Most DoD contractors know they need to conduct a NIST 800-171 self-assessment. Far fewer know how to do one that will hold up to scrutiny — either from a C3PAO auditor or a DoD contracting officer reviewing your SPRS score.
This guide walks through the practical steps of a credible self-assessment: how to scope it correctly, how to score each requirement honestly, how to calculate your SPRS score, and how to build a POA&M that actually demonstrates progress.
What NIST 800-171 Requires
NIST SP 800-171 defines 110 security requirements across 14 control families. These requirements apply to any non-federal system that processes, stores, or transmits Controlled Unclassified Information (CUI).
The 14 control families are: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.
For each requirement, your job during a self-assessment is to determine one of three things: the requirement is fully implemented, it is partially implemented, or it is not implemented.
Step 1: Define Your System Boundary
Before you assess anything, define what you are assessing. Your system boundary identifies all the components — hardware, software, networks, personnel, and processes — that process, store, or transmit CUI.
This step is where many self-assessments go wrong. Companies either scope too narrowly (missing systems that actually touch CUI) or too broadly (including infrastructure that has nothing to do with CUI, making compliance harder to demonstrate).
A well-defined system boundary includes:
- All endpoints and servers that store or access CUI
- The network segments those systems communicate across
- Cloud services (including email, file storage, and collaboration tools) used to handle CUI
- External connections such as VPNs and remote access tools
- Personnel who have access to CUI as part of their role
Document your system boundary in your System Security Plan (SSP) before you begin scoring requirements. Assessors will evaluate your controls in the context of the boundary you have defined.
Step 2: Gather Evidence for Each Requirement
Self-assessments are not opinion exercises. For each of the 110 requirements, you need to identify and document the evidence that either supports or contradicts implementation.
Evidence types include:
- Policy documents: Written policies that describe how a requirement is addressed
- Procedures: Step-by-step procedures showing how the policy is carried out
- Technical configurations: Screenshots, configuration exports, or logs showing that controls are in place
- Training records: Evidence that personnel have received required security training
- Audit logs: Records showing that monitoring and logging controls are active
A requirement is not fully implemented just because you have a policy that says you do it. The policy must be accompanied by evidence that the practice is actually in place and operating as described.
Step 3: Score Each Requirement Honestly
NIST 800-171 scoring follows a specific point system defined in NIST SP 800-171A and the DoD Assessment Methodology. Each requirement has a weighted point value based on its security importance. The maximum score is 110 points.
Scoring works as follows:
- Fully implemented: No point deduction
- Not implemented: Full point deduction for that requirement
- Partially implemented: Partial point deduction (determined by which specific objectives within the requirement are met)
The final SPRS score is calculated as 110 minus the sum of all deductions. A score of 110 means all requirements are fully implemented. A score of 0 or below means significant portions of the framework are not in place.
Do not inflate your score. DoD contracting officers can see your SPRS score before awarding contracts. More importantly, intentionally misrepresenting your cybersecurity posture in a government submission can trigger False Claims Act liability — a significant legal exposure that no federal contractor wants.
Step 4: Document Everything in Your SSP
Your System Security Plan is the central document for your self-assessment. It describes:
- The system boundary and the CUI it processes
- The controls you have in place for each of the 110 requirements
- How each control satisfies the requirement
- Any requirements that are partially or not implemented
An SSP is not a template you fill in with generic language. It must accurately reflect how your specific organization implements each requirement. Assessors reviewing an SSP that reads like a boilerplate document will probe more deeply — and they will find the gaps.
Your SSP should be kept current. When you make changes to your systems, update the SSP to reflect them. An SSP that was written two years ago and never updated will not reflect your current posture and will not serve you during an assessment.
Step 5: Build a Credible POA&M
For every requirement that is not fully implemented, you need a Plan of Action and Milestones (POA&M). The POA&M is your remediation roadmap.
A credible POA&M includes for each gap:
- The specific NIST 800-171 requirement number and description
- The current state (what is partially or not implemented)
- The planned remediation action
- The responsible owner (who is accountable for closing the gap)
- A target completion date that is realistic and achievable
- The resources required (tools, personnel, budget)
POA&M items are not failures — they are evidence of self-awareness and a structured approach to improvement. What concerns auditors is not the presence of gaps but the absence of a credible plan to close them.
Be realistic with your dates. A POA&M that lists every gap as closing in 30 days will not be credible if your current score reflects major implementation shortfalls. Build a timeline that reflects the actual complexity of the remediation work.
Step 6: Submit Your SPRS Score
Once you have completed your assessment and documented your score, you must submit it to the Supplier Performance Risk System (SPRS) at sprs.apps.mil. You will need a valid SAM.gov registration and a PIV card or ECA certificate to access the system.
Your SPRS submission includes:
- Your assessment date
- Your score
- A reference to your System Security Plan
DoD contracting officers can see your SPRS score when evaluating your company for contract awards. A score that reflects honest self-assessment is always better than an inflated score that does not match your actual practices.
Common Self-Assessment Mistakes
Scoping too narrowly
Companies often exclude cloud services, mobile devices, or remote access infrastructure from their system boundary. If these systems touch CUI, they must be in scope. A C3PAO assessor will not accept a boundary definition that conveniently excludes systems with obvious CUI exposure.
Treating policies as controls
A written policy is not a control. The control is the technical or administrative practice that implements the policy. Many companies have excellent policy documents covering requirements they have never actually implemented. Self-assessors who score policies as implemented controls will face serious findings during a third-party assessment.
Vague POA&M entries
POA&M items that say 'will implement access controls' with no specific action, no owner, and no realistic timeline are not useful. They do not demonstrate progress and will not satisfy an assessor who is looking for a credible remediation plan.
Not maintaining the SSP
An SSP written for a self-assessment and then never updated is a liability. When your infrastructure changes, your SSP must change with it. Assessors compare your SSP to your actual environment — inconsistencies are red flags.
What Happens if Your Score Is Low
A low SPRS score does not disqualify you from DoD contracts in the short term, but it will attract attention. Contracting officers weigh SPRS scores during source selection, and a low score can make you less competitive — especially when a competitor has a higher one.
More importantly, CMMC Level 2 third-party assessments require that all 110 requirements be fully or nearly fully implemented. If your self-assessment reveals a score significantly below 110, you have remediation work to do before you can pass a C3PAO assessment.
Use your self-assessment as a planning tool, not just a reporting exercise. The gaps you identify today define your remediation roadmap for CMMC compliance.
How This Connects to Your CMMC Assessment
A rigorous NIST 800-171 self-assessment is the foundation of CMMC Level 2 readiness. Whether you are ultimately subject to self-assessment or a C3PAO assessment, the process is the same: define your boundary, gather evidence, score honestly, document your SSP, and close your gaps.
Companies that have conducted honest self-assessments and maintained current SSPs are significantly better positioned for C3PAO assessments than companies that have never formalized their compliance posture.
Not sure where your organization stands? Take our free CMMC Readiness Assessment to evaluate your posture across all 14 NIST domains and get a domain-by-domain readiness profile you can use to prioritize your work.
Frequently Asked Questions
What is a NIST 800-171 self-assessment?
A structured evaluation of your organization's implementation of all 110 NIST SP 800-171 requirements. You document your system boundary, gather evidence for each control, score each requirement, and report the resulting SPRS score to DoD.
What is the maximum SPRS score?
The maximum score is 110, which means all 110 requirements are fully implemented. Unimplemented requirements reduce the score by their weighted point values. Many companies start their assessment with scores well below 110.
How long does a self-assessment take?
For a small company with a well-defined system boundary, a thorough self-assessment typically takes 40 to 80 hours of dedicated effort. Larger organizations with complex environments may require significantly more time.
What is the difference between a self-assessment and a C3PAO assessment?
A self-assessment is conducted by your own team. A C3PAO assessment is conducted by an independent, CMMC-accredited third-party organization. C3PAO assessments are required for CMMC Level 2 prioritized acquisitions and Level 3 contracts. Both processes evaluate the same 110 NIST requirements, but a C3PAO assessment carries greater rigor and independent verification.
Can a false SPRS score cause legal problems?
Yes. Knowingly submitting false compliance information to the government can trigger False Claims Act liability. Contractors who inflate their SPRS scores without actually implementing the required controls face significant legal exposure. Honest self-assessment is both an ethical obligation and a legal one.