SPRS Score Calculator for Shipbuilding & Maritime Defense
Prepare CMMC / NIST SP 800-171 scoring for SPRS — for shipbuilders and maritime-defense suppliers.
Shipbuilders and maritime-defense suppliers handle controlled technical data — hull and systems drawings, specifications, and program information — across deep, multi-tier supply chains. That data is CUI, so suppliers holding it fall under CMMC Level 2 (NIST SP 800-171).
Flow-down is the defining feature: requirements move down the chain with the CUI, so even lower-tier fabricators can inherit the obligation. Inventory which systems touch program CUI, categorize yard/OT equipment under §170.19, then self-assess at the objective level.
What's typically in scope for Shipbuilding & Maritime Defense
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| Engineering/PLM systems with hull and systems drawings | CUI | Store/transmit CTI — assessed against all Level 2 requirements. |
| Production and inspection systems holding program data | CUI | In scope as CUI Assets. |
| Yard OT / fabrication equipment that can't be fully secured | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| Corporate IT separated from program CUI | Out-of-Scope | Out of scope with justified separation. |
Where Shipbuilding & Maritime Defense teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Supplier flow-down across deep tiers
- Categorizing yard/OT equipment correctly
- Media protection and marking of drawings
- Physical protection of CUI-handling areas
- Encryption of program data in transit
Which CMMC level you need
Handling CUI puts maritime suppliers at Level 2; a prime requiring C3PAO can raise a subcontractor's floor (§170.23). Confirm per contract.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Are maritime-defense suppliers in scope?
- Suppliers handling controlled technical data for ship and submarine programs hold CUI and fall under Level 2.
- We are a lower-tier supplier — does flow-down reach us?
- Yes. CMMC requirements flow down the supply chain: if you receive CUI, Level 2 (Self) is the minimum, and a prime requiring C3PAO can raise your floor.
- Where do we start?
- Inventory which systems touch program CUI, confirm your SSP, then run an objective-level self-assessment.
- We only fabricate to a drawing — are we in scope?
- If the drawings or specs you receive are CUI/CTI, yes. The first step is scoping the systems that store or transmit that data.
- Level 1 or Level 2?
- FCI-only work is Level 1; any CUI/CTI raises the floor to Level 2 (the 110 requirements).
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.