SPRS Score Calculator for Virginia Defense Contractors

Northern Virginia and the Hampton Roads region are among the country's largest hubs of DoD contracting — from the Pentagon's doorstep to the Navy's Atlantic fleet — with a dense base of IT, professional-services, and systems-integration firms that handle CUI.

CMMC and the NIST SP 800-171 / SPRS methodology are federal, so they apply to Virginia contractors exactly as they do everywhere; what's local is the sheer concentration of CUI-handling work. If your contract carries the DFARS 7019/7020 clauses, you need a current SPRS score — start by scoping the systems that actually touch CUI.

Home to one of the highest concentrations of DoD contractors in the nation.

What you need to know

• Your SPRS score starts at a baseline of 110 and subtracts a weighted value (5, 3, or 1) for each unimplemented requirement — it can go negative (as low as −203).
• A score of 110 is a Final self-assessment; 88–109 is Conditional with a POA&M; below 88 you can't affirm a Conditional or Final status.
• A Conditional Level 2 self-assessment is valid 180 days to close your POA&M; a Final self-assessment is valid 3 years with annual affirmations.

Clauses that likely apply to you

Free tools

Frequently asked questions

Are CMMC or SPRS requirements different in Virginia?

No. CMMC and the NIST SP 800-171 / SPRS scoring methodology are federal and apply the same way to Virginia contractors as anywhere else. What varies is your contract's clauses and whether you handle FCI or CUI — not your location.

Do Virginia defense contractors have to be in SPRS?

If your contract includes DFARS 252.204-7019/7020, you must have a current NIST SP 800-171 assessment posted in SPRS to be eligible for award — regardless of where in Virginia you operate.

Do I need Level 1 or Level 2?

If you only handle Federal Contract Information (FCI), Level 1 (FAR 52.204-21) is the floor. If you handle Controlled Unclassified Information (CUI), Level 2 (the 110 NIST SP 800-171 requirements) is the minimum.

Where should a Virginia contractor start?

The same first steps apply in Virginia as everywhere, because the methodology is federal: run the level-determination wizard, scope to the systems that actually handle CUI, then run a free objective-level self-assessment to see your real score.

Can a provider in Virginia get us compliant?

An MSP, MSSP, or C3PAO can help with remediation and certification, but the obligation stays yours — you still need a current SPRS self-assessment. Browse providers in the marketplace, and self-assess first so you know your real gaps.

Related industries