Built by SpreadRunBeta

CMMC Self-Assessment Score Validator

Check the math before you post it. Send your CMMC Level 2 self-assessment results, all 110 NIST SP 800-171 Rev 2 requirements, with the details that go into SPRS. You get back the score recomputed with the published DoD method, whether it matches the score you planned to post, what the result qualifies for, and every gap in the package, each with its rule and source.

Why the number matters

The score is yours to stand behind. A Level 2 self-assessment is posted in SPRS and affirmed by a senior official, at each assessment and every year after.
False Claims Act exposure. In March 2025 a defense contractor paid $4.6 million to settle allegations that included a posted score of 104 that a consultant later put at -142. In June 2026 another paid $507,144 after a DoD assessment scored it -170, near the bottom of the -203 to 110 range.
Self-assessment carries the weight. DoD suspended the planned November 2026 move to Phase 2, so Level 2 (Self) stays the designation for CUI work.

Sources: the DOJ releases, DFARS 252.204-7021 and the DoD CIO memo, linked at the bottom of this page.

Where this fits. SPRS has no file upload for this: you type the score and details into SPRS yourself. SpreadRun checks the package before you do. The scoring method is public and free spreadsheets exist; what this adds is verified math with the rule cited on every finding, the POA&M limits spreadsheets tend to skip, the SPRS and affirmation checks, and an API for consultants and MSPs who run many clients.

A verified score is arithmetic, not a certification. It is computed from the results you enter. It is not a CMMC assessment, not legal or compliance advice, and a PASS does not mean your company meets NIST SP 800-171 or that DoD will accept the score.

Verify a score Download the CSV template

What it checks

The score. 110 minus the published value of each requirement NOT MET: 5, 3 or 1 point, with partial credit only for 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography). N/A counts as MET.
Your claimed score. Flagged if it does not match the recomputed score, or falls outside -203 to 110.
Completeness. All 110 requirements, each once, with a valid result. Unknown or duplicate rows are flagged.
The system security plan. 3.12.4 must be MET. Without an SSP no score can be posted.
POA&M rules. A POA&M for every NOT MET requirement, and each one allowed on a POA&M: 1-point requirements, plus 3.13.11 when encryption is not FIPS-validated, never the six that are excluded.
The threshold. Final (110), Conditional (at least 88, every gap allowed on a POA&M), or no Level 2 (Self) status, with the 180-day POA&M closeout window when you give the CMMC Status Date.
SPRS details. At least one CAGE code, each five characters; a defined assessment scope; an assessment date that is real, not in the future and under three years old.
The affirmation. Official named, title and contact included, statement made, dated on or after the assessment and within the last year.

Every report ends with a submission checklist: each area marked Ready, Review or Fix.

Who it's for

Defense contractors and subcontractors: check the number before the senior official affirms it.
MSPs and MSSPs: run every client through the same check, from a script.
Readiness consultants: a second look at a client's math, with the rule behind each finding.
Software and automation: a plain REST endpoint with JSON in and JSON out.

Not checked

Whether each requirement is really MET. SpreadRun never sees your systems, evidence or SSP.
Whether your scope, asset categories and CAGE codes are the right ones for your contracts.
Whether a CAGE code is registered to you. Only the format is checked.
The SPRS entry itself.
Level 1 and Level 3, and C3PAO certification assessments.

Input and output

Send
JSON with assessment (level 2, assessment date, claimed score, CAGE codes, and yes or no for scope, SSP and POA&M), affirmation (yes or no for each part, and the date), and the 110 results as a list or as the CSV you already keep. Up to 256 KB.
Check
Every rule on this page. No network calls, nothing stored.
Report
JSON with verifiedScore, band, claimedScore, deductions (requirement and points), readiness (the checklist) and findings (severity, ruleId, path, requirement, message, source).

Every field and all rule IDs are in the API docs.

Try it now

The sample packages run free. Your own results, answered here or uploaded as a CSV, run as a paid verification at $25.00 from your credit.

Free demo, no account: the three sample packages, 10 runs a day. For full validations from this form, sign in and buy credits: $25.00 per completed report, packs from $50.

Assessment and SPRS details

Assessment date

Score you plan to post

CAGE codes

CMMC Status Date

The CMMC Assessment Scope (every asset assessed) is defined.A system security plan covering every system in scope is in place.A POA&M is in place for every requirement that is not MET.

Affirmation

The Affirming Official (the senior official responsible for CMMC compliance) is named.Their title and contact information are included.They affirm that all applicable requirements are implemented and will stay implemented.

Affirmation date

We never ask for names. Each box is a yes or no.

Requirement results

0 of 110 answered. , then change the exceptions. PARTIAL is only offered where the method gives partial credit.

Access Control (22)

3.1.1 Limit system access to authorized users, processes acting for them, and devices.

3.1.2 Limit system access to the types of transactions and functions that authorized users may execute.

3.1.3 Control the flow of CUI in accordance with approved authorizations.

3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

3.1.5 Employ least privilege, including for specific security functions and privileged accounts.

3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.

3.1.7 Prevent non-privileged users from executing privileged functions, and log the execution of such functions.

3.1.8 Limit unsuccessful logon attempts.

3.1.9 Provide privacy and security notices consistent with applicable CUI rules.

3.1.10 Use session lock with pattern-hiding displays after a period of inactivity.

3.1.11 Terminate a user session automatically after a defined condition.

3.1.12 Monitor and control remote access sessions.

3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

3.1.14 Route remote access through managed access control points.

3.1.15 Authorize remote execution of privileged commands and remote access to security-relevant information.

3.1.16 Authorize wireless access before allowing such connections.

3.1.17 Protect wireless access using authentication and encryption.

3.1.18 Control connection of mobile devices.

3.1.19 Encrypt CUI on mobile devices and mobile computing platforms.

3.1.20 Verify and control or limit connections to and use of external systems.

3.1.21 Limit use of portable storage devices on external systems.

3.1.22 Control CUI posted or processed on publicly accessible systems.

Awareness and Training (3)

3.2.1 Make managers, administrators and users aware of the security risks of their activities and of applicable policies, standards and procedures.

3.2.2 Train personnel to carry out their assigned information security duties.

3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Audit and Accountability (9)

3.3.1 Create and retain system audit logs and records to enable monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity.

3.3.2 Ensure the actions of individual users can be uniquely traced to those users.

3.3.3 Review and update logged events.

3.3.4 Alert in the event of an audit logging process failure.

3.3.5 Correlate audit record review, analysis and reporting processes.

3.3.6 Provide audit record reduction and report generation.

3.3.7 Compare and synchronize internal system clocks with an authoritative source for time stamps.

3.3.8 Protect audit information and audit logging tools from unauthorized access, modification and deletion.

3.3.9 Limit management of audit logging functionality to a subset of privileged users.

Configuration Management (9)

3.4.1 Establish and maintain baseline configurations and inventories of systems.

3.4.2 Establish and enforce security configuration settings.

3.4.3 Track, review, approve or disapprove, and log changes to systems.

3.4.4 Analyze the security impact of changes before implementation.

3.4.5 Define, document, approve and enforce physical and logical access restrictions associated with changes.

3.4.6 Employ the principle of least functionality.

3.4.7 Restrict, disable or prevent the use of nonessential programs, functions, ports, protocols and services.

3.4.8 Apply deny-by-exception or permit-by-exception policy to prevent the use of unauthorized software.

3.4.9 Control and monitor user-installed software.

Identification and Authentication (11)

3.5.1 Identify system users, processes acting for users, and devices.

3.5.2 Authenticate the identities of users, processes or devices before allowing access.

3.5.3 Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.PARTIAL: MFA is implemented only for remote and privileged users.

3.5.4 Employ replay-resistant authentication for network access to privileged and non-privileged accounts.

3.5.5 Prevent reuse of identifiers for a defined period.

3.5.6 Disable identifiers after a defined period of inactivity.

3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.

3.5.8 Prohibit password reuse for a specified number of generations.

3.5.9 Allow temporary passwords for system logons only with an immediate change to a permanent password.

3.5.10 Store and transmit only cryptographically protected passwords.

3.5.11 Obscure feedback of authentication information.

Incident Response (3)

3.6.1 Establish an operational incident-handling capability, from preparation to recovery and user response.

3.6.2 Track, document and report incidents to designated officials and authorities.

3.6.3 Test the incident response capability.

Maintenance (6)

3.7.1 Perform maintenance on systems.

3.7.2 Control the tools, techniques, mechanisms and personnel used for system maintenance.

3.7.3 Sanitize equipment removed for off-site maintenance of any CUI.

3.7.4 Check media with diagnostic and test programs for malicious code before use.

3.7.5 Require multifactor authentication for nonlocal maintenance sessions, and end them when maintenance is complete.

3.7.6 Supervise maintenance by personnel without required access authorization.

Media Protection (9)

3.8.1 Protect (physically control and securely store) system media containing CUI, paper and digital.

3.8.2 Limit access to CUI on system media to authorized users.

3.8.3 Sanitize or destroy system media containing CUI before disposal or release for reuse.

3.8.4 Mark media with necessary CUI markings and distribution limitations.

3.8.5 Control access to media containing CUI and keep accountability for it during transport outside controlled areas.

3.8.6 Use cryptography to protect CUI on digital media during transport unless otherwise protected by alternative physical safeguards.

3.8.7 Control the use of removable media on system components.

3.8.8 Prohibit portable storage devices that have no identifiable owner.

3.8.9 Protect the confidentiality of backup CUI at storage locations.

Personnel Security (2)

3.9.1 Screen individuals before authorizing access to systems containing CUI.

3.9.2 Protect systems containing CUI during and after personnel actions such as terminations and transfers.

Physical Protection (6)

3.10.1 Limit physical access to systems, equipment and operating environments to authorized individuals.

3.10.2 Protect and monitor the physical facility and support infrastructure.

3.10.3 Escort visitors and monitor visitor activity.

3.10.4 Maintain audit logs of physical access.

3.10.5 Control and manage physical access devices.

3.10.6 Enforce safeguarding measures for CUI at alternate work sites.

Risk Assessment (3)

3.11.1 Periodically assess the risk to operations, assets and individuals from operating organizational systems and processing, storing or transmitting CUI.

3.11.2 Scan for vulnerabilities periodically and when new vulnerabilities are identified.

3.11.3 Remediate vulnerabilities in accordance with risk assessments.

Security Assessment (4)

3.12.1 Periodically assess the security controls to determine whether they are effective.

3.12.2 Develop and implement plans of action to correct deficiencies and reduce or eliminate vulnerabilities.

3.12.3 Monitor security controls on an ongoing basis.

3.12.4 Develop, document and periodically update system security plans.

System and Communications Protection (16)

3.13.1 Monitor, control and protect communications at external and key internal boundaries.

3.13.2 Employ architectural designs, development techniques and engineering principles that promote effective security.

3.13.3 Separate user functionality from system management functionality.

3.13.4 Prevent unauthorized and unintended information transfer through shared system resources.

3.13.5 Implement subnetworks for publicly accessible components, separated from internal networks.

3.13.6 Deny network traffic by default and allow it by exception.

3.13.7 Prevent remote devices from connecting to organizational systems while also connecting to resources in external networks (split tunneling).

3.13.8 Use cryptography to prevent unauthorized disclosure of CUI in transmission unless otherwise protected.

3.13.9 Terminate network connections at the end of sessions or after a defined period of inactivity.

3.13.10 Establish and manage cryptographic keys for the cryptography employed.

3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.PARTIAL: Encryption is employed but is not FIPS-validated.

3.13.12 Prohibit remote activation of collaborative computing devices and show users when devices are in use.

3.13.13 Control and monitor the use of mobile code.

3.13.14 Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

3.13.15 Protect the authenticity of communications sessions.

3.13.16 Protect the confidentiality of CUI at rest.

System and Information Integrity (7)

3.14.1 Identify, report and correct system flaws in a timely manner.

3.14.2 Provide protection from malicious code at designated locations.

3.14.3 Monitor system security alerts and advisories and take action in response.

3.14.4 Update malicious code protection mechanisms when new releases are available.

3.14.5 Perform periodic scans of systems and real-time scans of files from external sources.

3.14.6 Monitor systems, including inbound and outbound traffic, to detect attacks and indicators of potential attacks.

3.14.7 Identify unauthorized use of systems.

Processed in memory and not stored. Reports never repeat your CAGE codes, dates or scores you entered.

Sample report

Invented contractor with planted errors

FAIL

Verified score94 of 110No Level 2 (Self) status

Claimed score does not match6 not MET16 points deducted5 errors5 warnings

ReadyAll 110 requirements assessed, once each
ReadySystem security plan in place (3.12.4)
FixScore verified against the methodology
FixPOA&M in place and allowed for every NOT MET requirement
FixSPRS details: level, date, scope and CAGE codes
FixAffirmation by the Affirming Official
ReviewScore reaches a Level 2 (Self) status

Deductions (6)

Requirement	Points
3.1.10	-1
3.3.4	-1
3.5.3 (partial)	-3
3.10.4	-1
3.13.11	-5
3.14.6	-5

Severity	Rule	Where and what
Error	CMMC-AFFIRM-BEFORE	`/affirmation/affirmationDate` The affirmation is dated before the assessment. An affirmation is required at the time of each assessment.
Error	CMMC-AFFIRM-MISSING	`/affirmation/statementAffirmed` The affirmation statement attests that all applicable CMMC requirements are implemented and will stay implemented. It has not been made.
Error	CMMC-CAGE-FORMAT	`/assessment/cageCodes[1]` A CAGE code is five characters, letters and digits only.
Error	CMMC-POAM-MISSING	`/assessment/poamInPlace` There are NOT MET requirements, so a POA&M must be in place for each one (poamInPlace: true). A POA&M is not a substitute for a completed requirement, and the points stay deducted.
Error	CMMC-SCORE-MISMATCH	`/assessment/claimedScore` The claimed score does not match the score recomputed from the requirement results. Post the verified score, or correct the results it came from.
Warning	CMMC-BAND-NONE	`/score` This score does not reach a Level 2 (Self) status. It can still be posted, but a contract that requires Level 2 (Self) cannot be awarded on it.
Warning	CMMC-POAM-INELIGIBLE	`/requirement/3.10.4` NOT MET, and this requirement is on the list that may never be on a POA&M. It must be MET before a Level 2 (Self) status is possible.
Warning	CMMC-POAM-INELIGIBLE	`/requirement/3.13.11` NOT MET, and this requirement is worth more than 1 point as scored, and only 1-point requirements (or 3.13.11 when encryption is employed but not FIPS-validated) may be on a POA&M. It must be MET before a Level 2 (Self) status is possible.
Warning	CMMC-POAM-INELIGIBLE	`/requirement/3.14.6` NOT MET, and this requirement is worth more than 1 point as scored, and only 1-point requirements (or 3.13.11 when encryption is employed but not FIPS-validated) may be on a POA&M. It must be MET before a Level 2 (Self) status is possible.
Warning	CMMC-POAM-INELIGIBLE	`/requirement/3.5.3` NOT MET, and this requirement is worth more than 1 point as scored, and only 1-point requirements (or 3.13.11 when encryption is employed but not FIPS-validated) may be on a POA&M. It must be MET before a Level 2 (Self) status is possible.

Pricing

$25.00 per completed verification. One self-assessment, one full report.

Billed when a report is produced, PASS, WARN or FAIL. Invalid input is never billed.
Paid from the same prepaid credits as every SpreadRun API, in $5, $20, $50 or $100 packs. A $50 pack covers 2 verifications and a $100 pack covers 4. Credits never expire. All pricing
Running many clients? Talk to us first so we can tell you honestly whether this fits.

Verify a score Get API access

Call it from code

Fields, rule IDs, error codes and limits are in the API docs.

curl -X POST "https://www.spreadrun.com/api/v1/cmmc-self-assessment-validator" \
  -H "Authorization: Bearer $SPREADRUN_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @self_assessment.json

Questions

Does a PASS mean we are compliant, or that DoD will accept our score?

No. A PASS means the score you plan to post matches the published scoring method applied to the results you entered, and that the package has what SPRS and the affirmation need. SpreadRun cannot see your systems or evidence, so it cannot tell whether a requirement is really MET. A verified score is arithmetic, not a CMMC certification or assessment, and not legal or compliance advice.

The scoring method is public. Why pay for this?

It is public, and free scoring spreadsheets exist. If a spreadsheet works for you, use it. What this adds: the math checked against the regulation with the rule cited on every finding, the POA&M limits a spreadsheet usually skips (which requirements may never be on one, and the partial-credit exceptions), the SPRS and affirmation details, and an API so a consultant or MSP can run every client the same way.

How is the score calculated?

Start at 110, one point per requirement. For each requirement NOT MET, subtract its value from 32 CFR 170.24: 5, 3 or 1 point. Two requirements give partial credit: 3.5.3 costs 3 points instead of 5 if multifactor authentication covers only remote and privileged users, and 3.13.11 costs 3 instead of 5 if encryption is used but is not FIPS-validated. N/A counts as MET. The lowest possible score is -203. Without a system security plan (3.12.4) there is no score at all.

What makes a score Conditional or Final?

Final Level 2 (Self) needs every requirement MET or N/A: 110. Conditional needs a score of at least 0.8 of 110, which is 88, with every NOT MET requirement allowed on a POA&M: only 1-point requirements, plus 3.13.11 when encryption is used but not FIPS-validated, and never 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 or 3.12.4. The POA&M must then be closed out within 180 days of the CMMC Status Date, or the conditional status expires.

Does the Phase 2 suspension change anything here?

Not for self-assessments. DoD suspended the planned November 2026 move to Phase 2, which leaves Level 1 (Self) and Level 2 (Self) as the designations in use. Where a contract includes DFARS 252.204-7021, the contractor still enters current self-assessment results in SPRS and keeps an annual affirmation current. Check the sources below for anything newer.

Why do you not ask for the Affirming Official's name?

Because nothing in the check needs it, and SpreadRun does not take personal data. The affirmation checks are yes or no: is the official named, are title and contact information included, and has the statement been made.

Is my data stored?

No. The package is processed in memory for the length of the request and is not stored or shared. The report names requirement IDs and rules, never your CAGE codes, dates or the score you claimed. For billing and usage we log the time, endpoint, result status, size and duration, never the contents.

When is a run charged?

When the verification finishes and returns a report, whether it says PASS, WARN or FAIL: $25.00 per completed verification. Requests rejected before a report exists are free, such as a body that is not JSON, a level other than 2, or no requirement results.

Can I try it for free?

Yes, on the three sample packages on this page: a clean 110, a conditional result and a package with errors. They run free, up to 10 times a day. Verifying your own results, through the walk-through or a CSV, is the paid verification: sign in with at least $25.00 of credit and run it from the same form, or call the API.

Sources

SpreadRun is not affiliated with or endorsed by the Department of Defense, NIST or the Cyber AB. Where this check and the regulations differ, the regulations control.

More validators: WH-347 Certified Payroll Pre-Check | the full catalog