SPRS Score Calculator for Machine Shops & Precision Manufacturers
Self-score CMMC / NIST SP 800-171 for SPRS — built for machine shops and precision manufacturers in the DIB.
Machine shops and precision manufacturers receive government and prime drawings and specifications that are often controlled technical information — and therefore CUI. Many small shops are surprised to learn they hold CUI at all, which puts them in CMMC Level 2 (NIST SP 800-171) scope.
The shop-floor question dominates: CNC machines and OT often can't run security agents yet receive program drawings. Under §170.19 those are typically Specialized Assets reviewed via the SSP — so accurate categorization keeps the assessment focused on the few IT systems that actually store and transmit CUI.
What's typically in scope for Machine Shops & Precision Manufacturers
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| The PC / file share / email where drawings are received and stored | CUI | Holds CUI — assessed against all Level 2 requirements. |
| CNC / DNC / OT receiving drawings, not fully securable | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| A managed IT provider for the CUI systems | Security Protection | Assessed against the capability it provides. |
| Front-office systems with no CUI, separated | Out-of-Scope | Out of scope with justified separation. |
Where Machine Shops & Precision Manufacturers teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Categorizing CNC/OT so the floor doesn't widen scope
- Keeping the CUI system count small
- MFA + access control on the drawing systems
- Encryption + media handling of drawings
- A lean but real System Security Plan
Which CMMC level you need
If the drawings you receive are CUI/CTI, Level 2 is the floor; FCI-only shops are Level 1. Self vs C3PAO depends on the CUI category.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- My shop just makes parts — am I in scope?
- If the drawings or specs you receive are CUI/CTI, yes. Many small shops are surprised to learn they hold CUI.
- Can I keep my CNC machines out of scope?
- OT/CNC equipment that cannot be fully secured may be Specialized Assets reviewed via the SSP rather than assessed against every requirement; equipment with no CUI and proper separation can be Out-of-Scope.
- Do I need Level 2?
- If you handle CUI, Level 2 (NIST SP 800-171) is the floor. Confirm self-assessment versus C3PAO against your contract.
- We're a small shop with no IT staff — is this realistic?
- Yes. Scope is usually small (a handful of systems), and a guided objective-level self-assessment plus a lean SSP gets many shops to a defensible score without a consultant at every step.
- Do CNC machines have to meet all 110 requirements?
- No — OT/CNC that can't be fully secured are typically Specialized Assets reviewed through the SSP, not assessed against every requirement. Correct §170.19 categorization is the key.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.