Do professional and staffing firms handle CUI?

If your staff create, receive, or store CUI while performing services, your systems are in scope for Level 2.

Our people work on the client's systems — are we in scope?

If CUI only ever lives on the client's systems and never touches yours, your scope may be limited — but you must be able to justify it. Document the boundary in your SSP.

FCI-only work points to Level 1; any CUI raises the minimum to Level 2.

industry

SPRS Score Calculator for Professional & Staffing Services

Score CMMC / NIST SP 800-171 readiness for SPRS — for professional-services and staffing firms whose teams handle CUI.

Start free assessment How scoring works →

Consulting, engineering-support, and staffing firms often create or receive CUI while performing services for defense clients. Whether your own systems are in scope hinges on where that CUI actually lives — and on a clearly documented boundary in your SSP.

What you need to know

Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.

Read the full walkthrough

Clauses that likely apply to you

DFARS 252.204-7012

DFARS 252.204-7019

DFARS 252.204-7021

See what each clause requires

Know your score before you submit

Run a full 110-requirement self-assessment free — no account required to see your score.

Start free assessment

Free tools

Control Mapper800-171 ↔ CMMC cross-walk for all 110 requirementsOpen →DFARS ReferenceKey DFARS/FAR clauses, obligations, and effective datesOpen →Incident Timer72-hour DFARS cyber-incident reporting countdownOpen →

Frequently asked questions

Do professional and staffing firms handle CUI?: If your staff create, receive, or store CUI while performing services, your systems are in scope for Level 2.
Our people work on the client's systems — are we in scope?: If CUI only ever lives on the client's systems and never touches yours, your scope may be limited — but you must be able to justify it. Document the boundary in your SSP.
Level 1 or Level 2?: FCI-only work points to Level 1; any CUI raises the minimum to Level 2.

Related guides

Go deeper on scoring, levels, and POA&Ms.

How to Calculate Your SPRS Score (NIST SP 800-171)A step-by-step guide to the SPRS score: the DoD Assessment Methodology, how the 1/3/5 point weights work, why your score can go negative, and how MFA and FIPS partial credit are scored.Read guide CMMC Level 1 vs Level 2: Which Do You Need?FCI vs CUI, FAR 52.204-21 vs NIST SP 800-171, and the NARA Registry / DoD OIG test that decides whether Level 2 needs a self-assessment or a C3PAO certification.Read guide What Is a POA&M? (And Which Gaps Are Eligible)A Plan of Action and Milestones lets you reach a Conditional Level 2 status with a few open gaps — but not every gap qualifies. Here are the 32 CFR 170.21 eligibility rules and the 180-day clock.Read guide How to Prepare for a CMMC / SPRS Self-AssessmentA practical, in-order walkthrough: define your scope, confirm your SSP, assess at the objective level, build your POA&M, affirm, and enter your summary in SPRS.Read guide