Live SPRS score from your SSP
Secureframe calculates your Supplier Performance Risk System (SPRS) score live from your System Security Plan (SSP), so the score reflects your actual implementation work as you go.
New to SPRS? Start with Breaking Down SPRS for what the score is and why it matters.
Viewing your score
Your live SPRS score appears on the right side of your System Security Plan dashboard. The Control Implementation table provides the detailed breakdown, showing each control's assessment objectives and the score contribution of every control.
As you mark assessment objectives Implemented or Not Applicable, controls complete and your score updates. Treat the score as a live progress meter for your program rather than a one-time grade.
Why your score starts negative
Your score starts at the bottom of the range and climbs as you work. Secureframe only credits requirements you have marked Implemented or Not Applicable, so before any work is recorded, every requirement counts as unmet and the score sits near -203. That is not a judgment of your security. It just means nothing has been recorded yet. As you complete assessment objectives and your scoping answers mark out-of-scope requirements Not Applicable, points are added and the score rises toward 110.
Where your score comes from
Your score is driven by the implementation status of each requirement in your SSP:
Fully implemented: Full points.
Not Applicable: Full points, since the requirement does not apply to your environment. Requirements can be marked Not Applicable with documented justifications.
Partially implemented: Partial points, for the multi-factor authentication (MFA) and FIPS encryption requirements only.
Not implemented: Points deducted.
Improving your score
Work through the Control Implementation page and close out assessment objectives, following the guidance on any failing tests.
Make sure your CMMC Scoping answers are accurate, so requirements that genuinely do not apply to your environment are marked Not Applicable with documented justifications instead of counting against you. See CMMC Scoping.
Document remaining gaps as POA&M items with owners and target dates. Learn more: Creating and Managing POA&Ms
When you are ready to report your score to the DoD, see Submitting Your SPRS Score to DoD.