Skip to content
← Tools

Tools

SPRS Score Calculator

Mark each of the 110 Level 2 requirements as met, not met or not applicable to estimate your score (110 down to −203) and see whether a POA&M could give you Conditional Level 2 status. Answers stay in this browser.

This is an estimate, not an official score. Scores are submitted to SPRS through PIEE, and your annual affirmation duties are unchanged. Weights come from the DoD Assessment Methodology v1.2.1 Annex A and match 32 CFR 170.24; POA&M rules come from 32 CFR 170.21. A requirement is met only when every one of its assessment objectives is met.

AC · Access Control

AC.L2-3.1.1 Authorized Access Control [CUI Data]
AC.L2-3.1.15 pts

Authorized Access Control [CUI Data]

AC.L2-3.1.2 Transaction & Function Control
AC.L2-3.1.25 pts

Transaction & Function Control

AC.L2-3.1.3 Control CUI Flow
AC.L2-3.1.31 pt

Control CUI Flow

AC.L2-3.1.4 Separation of Duties
AC.L2-3.1.41 pt

Separation of Duties

AC.L2-3.1.5 Least Privilege
AC.L2-3.1.53 pts

Least Privilege

AC.L2-3.1.6 Non-Privileged Account Use
AC.L2-3.1.61 pt

Non-Privileged Account Use

AC.L2-3.1.7 Privileged Functions
AC.L2-3.1.71 pt

Privileged Functions

AC.L2-3.1.8 Unsuccessful Logon Attempts
AC.L2-3.1.81 pt

Unsuccessful Logon Attempts

AC.L2-3.1.9 Privacy & Security Notices
AC.L2-3.1.91 pt

Privacy & Security Notices

AC.L2-3.1.10 Session Lock
AC.L2-3.1.101 pt

Session Lock

AC.L2-3.1.11 Session Termination
AC.L2-3.1.111 pt

Session Termination

AC.L2-3.1.12 Control Remote Access
AC.L2-3.1.125 pts

Control Remote Access

N/A when remote access is not permitted.

AC.L2-3.1.13 Remote Access Confidentiality
AC.L2-3.1.135 pts

Remote Access Confidentiality

N/A when remote access is not permitted.

AC.L2-3.1.14 Remote Access Routing
AC.L2-3.1.141 pt

Remote Access Routing

AC.L2-3.1.15 Privileged Remote Access
AC.L2-3.1.151 pt

Privileged Remote Access

AC.L2-3.1.16 Wireless Access Authorization
AC.L2-3.1.165 pts

Wireless Access Authorization

N/A when wireless access is not permitted.

AC.L2-3.1.17 Wireless Access Protection
AC.L2-3.1.175 pts

Wireless Access Protection

N/A when wireless access is not permitted.

AC.L2-3.1.18 Mobile Device Connection
AC.L2-3.1.185 pts

Mobile Device Connection

N/A when connection of mobile devices is not permitted.

AC.L2-3.1.19 Encrypt CUI on Mobile
AC.L2-3.1.193 pts

Encrypt CUI on Mobile

AC.L2-3.1.20 External Connections [CUI Data]
AC.L2-3.1.201 pt

External Connections [CUI Data]

AC.L2-3.1.21 Portable Storage Use
AC.L2-3.1.211 pt

Portable Storage Use

AC.L2-3.1.22 Control Public Information [CUI Data]
AC.L2-3.1.221 pt

Control Public Information [CUI Data]

AT · Awareness & Training

AT.L2-3.2.1 Role-Based Risk Awareness
AT.L2-3.2.15 pts

Role-Based Risk Awareness

AT.L2-3.2.2 Role-Based Training
AT.L2-3.2.25 pts

Role-Based Training

AT.L2-3.2.3 Insider Threat Awareness
AT.L2-3.2.31 pt

Insider Threat Awareness

AU · Audit & Accountability

AU.L2-3.3.1 System Auditing
AU.L2-3.3.15 pts

System Auditing

AU.L2-3.3.2 User Accountability
AU.L2-3.3.23 pts

User Accountability

AU.L2-3.3.3 Event Review
AU.L2-3.3.31 pt

Event Review

AU.L2-3.3.4 Audit Failure Alerting
AU.L2-3.3.41 pt

Audit Failure Alerting

AU.L2-3.3.5 Audit Correlation
AU.L2-3.3.55 pts

Audit Correlation

AU.L2-3.3.6 Reduction & Reporting
AU.L2-3.3.61 pt

Reduction & Reporting

AU.L2-3.3.7 Authoritative Time Source
AU.L2-3.3.71 pt

Authoritative Time Source

AU.L2-3.3.8 Audit Protection
AU.L2-3.3.81 pt

Audit Protection

AU.L2-3.3.9 Audit Management
AU.L2-3.3.91 pt

Audit Management

CM · Configuration Management

CM.L2-3.4.1 System Baselining
CM.L2-3.4.15 pts

System Baselining

CM.L2-3.4.2 Security Configuration Enforcement
CM.L2-3.4.25 pts

Security Configuration Enforcement

CM.L2-3.4.3 System Change Management
CM.L2-3.4.31 pt

System Change Management

CM.L2-3.4.4 Security Impact Analysis
CM.L2-3.4.41 pt

Security Impact Analysis

CM.L2-3.4.5 Access Restrictions for Change
CM.L2-3.4.55 pts

Access Restrictions for Change

CM.L2-3.4.6 Least Functionality
CM.L2-3.4.65 pts

Least Functionality

CM.L2-3.4.7 Nonessential Functionality
CM.L2-3.4.75 pts

Nonessential Functionality

CM.L2-3.4.8 Application Execution Policy
CM.L2-3.4.85 pts

Application Execution Policy

CM.L2-3.4.9 User-Installed Software
CM.L2-3.4.91 pt

User-Installed Software

IA · Identification & Authentication

IA.L2-3.5.1 Identification [CUI Data]
IA.L2-3.5.15 pts

Identification [CUI Data]

IA.L2-3.5.2 Authentication [CUI Data]
IA.L2-3.5.25 pts

Authentication [CUI Data]

IA.L2-3.5.3 Multifactor Authentication
IA.L2-3.5.35 pts

Multifactor Authentication

Partial: MFA is implemented only for remote and privileged users (−3).

IA.L2-3.5.4 Replay-Resistant Authentication
IA.L2-3.5.41 pt

Replay-Resistant Authentication

IA.L2-3.5.5 Identifier Reuse
IA.L2-3.5.51 pt

Identifier Reuse

IA.L2-3.5.6 Identifier Handling
IA.L2-3.5.61 pt

Identifier Handling

IA.L2-3.5.7 Password Complexity
IA.L2-3.5.71 pt

Password Complexity

IA.L2-3.5.8 Password Reuse
IA.L2-3.5.81 pt

Password Reuse

IA.L2-3.5.9 Temporary Passwords
IA.L2-3.5.91 pt

Temporary Passwords

IA.L2-3.5.10 Cryptographically-Protected Passwords
IA.L2-3.5.105 pts

Cryptographically-Protected Passwords

IA.L2-3.5.11 Obscure Feedback
IA.L2-3.5.111 pt

Obscure Feedback

IR · Incident Response

IR.L2-3.6.1 Incident Handling
IR.L2-3.6.15 pts

Incident Handling

IR.L2-3.6.2 Incident Reporting
IR.L2-3.6.25 pts

Incident Reporting

IR.L2-3.6.3 Incident Response Testing
IR.L2-3.6.31 pt

Incident Response Testing

MA · Maintenance

MA.L2-3.7.1 Perform Maintenance
MA.L2-3.7.13 pts

Perform Maintenance

MA.L2-3.7.2 System Maintenance Control
MA.L2-3.7.25 pts

System Maintenance Control

MA.L2-3.7.3 Equipment Sanitization
MA.L2-3.7.31 pt

Equipment Sanitization

MA.L2-3.7.4 Media Inspection
MA.L2-3.7.43 pts

Media Inspection

MA.L2-3.7.5 Nonlocal Maintenance
MA.L2-3.7.55 pts

Nonlocal Maintenance

MA.L2-3.7.6 Maintenance Personnel
MA.L2-3.7.61 pt

Maintenance Personnel

MP · Media Protection

MP.L2-3.8.1 Media Protection
MP.L2-3.8.13 pts

Media Protection

MP.L2-3.8.2 Media Access
MP.L2-3.8.23 pts

Media Access

MP.L2-3.8.3 Media Disposal [CUI Data]
MP.L2-3.8.35 pts

Media Disposal [CUI Data]

MP.L2-3.8.4 Media Markings
MP.L2-3.8.41 pt

Media Markings

MP.L2-3.8.5 Media Accountability
MP.L2-3.8.51 pt

Media Accountability

MP.L2-3.8.6 Portable Storage Encryption
MP.L2-3.8.61 pt

Portable Storage Encryption

MP.L2-3.8.7 Removeable Media
MP.L2-3.8.75 pts

Removeable Media

MP.L2-3.8.8 Shared Media
MP.L2-3.8.83 pts

Shared Media

MP.L2-3.8.9 Protect Backups
MP.L2-3.8.91 pt

Protect Backups

PS · Personnel Security

PS.L2-3.9.1 Screen Individuals
PS.L2-3.9.13 pts

Screen Individuals

PS.L2-3.9.2 Personnel Actions
PS.L2-3.9.25 pts

Personnel Actions

PE · Physical Protection

PE.L2-3.10.1 Limit Physical Access [CUI Data]
PE.L2-3.10.15 pts

Limit Physical Access [CUI Data]

PE.L2-3.10.2 Monitor Facility
PE.L2-3.10.25 pts

Monitor Facility

PE.L2-3.10.3 Escort Visitors [CUI Data]
PE.L2-3.10.31 pt

Escort Visitors [CUI Data]

PE.L2-3.10.4 Physical Access Logs [CUI Data]
PE.L2-3.10.41 pt

Physical Access Logs [CUI Data]

PE.L2-3.10.5 Manage Physical Access [CUI Data]
PE.L2-3.10.51 pt

Manage Physical Access [CUI Data]

PE.L2-3.10.6 Alternative Work Sites
PE.L2-3.10.61 pt

Alternative Work Sites

RA · Risk Assessment

RA.L2-3.11.1 RIsk Assessments
RA.L2-3.11.13 pts

RIsk Assessments

RA.L2-3.11.2 Vulnerability Scan
RA.L2-3.11.25 pts

Vulnerability Scan

RA.L2-3.11.3 Vulnerability Remediation
RA.L2-3.11.31 pt

Vulnerability Remediation

CA · Security Assessment

CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.15 pts

Security Control Assessment

CA.L2-3.12.2 operational Plan of Action
CA.L2-3.12.23 pts

operational Plan of Action

CA.L2-3.12.3 Security Control Monitoring
CA.L2-3.12.35 pts

Security Control Monitoring

CA.L2-3.12.4 System Security Plan
CA.L2-3.12.4no points · required

System Security Plan

SC · System & Communications Protection

SC.L2-3.13.1 Boundary Protection [CUI Data]
SC.L2-3.13.15 pts

Boundary Protection [CUI Data]

SC.L2-3.13.2 Security Engineering
SC.L2-3.13.25 pts

Security Engineering

SC.L2-3.13.3 Role Separation
SC.L2-3.13.31 pt

Role Separation

SC.L2-3.13.4 Shared Resource Control
SC.L2-3.13.41 pt

Shared Resource Control

SC.L2-3.13.5 Public-Access System Separation [CUI Data]
SC.L2-3.13.55 pts

Public-Access System Separation [CUI Data]

SC.L2-3.13.6 Network Communication by Exception
SC.L2-3.13.65 pts

Network Communication by Exception

SC.L2-3.13.7 Split Tunneling
SC.L2-3.13.71 pt

Split Tunneling

SC.L2-3.13.8 Data in Transit
SC.L2-3.13.83 pts

Data in Transit

SC.L2-3.13.9 Connections Termination
SC.L2-3.13.91 pt

Connections Termination

SC.L2-3.13.10 Key Management
SC.L2-3.13.101 pt

Key Management

SC.L2-3.13.11 CUI Encryption
SC.L2-3.13.115 pts

CUI Encryption

Partial: encryption is employed but is not FIPS-validated (−3).

SC.L2-3.13.12 Collaborative Device Control
SC.L2-3.13.121 pt

Collaborative Device Control

SC.L2-3.13.13 Mobile Code
SC.L2-3.13.131 pt

Mobile Code

SC.L2-3.13.14 Voice over Internet Protocol
SC.L2-3.13.141 pt

Voice over Internet Protocol

SC.L2-3.13.15 Communications Authenticity
SC.L2-3.13.155 pts

Communications Authenticity

SC.L2-3.13.16 Data at Rest
SC.L2-3.13.161 pt

Data at Rest

SI · System & Information Integrity

SI.L2-3.14.1 Flaw Remediation [CUI Data]
SI.L2-3.14.15 pts

Flaw Remediation [CUI Data]

SI.L2-3.14.2 Malicious Code Protection [CUI Data]
SI.L2-3.14.25 pts

Malicious Code Protection [CUI Data]

SI.L2-3.14.3 Security Alerts & Advisories
SI.L2-3.14.35 pts

Security Alerts & Advisories

SI.L2-3.14.4 Update Malicious Code Protection [CUI Data]
SI.L2-3.14.45 pts

Update Malicious Code Protection [CUI Data]

SI.L2-3.14.5 System & File Scanning [CUI Data]
SI.L2-3.14.53 pts

System & File Scanning [CUI Data]

SI.L2-3.14.6 Monitor Communications for Attacks
SI.L2-3.14.65 pts

Monitor Communications for Attacks

SI.L2-3.14.7 Identify Unauthorized Use
SI.L2-3.14.73 pts

Identify Unauthorized Use