location
SPRS Score Calculator for Massachusetts Defense Contractors
Score CMMC / NIST SP 800-171 readiness for SPRS — for Massachusetts's defense R&D and technology firms.
Massachusetts's concentration of defense research labs and technology firms means many contractors handle CUI tied to advanced programs, from its R&D institutions to its software and electronics base.
The methodology is federal — Massachusetts firms follow the same NIST SP 800-171 / SPRS rules — but the research-heavy economy means controlled and export-controlled data is common. A precise SPRS score and CMMC plan start with scoping.
What you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
DFARS 252.204-7012
DFARS 252.204-7019
DFARS 252.204-7021
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Are CMMC or SPRS requirements different in Massachusetts?
- No. CMMC and the NIST SP 800-171 / SPRS scoring methodology are federal and apply the same way to Massachusetts contractors as anywhere else. What varies is your contract's clauses and whether you handle FCI or CUI — not your location.
- Do Massachusetts defense contractors have to be in SPRS?
- If your contract includes DFARS 252.204-7019/7020, you must have a current NIST SP 800-171 assessment posted in SPRS to be eligible for award — regardless of where in Massachusetts you operate.
- Do I need Level 1 or Level 2?
- If you only handle Federal Contract Information (FCI), Level 1 (FAR 52.204-21) is the floor. If you handle Controlled Unclassified Information (CUI), Level 2 (the 110 NIST SP 800-171 requirements) is the minimum.
- Where should a Massachusetts contractor start?
- The same first steps apply in Massachusetts as everywhere, because the methodology is federal: run the level-determination wizard, scope to the systems that actually handle CUI, then run a free objective-level self-assessment to see your real score.
- Can a provider in Massachusetts get us compliant?
- An MSP, MSSP, or C3PAO can help with remediation and certification, but the obligation stays yours — you still need a current SPRS self-assessment. Browse providers in the marketplace, and self-assess first so you know your real gaps.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.
How to Calculate Your SPRS Score (NIST SP 800-171)A step-by-step guide to the SPRS score: the DoD Assessment Methodology, how the 1/3/5 point weights work, why your score can go negative, and how MFA and FIPS partial credit are scored.Read guide CMMC Level 1 vs Level 2: Which Do You Need?FCI vs CUI, FAR 52.204-21 vs NIST SP 800-171, and the NARA Registry / DoD OIG test that decides whether Level 2 needs a self-assessment or a C3PAO certification.Read guide What Is a POA&M? (And Which Gaps Are Eligible)A Plan of Action and Milestones lets you reach a Conditional Level 2 status with a few open gaps — but not every gap qualifies. Here are the 32 CFR 170.21 eligibility rules and the 180-day clock.Read guide How to Prepare for a CMMC / SPRS Self-AssessmentA practical, in-order walkthrough: define your scope, confirm your SSP, assess at the objective level, build your POA&M, affirm, and enter your summary in SPRS.Read guide