If you sell to a defense prime in Virginia, Maryland or DC, the first thing their supplier team looks at isn't your past performance. It's your SPRS score and your CMMC level. A defense contractor without a current score in the Supplier Performance Risk System can be ruled ineligible before anyone reads the technical volume. This guide to CMMC explains what the requirements actually are, how your SPRS score is based on NIST SP 800-171, where CMMC compliance stands after DoD suspended Phase 2, and what primes in the region are asking subcontractors for right now. It ends with a checklist and a 90-day plan, so you can turn the SPRS score and CMMC certification question from a risk into a qualifier on your next DoD contract.
CMMC is an award gate, not an evaluation factor
Most contractors think of cybersecurity as one more box on the proposal. CMMC doesn't work that way. When a solicitation carries a CMMC requirement, the contractor must have a current CMMC level and status posted in SPRS by the time of award. It's pass/fail. A brilliant technical approach and a decade of strong past performance don't matter if the status is missing, expired or below the level the contract requires.
That is why primes check it first. Under DFARS 252.204-7021, which implements the CMMC Program rule at 32 CFR Part 170, a prime that flows a CMMC requirement down to subcontractors has to make sure those suppliers hold the right level and assessment type before it awards the subcontract. No prime wants to discover a gap after a teaming agreement is signed, so checking the SPRS score for CMMC eligibility has moved to the front of supplier onboarding.
The practical effect: your score on file is now part of your capability statement whether you put it there or not. Treat it like a security clearance for the company. Keep it current, keep it accurate, and know what it says before a prime asks.
What CMMC Level 2 requires: 110 NIST SP 800-171 controls, an SPRS score and an annual affirmation
CMMC Level 2 applies to companies that handle controlled unclassified information (CUI) on a DoD contract. The technical bar is the 110 NIST SP 800-171 Revision 2 security requirements, the same controls DFARS 252.204-7012 has required since 2017. NIST has since published Rev 3 and marked Rev 2 as withdrawn, but DoD still assesses against Rev 2, so that's the version to build to.
Level 2 adds three things on top of the controls. First, a system security plan (SSP) describing how each control is met. Second, an assessment score entered into SPRS, either from a self-assessment or from a CMMC third-party assessment organization (C3PAO), depending on what the contract specifies. Third, an affirmation from a senior company official, repeated every year, that the company still meets the requirements. That status is valid for three years, with the score in SPRS and an annual affirmation keeping it current in between.
That affirmation carries legal weight. The official who signs it is telling the government the controls are in place today, not that they were in place on assessment day.
What is the difference between CMMC Level 1 and Level 2?
CMMC Level 1 covers companies that handle only federal contract information, not CUI. It requires 15 basic safeguarding requirements from FAR 52.204-21, an annual self-assessment and an annual affirmation. There's no partial credit and no plan of action: you meet all 15 or you don't qualify.
Level 2 is a much larger lift: 110 controls instead of 15, a documented SSP, a weighted score, and in many cases an outside assessor. The dividing line usually comes down to one question: does CUI touch your systems? If it does, even through a single drawing or specification, you're in Level 2 territory.
Level 3 sits above both and adds 24 enhanced requirements from NIST SP 800-172, assessed by the government's own DIBCAC team. It applies to a small set of programs facing advanced persistent threats. Most suppliers in the defense industrial base will live at one of the first two levels.
How is your SPRS score calculated?
Your SPRS score is the number DoD uses to summarize how much of NIST SP 800-171 a contractor has implemented. The SPRS score is calculated with the DoD Assessment Methodology: the score starts at 110, a perfect score of 110 meaning every requirement is met, and points are subtracted for each requirement that isn't. Each control is weighted at 1, 3 or 5 points depending on how much damage its absence would cause.
Scores range from -203 to 110. A negative score is possible and not unusual for companies just starting out, because missing high-value controls like multifactor authentication or FIPS-validated encryption cost 5 points each. The full score range matters because primes and contracting officers can see where you sit, not just whether you've submitted.
Under the CMMC rule, a self-assessment score of 88 or higher with an approved plan of action and milestones earns Conditional Level 2 Status, but only lower-weighted controls can be left open, and the plan must close within 180 days. A final CMMC status requires every requirement met. To submit an SPRS score, someone in your company needs the SPRS Cyber Vendor User role in the PIEE system; get that access sorted before you need it.
Where CMMC stands in 2026: Phase 1 in force, Phase 2 paused
Phase 1 took effect on November 10, 2025. Since then, solicitations can include CMMC requirements at Level 1 (Self) and Level 2 (Self), and SPRS posting plus annual affirmations are live. Phase 2, which would have made C3PAO assessments mandatory for most Level 2 contracts starting November 10, 2026, is suspended. The Department of Defense, now also styled the Department of War, announced the suspension of CMMC Phase 2 on July 13, 2026, and created a CMMC Reform Task Force to review the program.
The suspension is narrower than many headlines suggest. A July 2026 class deviation, reissued on September 3, lets requiring activities designate only CMMC Level 1 or Level 2 self-assessments in new solicitations, and Level 3 designations are also on hold. But NIST SP 800-171 compliance under DFARS 252.204-7012 hasn't changed, SPRS reporting hasn't changed, and annual affirmations haven't changed. The task force's report was due in September; as of this writing, no new Phase 2 date has been published.
So the CMMC phase timeline moved, but the obligations underneath it didn't. Contractors who paused CMMC readiness work in July are carrying the same False Claims Act exposure they had before, with less time to fix it once Phase 2 restarts.
Do you need a C3PAO assessment or a self-assessment for Level 2?
The contract decides. Each solicitation names the required level and type: Level 2 (Self) or Level 2 (C3PAO). With Phase 2 suspended, DoD solicitations are generally asking for self-assessed status, and a Level 2 self-assessment is what most Mid-Atlantic subcontractors will submit this year.
That doesn't make the C3PAO route irrelevant. Some primes are asking key contractors to pursue a C3PAO Level 2 certification anyway, because they expect the requirement to return and don't want to requalify their supply chain on short notice. A CMMC assessment by a C3PAO also gives your score third-party credibility that a self-reported number can't. If you're pursuing CMMC Level 2 to win prime work rather than just stay eligible, a certification is a sales asset.
Whichever route applies, prepare the same way. The DoD CIO's CMMC resources, including the CMMC Level 2 Assessment Guide, show exactly how assessors test each control. Use them when you score yourself so the number you post survives an outside look later. Our comparison of RPO vs C3PAO vs in-house support walks through the trade-offs.
The Mid-Atlantic reality: primes, flow-down and subcontractor checks in Virginia, Maryland and DC
The region has one of the densest concentrations of defense primes and integrators in the country, clustered around Northern Virginia, the Maryland suburbs and installations from Fort Meade and Aberdeen to Quantico and Norfolk. For a small contractor, that means most of your revenue probably runs through a handful of large companies, each with its own supplier portal, cybersecurity questionnaire and flow-down clauses.
Those primes carry the risk of their supply chain. When a DoD contract includes DFARS 252.204-7012 or a CMMC requirement, the prime contractor has to flow it to every subcontractor that will handle CUI, and confirm those subcontractors meet it. In practice, level 2 contractors in the region tend to see the same sequence: a request for their score and CMMC posture at supplier registration, a questionnaire on the system security plan and incident reporting, and a request for any C3PAO certificate. If your score does not match what your questionnaire answers imply, expect follow-up questions.
The practical advice for regional suppliers is to make the prime's check easy. Keep a one-page summary of your CMMC posture ready to send: level, status, score, assessment date and assessment type. A prime contractor that has to chase you for basic information is already forming an opinion before any past performance discussion starts. Our federal B2G strategy team helps suppliers package that information for teaming conversations.
What happens if you submit an inaccurate SPRS score?
An inflated SPRS score is a False Claims Act problem, not a paperwork problem. In March 2025, MORSECORP agreed to pay $4.6 million to resolve allegations that included reporting a score of 104 to DoD when a consultant later put its actual score at -142, and not updating it for nearly a year. DOJ's Civil Cyber-Fraud Initiative has made cases like this a steady stream.
Every defense contract you win while an overstated score sits in the system can be treated as a false claim. That exposure exists whether the inflated number came from optimism, a misunderstanding of the methodology or an outdated assessment. Whistleblowers, usually insiders, receive a share of recoveries, which is why many of these cases start inside the company.
The fix is straightforward: post an accurate SPRS score and keep it that way. Update your SPRS score when your environment changes, such as after a cloud migration or the loss of a key control, rather than waiting for the next cycle. An accurate score of 70 with a credible plan is a far better position than a 110 nobody can defend.
CMMC Level 2 compliance checklist
Use this as the working list for your CMMC compliance effort:
- Scope: identify every system, person and facility that stores, processes or transmits CUI, and consider an enclave to shrink that footprint.
- System security plan: one current document describing how each of the 110 requirements is met, plus network diagrams and data flows.
- Self-assessment: score every control using the DoD Assessment Methodology and DoD's assessment guide, with evidence for each "met."
- Plan of action: document open items, owners and dates; know which ones disqualify you from conditional status.
- SPRS submission: confirm who holds SPRS access, enter the score in your CMMC SPRS record, assessment date and scope, and save a copy.
- Affirmation: name the affirming official and calendar the annual affirmation.
- Incident reporting: a tested process to report cyber incidents to DoD within 72 hours, as DFARS 252.204-7012 requires.
- Flow-down: list subcontractors handling CUI and verify their scores and status.
Every item on this list maps to something a prime or assessor will ask for. If any item is missing, that's where to start.
A 90-day readiness plan
Days 1–30: scope and score. Confirm where CUI lives, decide on an enclave versus whole-network approach, and run an honest CMMC self-assessment. Compare the result with the score currently in SPRS. If the posted number is too high, update your score now; that single step reduces more risk than anything else on this list. Our guide on CMMC and NIST SP 800-171 for contractors covers the control families in detail.
Days 31–60: close the heavy gaps. Prioritize 5-point controls first: multifactor authentication, FIPS-validated encryption, logging and incident response. These drive the largest score improvement and are the ones conditional status won't let you defer. Suppliers who want to improve their SPRS score quickly should start here. Write or update the SSP as you go, not at the end.
Days 61–90: evidence and submit. Collect evidence for every met control, finalize the plan of action, post the updated score to SPRS and have the affirming official sign off. If a prime has asked for a C3PAO certification, use this window to choose an assessor; our guide on how to choose a CMMC consultant helps, and our 90-day C3PAO readiness roadmap goes deeper on the assessment itself. For the bigger picture, start with our CMMC 2.0 compliance guide.
Frequently asked questions
What is an SPRS score?
It's the number DoD uses to summarize how much of NIST SP 800-171 a contractor has implemented. Under the DoD Assessment Methodology it starts at 110 and loses 1, 3 or 5 points for each unmet requirement, so scores range from -203 to 110.
What SPRS score do you need for CMMC Level 2?
A final Level 2 status requires all 110 requirements met. A self-assessment score of 88 or higher with an approved plan of action earns Conditional Level 2 status, provided only lower-weighted controls are open and the plan closes within 180 days.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers federal contract information only and requires 15 basic safeguarding requirements with an annual self-assessment. Level 2 covers CUI and requires the 110 NIST SP 800-171 Rev 2 controls, a system security plan, an SPRS score and an annual affirmation.
Is CMMC Phase 2 delayed?
Yes. DoD suspended Phase 2, which would have made C3PAO assessments mandatory for most Level 2 contracts from November 10, 2026, and no new date has been published. NIST SP 800-171, SPRS reporting and annual affirmations still apply.
What happens if your SPRS score is wrong?
An inflated score can create False Claims Act exposure on every contract it supports. MORSECORP agreed to pay $4.6 million in 2025 to resolve allegations that included reporting a score far above its actual one, so update your score whenever your environment changes.
Ready to get your SPRS score prime-ready?
VisioneerIT's CMMC preparation team helps suppliers to the government and defense market scope CUI, score their environment honestly, build the SSP and post a score they can defend. Our cybersecurity consulting group then closes the technical gaps. Talk to our team about a 90-day CMMC readiness plan.
Key Things to Remember
- CMMC is pass/fail at award; primes check your SPRS score and status before they weigh past performance.
- Level 2 means 110 controls from NIST SP 800-171 Rev 2, an SSP, an SPRS score and an annual affirmation.
- SPRS scores run from -203 to 110; 88 with an approved plan earns conditional status, and a final Level 2 certification or status requires the full 110.
- Phase 2 (mandatory C3PAO assessments) is suspended, but NIST SP 800-171, SPRS reporting and affirmations still apply.
- An inflated score creates False Claims Act exposure on every contract it touches; MORSECORP paid $4.6 million.
- Mid-Atlantic primes want a quick, documented answer on your level, status and score; have it ready.
- Spend the first 30 days on an honest score, then fix 5-point controls first.
