All Support Topics

Reviewing your self-assessment score

For defense contractors pursuing CMMC Level 2, Totem will automatically calculate your self-assessment (SPRS) score as you work your way through your controls assessment. There is no manual calculation effort required from you. This guide walks you through where to find your score and some important considerations.

To view your current score:

  • Log in to Totem.
  • Verify that the CMMC Assessment Type at the L2 Practice Level are currently active.
    • Note: While the CMMC/NIST 800-171 scoring methodology is only applicable to Level 2, you will also see a score if you are viewing the L1 or L3 CMMC Practice Level.
  • View your current score right on the Dashboard.
  • Alternatively, navigate to the Control Status module via the left-hand menu:
  • See that your current score is displayed at the top of the page:

Important Considerations

  • Your score updates any time a control’s assessment status changes such that points are lost or earned. Per the DoD 800-171 Assessment Methodology, your self-assessment score starts at 110/110. When a control is deemed Not Met, you lose the control’s accompanying points from 110. When that control is no longer Not Met, you gain the points back. While Trending Met and Not Applicable are not the same as Met, they do not result in any points lost when a control is marked one of these. Only Not Met results in lost points.
  • Each NIST 800-171 control has an associated score value. You can see this score value right in Totem:
  • There are two controls, IA.L2-3.5.3 and SC.L2-3.13.11, that are considered “variable” point controls. You can get partial credit for these controls depending on your degree of implementation. When you mark these as Not Met, you’ll see a scoring modal open, where you can specify your implementation:
  • If you are performing a CMMC Level 2 Self-Assessment, ensure that you are following the CMMC Scoring Methodology. This assessment methodology will not allow you to submit a score less than 88/110 with the following major caveats:
    • No CMMC Level 1, 3-point, or 5-point controls may be deficient. This means that only Level 2 controls worth 1 point may be deficient at the time of assessment, and only if your total score is at least 88/110.
    • If your score is not 110/110, any permitted deficient controls must be on your POA&M with a clear roadmap towards remediation in 180 days.