From “where do I start?” to a SPRS score you can defend.

The five steps

1. 1

   Scope your environment

   Tell us who you are, which contracts carry Controlled Unclassified Information (CUI), and which systems touch it. That boundary is what gets assessed.
2. 2

   Answer the 110 controls

   Each NIST SP 800-171 Rev. 2 requirement becomes a simple question — Met, Not met, Partially met or Not applicable — with an explanation of what an assessor expects to see.
3. 3

   Attach evidence

   Upload policies, screenshots and configuration exports. Every file records who reviewed it and when. Never upload CUI itself.
4. 4

   Let Autopilot build your SSP and POA&M

   The agent drafts your System Security Plan and creates a Plan of Action & Milestones entry for every gap, ranked by point value — you watch it work in real time.
5. 5

   Submit your score and close the gaps

   Enter your score in SPRS, then work the POA&M. The score updates live as you fix each control.

How SPRS scoring works

The DoD Assessment Methodology starts every company at 110 — one point for each control. For each control that isn't fully implemented, you subtract its weight: 5, 3 or 1 point. The lowest possible score is −203.

A few controls are partially credited: multi-factor authentication (3.5.3) and FIPS-validated encryption (3.13.11) can subtract fewer points when partly in place. CMMC Agent applies these rules automatically.

Who does what

Contractors answer questions and upload evidence. Consultants manage several client workspaces and review answers. Assessors get read-only access to see the evidence trail before an official assessment.