From SPRS Score to CMMC Level 2: A Readiness Roadmap for Defense Contractors

Four DFARS provisions and one CFR part do most of the work. Read them as layers: one requires the security controls, two require a scored assessment of those controls, and the last two require a verified CMMC status.

The 32 CFR Part 170 program rule took effect on December 16, 2024. The companion acquisition rule that added the -7021 clause and solicitation provision -7025 was published September 10, 2025, and took effect November 10, 2025. Both are cited in the sources below.

NIST published SP 800-171 Revision 3 in May 2024 and withdrew Revision 2 on its own site the same month. Revision 3 restructures the requirements: it has 97 requirements across 17 families, introduces organization-defined parameters, and adds Planning, System and Services Acquisition, and Supply Chain Risk Management families.

DoD has not adopted Revision 3 for contract compliance. Two mechanisms keep Revision 2 in force for defense contractors:

• CMMC incorporates Revision 2 by reference. 32 CFR Part 170 incorporates NIST SP 800-171 Revision 2 and scores Level 2 against its 110 requirements.
• DFARS Class Deviation 2024-O0013. Issued in May 2024, it directs contracting officers to use an alternate 252.204-7012 clause that requires Revision 2 rather than the version "in effect at the time the solicitation is issued."

Plan, score, and assess against Revision 2. It is reasonable to read Revision 3 for direction, and some of its clarifications are useful, but do not rebuild your system security plan around it until DoD changes the rule or the deviation. Confirm the governing revision in each contract.

The NIST SP 800-171 DoD Assessment Methodology, and the CMMC scoring rule at 32 CFR 170.24, use the same arithmetic. Start at 110, one point per requirement. For each requirement not fully met, subtract its weight. Partial implementation earns no credit except in two named cases.

Because 42 requirements carry 5 points, 14 carry 3, 51 carry 1, and the two partial-credit requirements can each cost 5, the maximum total deduction is 313 points, which yields the familiar floor of -203.

Scoring mistakes that cost contractors later

• Counting policies as implementation. A requirement is met only when every assessment objective is satisfied with final, approved evidence. CMMC explicitly rejects drafts and working papers.
• Treating "planned" as "met." A requirement that is still on a plan of action has not been implemented, and the methodology gives no credit for intent.
• Scoring the enterprise instead of the scope. Score each covered contractor information system that is relevant to the offer; a clean corporate network does not cover an engineering enclave that handles CUI.

32 CFR Part 170 defines three levels. Level 1 protects federal contract information with an annual self-assessment and no POA&M. Level 3 adds selected NIST SP 800-172 requirements and is assessed by DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Most contractors handling CUI will be asked for one of the two Level 2 statuses.

Which status a contract requires is set by the program office and stated in the solicitation through provision 252.204-7025 and clause 252.204-7021. Do not assume that a self-assessment will satisfy a contract that calls for C3PAO certification.

CMMC is far stricter about POA&Ms than the SPRS Basic Assessment ever was. Under 32 CFR 170.21, a contractor can hold a Conditional Level 2 status only if all of these are true:

1. The assessment score divided by 110 is at least 0.8, which means at least 88 points.
2. No POA&M item has a point value greater than 1, with one exception: 3.13.11 may be on the POA&M if encryption is employed but not FIPS-validated.
3. None of six named requirements are on the POA&M: 3.1.20 (external connections), 3.1.22 (control public information), 3.12.4 (system security plan), 3.10.3 (escort visitors), 3.10.4 (physical access logs), and 3.10.5 (manage physical access).

A POA&M closeout assessment must confirm that every item is closed within 180 days of the conditional status date. If it is not, the conditional status expires.

The practical consequence is that every 5-point and 3-point requirement must be met on assessment day. A roadmap that leaves high-value items for "after the assessment" cannot produce a conditional status.

Operational plans of action are different

The scoring rule recognizes two situations that are assessed as met: enduring exceptions described with their mitigations in the SSP, and temporary deficiencies being worked through an operational plan of action that shows reviews and progress. These cover things like a component that breaks a control after it was implemented, not a control that was never put in place.

32 CFR 170.3(e) phases CMMC in over four stages. Phase 1 began on the effective date of the acquisition rule, November 10, 2025, and focuses on Level 1 and Level 2 self-assessments, although DoD may require C3PAO certification earlier at its discretion. Phase 2 begins one calendar year after Phase 1 starts and adds Level 2 (C3PAO) as a condition of award for applicable solicitations. Phases 3 and 4 follow at one-year intervals, ending with full implementation including option periods on older contracts.

Two cautions. DoD retains discretion within each phase to require a higher status or to defer a requirement to an option period, so the solicitation, not the calendar, decides. And phase-in schedules can be revised. Check the current phase-in status and the level written into each solicitation with your contracting officer before committing to an assessment date.

The sequence below is the order that protects your score and your schedule. It is deliberately conservative.

External service providers deserve early attention. If a cloud service or managed service provider handles CUI or security functions inside your scope, its own authorization or assessment status and your shared responsibility documentation become part of your evidence.