices in scope?
- Devices that can't be fully secured but touch CUI are typically Specialized Assets reviewed via the SSP; devices with no CUI and proper separation can be Out-of-Scope.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.