If your company handles Controlled Unclassified Information on a defense contract, someone has asked, or soon will ask, for your SPRS score. The number looks simple. How it is built is not obvious, and a score that cannot be defended is worse than a low one.
Where the number comes from
CMMC Level 2 rests on the 110 security requirements of NIST SP 800-171 Revision 2, organized in 14 domains. The DoD Assessment Methodology scores them by subtraction. You start at 110. Every requirement that is not fully implemented takes points away, and the requirements are weighted, so a missed high-impact control costs more than a missed administrative one. That is why the scale runs from 110 all the way down to -203, and why a company that has done a great deal of work can still be surprised by a negative number.
Three things companies get wrong
- Scoring intent instead of implementation. A policy that says you will do something is not the control. A requirement is met when it is implemented and you can show it.
- Treating the POA&M as a parking lot. A Plan of Action and Milestones is a commitment with owners and dates. Not every gap is allowed to sit on one, and open items have to be closed on a schedule.
- Scoring once. The score is a snapshot of a system that changes. People leave, tools change, a new enclave gets stood up. A number nobody has revisited in a year is a number nobody should sign.
What a defensible score looks like
- Every one of the 110 requirements has a status, and the status traces to assessment objectives, not a gut call.
- Every "met" points to where the evidence lives, such as the policy, the configuration, or the log.
- Every gap has a POA&M entry with an owner and a due date, and someone is watching for overdue items.
- You can show who changed a status, and when.
Why we built the tracker to run on your machine
The assessment itself is sensitive. We did not want to hold it, and most contractors should not want a vendor to hold it either. The CMMC Level 2 Compliance Tracker runs on your own workstation or server, with no cloud service. It records control status and pointers to where your evidence lives, not the evidence, so that used as intended the tracker's own data stays non-CUI. It calculates the score live as you work the controls, flags gaps that cannot sit on a POA&M, and keeps an append-only record of changes.
What it is not
A tracker does not certify anyone. It is a readiness and management tool for your self-assessment. Where a contract requires a certification assessment, that is conducted by an accredited C3PAO, and your official score lives in the Department's SPRS system. The job of the tool is to make sure the number you submit is one you can stand behind.