You did the self-assessment, posted a solid score to SPRS, and then a prime asks about your “CMMC Level 2 status.” Aren’t those the same thing? You already told the government where you stand — isn’t that the requirement?
Almost. They’re built on the same 110 controls, which is exactly why they get conflated — and the difference is the part that decides whether you’re actually done. Here it is in one sentence: your SPRS score is you telling the government where you stand, on your signature. CMMC Level 2 is the government checking.
What Your SPRS Score Is
The SPRS score is a self-assessed number — from a floor of −203 up to a perfect 110 — that you calculate by walking all 110 controls of NIST SP 800-171 Rev 2 and subtracting the 1, 3, or 5 point weight of every control you haven’t met. The scoring method is here.
You post that number to the Supplier Performance Risk System under DFARS 252.204-7019, and a contracting officer checks that a current score exists — no more than three years old — before awarding you a contract involving CUI. Nobody audits the number when you post it. Nobody asks for your evidence at the portal. It is a representation, made by you, relied on for award. The full submission walkthrough covers the portal mechanics.
What CMMC Level 2 Is
CMMC — the Cybersecurity Maturity Model Certification program — is the Department’s answer to an obvious weakness in that arrangement: self-reported numbers drift. At Level 2, the level that applies to contractors handling CUI, the program takes the same 110 controls — verbatim, control for control — and changes exactly one thing: who does the checking.
For most CUI contracts, Level 2 means an assessment by a certified third-party assessor organization (a C3PAO) that examines your evidence control by control, with a smaller set of contracts allowed a Level 2 self-assessment plus an executive affirmation. Either way, the assessment happens under program rules, the result is recorded, and an Affirming Official re-affirms it annually.
One important caveat on timing: the Department of War suspended CMMC Phase 2 on July 13, 2026, which paused the rollout of certification requirements into new solicitations. The checking is paused. The telling — your SPRS score — never was.
Side by Side
| SPRS score | CMMC Level 2 | |
|---|---|---|
| What it is | A self-assessed number posted to a DoD database | A program status verifying the same controls |
| The standard | Identical: all 110 controls of NIST SP 800-171 Rev 2 | |
| Who assesses | You | A C3PAO for most CUI contracts; self-assessment + affirmation for some |
| Evidence reviewed | None at submission — retained by you, producible on request | Examined control by control; not documented = not met |
| POA&M rules | Any control may be open, with a completion date | Score ≥ 88, no high-weight items open, 180-day closeout |
| Output | The −203-to-110 number, current within 3 years | Certification / status, affirmed annually |
| Status today | Fully in force under DFARS 7019/7020 | Phase 2 suspended July 13, 2026, pending reform review |
The POA&M Trap: Where a Good Score Isn’t Enough
Here is the difference that surprises contractors who think a high SPRS score means they’re CMMC-ready.
SPRS is generous about unfinished work: any control can sit on your POA&M with a completion date, and you post whatever score the arithmetic produces. CMMC is not generous. To earn even a conditional Level 2 status, three rules apply at once:
- Your assessed score must be at least 88 out of 110;
- The highest-weight requirements cannot be open items at all — no deferring FIPS-validated encryption, multifactor authentication, and their 5-point peers to the plan; and
- Everything on the POA&M must close within 180 days, verified, or the status lapses.
Run the scenario: a contractor with an honest 98 — a genuinely strong score — with two 5-point controls open on the POA&M. SPRS accepts that posting without a murmur, and it’s fully award-eligible today. A CMMC Level 2 assessment would refuse conditional status to that same environment until those two controls actually close, because of which controls they are, not the number. The two rulebooks, in detail.
Know your score — and what’s blocking it
CMMC Map walks all 110 controls in plain English and computes your SPRS score live, with your gap list ranked by point value — so you can see exactly which high-weight items stand between your number and a defensible one. Free, no credit card.
See where you stand →Does SPRS Work Count Toward CMMC?
Yes — nearly all of it. Because the standard is identical, every control you genuinely implement for your SPRS self-assessment is a control implemented for CMMC. The delta is evidence depth. Your self-assessment can rest on your own knowledge that a control is met; an assessor needs to see it — the setting, the log, the policy, the record. The assessor community’s shorthand is blunt: not documented, not met.
So the honest way to describe the relationship: an accurate SPRS score with a real SSP, a live POA&M, and retained evidence is CMMC preparation. An inflated SPRS score is the opposite — it’s a written representation that a future assessment contradicts.
Where This Leaves You Right Now
- If you handle CUI: the SPRS score is your live obligation — required for award today. Keep it current, keep the SSP and POA&M behind it real, and close high-weight items first. That is simultaneously your best CMMC position for whenever certification resumes; the reform task force is expected to report around mid-September.
- If you handle only FCI: neither the scored submission nor Level 2 applies to you — you’re in Level 1 territory, which is a different, much lighter path.
- If a prime asks for your “CMMC score”: there’s no such number. They almost certainly mean your SPRS score — send the number and its assessment date, and if they ask about certification status, the accurate answer for nearly everyone right now is “self-assessed under DFARS 7019; certification pathway paused per the July 13 suspension.”
Same controls, two mechanisms: one in force, one paused. Do the work once, honestly, and both are covered.