Self-assess all 110 NIST SP 800-171 requirements, compute your DoD SPRS score with the official weighting, and generate a POA&M of every gap, guided, in your browser, with your assessment data never leaving your device.
Under DFARS 252.204-7012, contractors handling CUI must post a NIST SP 800-171 self-assessment score in SPRS: starting at 110, with weighted deductions of 5, 3, or 1 points for each unimplemented requirement, down to a floor of −203.
This tool implements that DoD Assessment Methodology exactly: the per-requirement weights, the partial-credit rules for multifactor authentication and FIPS-validated encryption, and the gating role of the system security plan. Mark each requirement and watch your score move in real time.
Every requirement is presented with its official statement and NIST discussion text, its SPRS point weight, and a status you control. The score and your POA&M update as you go.
Record the organization, the system or enclave under assessment, the assessment scope (the CUI enclave, cloud environment, or contract boundary), and your System Security Plan reference: the same fields you'll enter into SPRS.
All 110 SP 800-171 Rev 2 requirements, organized into the 14 families, each with its official statement and NIST discussion. Mark each Met, Partial, Not Met, or N/A, and open any requirement for full detail and implementation notes.
Your score is calculated live using the DoD Assessment Methodology weights (5, 3, or 1 point per gap, the partial-credit rules for MFA (3.5.3) and FIPS encryption (3.13.11), and the SSP gating requirement), from a maximum of 110 down to the −203 floor.
Per-family progress bars show where you stand across Access Control, Identification & Authentication, System & Communications Protection, and the rest, so you know which families need attention before an assessment.
Every Not Met or Partial requirement becomes a documented gap with implementation notes and a target date. Export it to CSV, or carry it into the POA&M Tracker to manage remediation to closure.
The assessment is fully usable for free. Pro adds the I/O layer so your work persists, travels, and presents.
Save the full assessment as a JSON file and reload it later, or keep a versioned history as you close gaps between assessment cycles.
Export all 110 requirements with status, SPRS weight, notes, and POA&M target dates, ready for leadership, a prime, or your C3PAO.
Produce a print-ready assessment report with the score, per-family progress, and gap list for your records or submission package.
Compare snapshots over time to show your SPRS score climbing as remediation lands: useful evidence of continuous improvement.
Start scoring against all 110 requirements immediately: no setup, no account. Pro adds save, export, and print when you're ready to share.
Risk Posture Tools