The 5 Point Controls SPRS Weights Most: Fix These First to Raise Your Score Fastest

Your score in the Supplier Performance Risk System (SPRS) starts at 110 and loses the point value of every NIST SP 800-171 requirement you have not fully implemented, down to a floor of minus 203. Each requirement is worth 5, 3 or 1 points under the Department of Defense (DoD) Assessment Methodology, so the 5 point controls SPRS weights most are both why a score is low and the fastest way to raise it. The arithmetic is covered in our guide to calculating your SPRS score, and you can run your own numbers on the free SPRS calculator. This post is the fix list.

How many 5 point controls SPRS scoring has, and why they come first

Three reasons, and only the first is arithmetic. One 5-point requirement moves your score as much as five 1-point requirements, usually for less work than five separate fixes.

The second reason is the CMMC rule. Under 32 CFR 170.21, Conditional Level 2 (Self) status requires a score of at least 80 percent (88 of 110) and nothing on the plan of action worth more than 1 point, with one exception for 3.13.11 when encryption exists but is not FIPS validated. Every open 5-pointer therefore blocks Level 2 (Self) outright. SPRS accepts any score with a plan of action and a date for reaching 110, but the same list drives both.

The third reason is the methodology's own logic. Section 5 says that basic requirements left unimplemented render the more numerous derived requirements ineffective, with 3.1.1 as its example: fail to limit system access and the rest of access control stops meaning anything.

The requirement scored above the score: your system security plan

Requirement 3.12.4, the system security plan (SSP), has no point value in Annex A. It is marked NA, and Section 5(g) of the methodology explains why: the assessment is a review of the SSP, so without one the finding is that an assessment could not be completed due to incomplete information and noncompliance with DFARS (Defense Federal Acquisition Regulation Supplement) clause 252.204-7012. 32 CFR 170.24 repeats that wording for CMMC. No SSP, no score. Its neighbor 3.12.2, the plan of action, is worth 3 points and is not implemented if any unimplemented requirement lacks one. 3.12.1 (periodic assessment) and 3.12.3 (ongoing monitoring) are ordinary 5-pointers, evidenced by a dated self-assessment and a recurring control review.

All 42, grouped by how a small shop fixes them

Requirement text is from NIST SP 800-171 Revision 2, values from Annex A. "Suite" means the Microsoft 365 or Google Workspace admin settings you already pay for; CUI is controlled unclassified information.

Requirement	Short name	Typical fix in a 5 to 50 person shop
Identification and inventory: free
3.1.1	Limit access to authorized users and devices	User, service account and device lists, reconciled to payroll
3.1.2	Limit access to permitted functions	Role list plus the groups that enforce it
3.5.1	Identify users, processes, devices	Same lists, unique identifier per entry
3.5.2	Authenticate users, processes, devices	Suite sign-in everywhere, no shared logins
3.4.1	Baseline configurations and inventories	Inventory plus a standard build per device type
MFA and access paths: suite settings
3.5.3	Multifactor authentication (3 or 5)	Suite MFA for all users, then local admin and server consoles
3.1.12	Monitor and control remote access	One logged VPN (virtual private network) or gateway, or prohibit it in writing
3.1.13	Encrypt remote access sessions	Same gateway with current TLS (transport layer security) or IPsec
3.7.5	MFA for nonlocal maintenance	MFA on the IT provider's remote tool, sessions closed after
3.1.16	Authorize wireless access	Wireless policy, guest network off the CUI network
3.1.17	Wireless authentication and encryption	WPA2 or WPA3 with per-user or certificate authentication
3.1.18	Control mobile device connections	Suite device management, or a policy keeping phones off CUI
Encryption: the FIPS trap
3.13.11	FIPS-validated cryptography for CUI (3 or 5)	FIPS 140 validated modules only, each one documented
3.5.10	Cryptographically protected passwords	Directory passwords and a password manager; no spreadsheet
3.13.15	Session authenticity	TLS everywhere, VPN for internal apps, legacy protocols off
Logging and monitoring: cheap to start
3.3.1	Create and retain audit logs	Suite, firewall and endpoint logging on, retention set
3.3.5	Correlate log review and response	A weekly written log review, or a managed detection service
3.14.6	Monitor for attacks	Endpoint detection and firewall alerts, with a named reader
3.14.3	Act on alerts and advisories	CISA (Cybersecurity and Infrastructure Security Agency) and vendor advisories, actions logged
3.12.3	Monitor controls on an ongoing basis	Monthly control checklist with dates and initials
Vulnerabilities, patching, malware: one purchase
3.11.2	Scan for vulnerabilities	A scanner, yours or your provider's, on a schedule, reports kept
3.14.1	Identify, report, correct flaws	Managed patching via device management, deadline per severity
3.14.2	Malicious code protection	Managed antimalware on every endpoint, mail filtering
3.14.4	Update malware protection	Automatic updates, verified in the console
Boundary and configuration
3.13.1	Protect communications at boundaries	Logged business firewall at the edge and around the CUI segment
3.13.6	Deny by default, allow by exception	Deny-all rule set, inbound and outbound
3.13.5	Separate public-facing subnetworks	A DMZ (perimeter network) for anything public, or N/A with nothing public
3.13.2	Security-minded architecture	Network diagram and design principles in the SSP
3.4.2	Secure configuration settings	Hardening baseline pushed by device management
3.4.5	Access restrictions for changes	Named admins only; written change procedure
3.4.6	Least functionality	Standard build with unneeded features off
3.4.7	Restrict nonessential programs and ports	Remove unused software and ports, document what stays
3.4.8	Allowlisting or blocklisting software	Application control policy; a blocklist is the minimum
3.8.7	Control removable media	USB storage blocked by policy, exceptions listed
3.7.2	Control maintenance tools	Approved remote management tools and who may use them
People, physical, incidents, program
3.2.1	Security awareness	Annual awareness training, completion recorded
3.2.2	Role-based security training	Admin and CUI-handler training, recorded
3.9.2	Terminations and transfers	Same-day offboarding checklist: accounts off, devices back
3.10.1	Limit physical access	Locked doors to servers and CUI areas, key or badge list
3.10.2	Protect and monitor the facility	Alarm or cameras plus a visitor process
3.6.1	Incident handling capability	Short incident response plan naming who does what
3.6.2	Report incidents	Incident log with the DFARS 252.204-7012 reporting steps
3.8.3	Sanitize media before disposal	Wipe or destroy drives, with a record
3.12.1	Periodically assess controls	Dated self-assessment of all 110, on a schedule

Where the traps are

3.5.3 and local admin. One of its four assessment objectives is MFA for local access to privileged accounts: the server console, the local administrator account on a laptop. Suite MFA covers email and cloud apps, not that keyboard. Cover remote and privileged users but not the general user and the methodology subtracts 3 instead of 5. Any other gap, including a rollout that is 75 percent done with a plan of action, is scored as not implemented. More in our post on whether CMMC requires MFA.

3.13.11 and FIPS. Section 5(i) of the methodology is blunt: an approved algorithm such as AES is not sufficient, the module implementing it must be validated under FIPS 140. No encryption costs 5, encryption that is not FIPS validated costs 3, and an isolated non-validated case with a plan of action is a temporary deficiency scored as implemented. Note that 3.13.8 (CUI in transit) is a 3-point requirement and 3.8.6 (CUI on media in transport) is 1 point, so the 5-point exposure sits in 3.13.11 alone. Our FIPS guide covers finding a validated module.

Remote, wireless, mobile. Annex A subtracts nothing for 3.1.12, 3.1.13, 3.1.16, 3.1.17 or 3.1.18 when that kind of access is not permitted, but Section 5(i) expects a written policy and procedure keeping it from being enabled by accident.

What needs a purchase. For most shops this size: a business-grade firewall if you are on a consumer router (3.13.1, 3.13.6), a vulnerability scanner or a provider who runs one (3.11.2), endpoint detection or managed monitoring (3.14.6, 3.3.5), and longer log retention than the suite default (3.3.1). Everything else is settings and paperwork.

The order to work them

1. Identification first, because it is free. Users, service accounts, devices, roles and an inventory cover objectives across 3.1.1, 3.1.2, 3.5.1, 3.5.2 and 3.4.1, and every later group depends on knowing what you have. Twenty-five points for a few afternoons.
2. MFA second. Enforce it for everyone in the suite, then chase local admin and the remote support tool: 3.5.3, 3.7.5 and the remote access pair.
3. Encryption third. List every place CUI is encrypted, confirm each module's FIPS 140 validation, retire what does not qualify or put the isolated case on a plan of action.
4. Logging fourth. Turn logging on everywhere before you buy anything, then decide whether a person or a service reads it.
5. Then patching and scanning, boundary and configuration, people and physical. Steadier work with more line items and purchases, and faster once the first four groups exist, because the inventory tells you what to patch, scan and harden.

What to do this week

1. Print the 42 and mark each one implemented, not implemented or not applicable, honestly, against the 800-171A assessment objectives.
2. Write the three lists: users, service accounts and processes, devices. Date them and name an owner.
3. Turn on MFA for every suite account, then sign in at a server console and see whether anything asks for a second factor.
4. List every place CUI is encrypted and look up whether the module is FIPS 140 validated.
5. Confirm you have a signed, current SSP. If not, it comes before everything above, because without it there is no score to improve.

The score is not the goal. The three self-assessed paths that matter right now, CMMC Level 1 (Self), CMMC Level 2 (Self) and the SPRS score, all run on the same implemented or not implemented judgment, and eleven of the 42 five-pointers are also Level 1 safeguards under FAR 52.204-21. CMMC Map, CMMC compliance software for small defense contractors, scores all 110 requirements with the DoD weights and sorts the gap list by points lost, so the 5-pointers sit at the top. The assessment and the live score are free. The generated SSP, plan of action, policies and readiness report are the one paid plan at $149 a month.

This is explanatory content about contractual requirements, not legal advice. Your contract clauses and your prime's flowdown letter govern.