SPRS Score Calculator for Universities & Research Institutions
Prepare CMMC / NIST SP 800-171 scoring for SPRS — for universities and research institutions performing DoD-funded work with CUI.
Universities and research institutions performing DoD-funded work frequently hold controlled or export-controlled research that is CUI. Genuinely fundamental research may be exempt, but controlled data is not — and that puts the systems holding it in CMMC Level 2 (NIST SP 800-171) scope.
Most institutions scope to a separated research enclave rather than the whole campus, keeping the assessment focused on the labs and systems that actually handle CUI. Document the enclave boundary in the SSP and assess at the objective level.
Genuinely fundamental research may be exempt — but controlled and export-controlled data is still CUI.
What's typically in scope for Universities & Research Institutions
How the five CMMC asset categories (32 CFR 170.19) usually map to your environment — scope drives which requirements apply, so categorize before you assess.
| Asset | Category | What it means |
|---|---|---|
| Research enclave compute and storage holding CUI | CUI | Assessed against all Level 2 requirements. |
| Investigator workstations with controlled data | CUI | In scope as CUI Assets (within the enclave). |
| Lab instruments / equipment that can't be hardened | Specialized | Reviewed via the SSP, not assessed against every requirement. |
| Open campus IT and fundamental-research systems | Out-of-Scope | Out of scope when no CUI lands there — fundamental research. |
Where Universities & Research Institutions teams usually focus
Common areas to shore up — your real gaps come from the assessment, not a generic list.
- Standing up a separated research enclave
- Access control + MFA for researchers
- FIPS-validated encryption of controlled / export-controlled data
- Keeping fundamental research genuinely separate
- A clear SSP boundary + network diagram
Which CMMC level you need
Controlled CUI research → Level 2; self vs C3PAO depends on the CUI category. Confirm per award.
Run the level-determination wizardWhat you need to know
- Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
- A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
- A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.
Clauses that likely apply to you
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentFree tools
Frequently asked questions
- Does CMMC apply to universities?
- Yes, when they perform DoD-funded work involving CUI or controlled/export-controlled research. Genuinely fundamental research may be exempt, but controlled data is not.
- How do we scope a campus?
- Scope to the specific labs, systems, and enclaves that handle CUI rather than the whole institution — a separated research enclave is a common approach.
- Self-assessment or certification?
- It depends on whether the CUI is in the DoD OIG. Confirm the required level against the award.
- Does the fundamental-research exemption cover us?
- Only for genuinely fundamental research with no controlled or export-controlled data. The moment a project holds CUI, those systems are in scope — which is why a separated enclave is the common approach.
- Can one enclave serve many DoD projects?
- Yes — a single well-documented research enclave can host multiple CUI projects, keeping the rest of the campus Out-of-Scope. Keep the SSP and boundary current as projects come and go.
Related industries
Related guides
Go deeper on scoring, levels, and POA&Ms.