CMMC Level 1 vs Level 2 in SPRS: Binary Pass/Fail vs the -203 to 110 NIST 800-171 Score

Two assessment systems, not two sizes of the same score

Level 1 and Level 2 do not share a universal percentage score. Under 32 CFR 170.15, Level 1 addresses the basic safeguarding requirements from FAR 52.204-21. Under 170.24, assessment findings depend on whether applicable objectives are satisfied. Owners should not convert a partly completed Level 1 checklist into a 110-point SPRS number.

The FAR clause contains 15 numbered safeguarding requirements. Some historical practice lists decomposed these into additional entries. AffirmTrail keeps the 15 clause items visible and ties evidence to them so a shop owner can reconcile the workspace directly to the contract clause.

Level 1: all applicable requirements must be met

A MET finding needs supporting implementation, not simply a policy title. If a user account review has never occurred, a written access-control procedure alone does not establish that the access requirement is implemented. Review the applicable assessment objectives and retain evidence of actual operation.

Level 1 does not allow a conditional POA&M. A NOT MET requirement blocks an all-MET outcome. “In Review” is an internal documentation state in the vault, not an official CMMC finding. Perform the required annual assessment and affirmation, and retain the associated artifacts under the applicable retention rules.

Level 2: start at 110 and deduct by significance

The DoD NIST SP 800-171 Assessment Methodology evaluates 110 Rev 2 requirements across 14 families. Each unmet scored requirement deducts one, three or five points according to the official methodology. These values are not effort estimates and cannot be changed because a particular safeguard is expensive.

The total possible deductions are 313, producing an arithmetic range from 110 down to -203. The System Security Plan requirement, 3.12.4, is a mandatory assessment gate rather than a normal numeric deduction. Without a suitable SSP, an arithmetic total is not a valid completed assessment.

Partial implementation and N/A require discipline

The methodology has specific partial-deduction cases for MFA (3.5.3) and FIPS-validated encryption (3.13.11). A qualifying partial implementation can produce a three-point deduction instead of five, while the finding remains NOT MET. This is not permission to invent fractional credit for other controls.

N/A findings require a defensible scope and objective-based rationale. They are credited as MET for scoring when genuinely justified. Do not use N/A as a shortcut for a missing safeguard. In the vault, record the rationale in the SSP statement and have it reviewed before relying on an exported estimate.

A high score does not equal final compliance

A Level 2 score of 88 or higher is only one condition for conditional status. All remaining gaps must be eligible for POA&M treatment, and closeout must occur within the regulatory window. A five-point gap such as missing MFA normally blocks conditional eligibility even if the total remains above 88.

Treat the live score as an estimate based on your inputs. Reconcile the control findings, SSP, evidence, scope and applicable assessment type before any official entry. AffirmTrail never submits scores or affirmations to SPRS.

Official sources

• 32 CFR 170.15: Level 1
• 32 CFR 170.24: findings and scoring
• DoD Assessment Methodology v1.2.1