SPRS Score Calculator for Defense R&D Organizations
Prepare CMMC / NIST SP 800-171 scoring for SPRS — for research and development organizations handling CUI.
Defense R&D organizations generate and hold controlled technical information and export-controlled research — typically CUI — which places them in CMMC Level 2 (NIST SP 800-171) scope. Genuinely fundamental research may not be CUI, but controlled or export-restricted data is.
Programs evolve, so the CUI footprint shifts; scope to the systems and enclaves that actually hold CUI and keep the SSP current as projects change. Assess at the objective level so partial credit and gaps are scored correctly.
What's typically in scope for Research & Development
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| Research computing / data stores holding controlled research | CUI | Assessed against all Level 2 requirements. |
| Investigator workstations with export-controlled data | CUI | In scope as CUI Assets. |
| Specialized instruments / test equipment that can't be hardened | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| Open/fundamental-research systems with no CUI, separated | Out-of-Scope | Out of scope with justified separation. |
Where Research & Development teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Separating controlled research into an enclave
- Access control + MFA for investigators
- FIPS-validated encryption of export-controlled data
- Keeping scope and the SSP current as programs change
- Media handling and marking
Which CMMC level you need
Controlled/export-controlled research puts you at Level 2; self vs C3PAO depends on the CUI category. Confirm per award.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Is controlled research CUI?
- Export-controlled and controlled technical information generated in defense R&D is CUI, which places the organization in Level 2 scope.
- Fundamental research is exempt — does that help?
- Genuinely fundamental research may not be CUI, but controlled or export-restricted data is. Scope to the systems that actually hold CUI.
- How do we handle evolving programs?
- Keep your scope and SSP current as programs change, and reassess when the CUI footprint shifts.
- Is export-controlled (ITAR/EAR) data CUI?
- Yes — export-controlled technical data is CUI in your CMMC scope, separate from your ITAR/EAR export obligations.
- How do we keep an enclave's scope small?
- Put controlled research on a separated enclave with documented boundaries; open or fundamental-research systems with no CUI can stay Out-of-Scope if you can justify it.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.