Does CMMC apply to universities?

Yes, when they perform DoD-funded work involving CUI or controlled/export-controlled research. Genuinely fundamental research may be exempt, but controlled data is not.

How do we scope a campus?

Scope to the specific labs, systems, and enclaves that handle CUI rather than the whole institution — a separated research enclave is a common approach.

Self-assessment or certification?

It depends on whether the CUI is in the DoD OIG. Confirm the required level against the award.

industry

SPRS Score Calculator for Universities & Research Institutions

Prepare CMMC / NIST SP 800-171 scoring for SPRS — for universities and research institutions performing DoD-funded work with CUI.

Start free assessment How scoring works →

Universities and research institutions performing DoD-funded work frequently hold controlled or export-controlled research that is CUI. Most scope to a separated research enclave rather than the whole campus, keeping the assessment focused on the systems that actually handle CUI.

Genuinely fundamental research may be exempt — but controlled and export-controlled data is still CUI.

What you need to know

Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.

Read the full walkthrough

Clauses that likely apply to you

DFARS 252.204-7012

DFARS 252.204-7019

DFARS 252.204-7021

FAR 52.204-21

See what each clause requires

Know your score before you submit

Run a full 110-requirement self-assessment free — no account required to see your score.

Start free assessment

Free tools

Control Mapper800-171 ↔ CMMC cross-walk for all 110 requirementsOpen →DFARS ReferenceKey DFARS/FAR clauses, obligations, and effective datesOpen →Incident Timer72-hour DFARS cyber-incident reporting countdownOpen →

Frequently asked questions

Does CMMC apply to universities?: Yes, when they perform DoD-funded work involving CUI or controlled/export-controlled research. Genuinely fundamental research may be exempt, but controlled data is not.
How do we scope a campus?: Scope to the specific labs, systems, and enclaves that handle CUI rather than the whole institution — a separated research enclave is a common approach.
Self-assessment or certification?: It depends on whether the CUI is in the DoD OIG. Confirm the required level against the award.

Related guides

Go deeper on scoring, levels, and POA&Ms.

How to Calculate Your SPRS Score (NIST SP 800-171)A step-by-step guide to the SPRS score: the DoD Assessment Methodology, how the 1/3/5 point weights work, why your score can go negative, and how MFA and FIPS partial credit are scored.Read guide CMMC Level 1 vs Level 2: Which Do You Need?FCI vs CUI, FAR 52.204-21 vs NIST SP 800-171, and the NARA Registry / DoD OIG test that decides whether Level 2 needs a self-assessment or a C3PAO certification.Read guide What Is a POA&M? (And Which Gaps Are Eligible)A Plan of Action and Milestones lets you reach a Conditional Level 2 status with a few open gaps — but not every gap qualifies. Here are the 32 CFR 170.21 eligibility rules and the 180-day clock.Read guide How to Prepare for a CMMC / SPRS Self-AssessmentA practical, in-order walkthrough: define your scope, confirm your SSP, assess at the objective level, build your POA&M, affirm, and enter your summary in SPRS.Read guide