Your SPRS score during the CMMC pause: which NIST 800-171 gaps to close first?

Does the CMMC pause change what NIST SP 800-171 requires?

No. The pause removed the third-party verification step and left the controls, and the SPRS score built on them, in place. When the Department of War suspended CMMC Phase 2 on July 13, 2026, its announcement said "All Phase I self-assessment requirements remain firmly in place" and that the department would "enforce cybersecurity compliance with the NIST SP 800-171 Rev 2 standard through self-assessments." It added that contractors "remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012."

That clause is where the 110 requirements come from for most design firms. DFARS 252.204-7012 requires adequate security for covered defense information, rapid reporting of cyber incidents (defined as "within 72 hours of discovery"), and, if you use a cloud provider for that information, a provider that meets requirements equivalent to the FedRAMP Moderate baseline. None of that was paused. Our earlier piece, CMMC Phase 2 is suspended, covers the program status in detail. This one is about the controls themselves.

Which version of NIST SP 800-171 should you be closing gaps against?

You should close gaps against Revision 2. NIST published Revision 3 on May 14, 2024, and it formally supersedes Revision 2 at NIST. But the CMMC rule incorporates Revision 2 by reference: 32 CFR 170.2 lists "Revision 2, February 2020 (includes updates as of January 28, 2021)." DoD also issued a class deviation in May 2024 directing contractors under 7012 to Revision 2, and the July 2026 suspension notice named Rev 2 as the standard it will enforce.

For a firm doing gap closure this quarter, that means your system security plan, your SPRS score, and your POA&M should all reference the 110 Revision 2 requirements. Revision 3 is worth reading for direction, since it reorganizes the requirements and adds organization-defined parameters, but it is not what your score is measured against today.

How is the SPRS score calculated?

You start at 110 and subtract the value of every requirement you have not met. 32 CFR 170.24 sets the maximum score equal to the number of Level 2 requirements and assigns each one a value of 1, 3, or 5 points, noting that subtraction "may result in a negative score." The lowest possible score is -203.

Two requirements earn partial credit. Multifactor authentication (3.5.3) costs 5 points if it is not implemented at all and 3 points if it is implemented "only for remote and privileged users." Encryption of CUI (3.13.11) costs 5 points if encryption is not used and 3 points "If encryption is employed, but is not FIPS-validated."

The system security plan (3.12.4) carries no point value, but it is a precondition. The rule states that firms "must have a System Security Plan (SSP) ... in place at the time of assessment." Without one, there is no valid assessment to score.

Which gaps can stay on a POA&M, and which cannot?

Only 1-point gaps can stay on a POA&M, plus one narrow encryption exception, and only if your score is at least 88. 32 CFR 170.21 allows a Conditional Level 2 status only when "The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8." With 110 requirements, that is 88.

The same section bars any POA&M item with a value greater than 1. The exception is 3.13.11, which may be on a POA&M if encryption is used but not FIPS-validated. Six requirements can never be deferred, regardless of value:

• AC.L2-3.1.20, external connections
• AC.L2-3.1.22, control of publicly posted information
• CA.L2-3.12.4, the system security plan
• PE.L2-3.10.3, escorting visitors
• PE.L2-3.10.4, physical access logs
• PE.L2-3.10.5, managing physical access devices

Every POA&M item must be closed "within 180-days of the Conditional CMMC Status Date," or the conditional status expires. In practice, this means a gap-closure plan should start with the 5-point and 3-point requirements and the six that cannot be deferred. Those are the items that decide whether you can claim a conditional status at all.

Which 5-point requirements trip up design firms most often?

The 5-point requirements that trip up design firms most often are the ones that depend on knowing where CUI lives. The 5-point list in 32 CFR 170.24 includes limiting system access to authorized users (3.1.1) and to authorized functions (3.1.2), baseline configurations and inventories (3.4.1), identifying and authenticating users (3.5.1 and 3.5.2), incident handling (3.6.1 and 3.6.2), protecting and sanitizing media (3.8.3), periodic security assessments and plans of action (3.12.1 and 3.12.3), boundary protection (3.13.1), and flaw remediation and malicious code protection (3.14.1, 3.14.2, 3.14.3).

For an architecture or engineering office, these usually surface in a few places:

• Project drawings with CUI markings sitting on a general file share every employee can open, which works against 3.1.1 and 3.1.2.
• Drawings shared with subconsultants through consumer file links instead of an approved platform.
• Large-format plotters and rendering workstations missing from the inventory required by 3.4.1.
• Personal phones syncing project email without MFA, which affects 3.5.3.
• An incident response plan that does not name who files the 72-hour DoD report.

Scoping is the lever that makes the rest manageable. A firm that confines CUI to a defined enclave of users, devices, and cloud services has far fewer machines to bring up to 110 than a firm whose CUI is everywhere.

Why does an accurate SPRS score matter while certification is paused?

An accurate SPRS score matters because it is a representation to the government, and the Justice Department can pursue a false one under the False Claims Act. DFARS 252.204-7019 requires a current assessment, "not more than 3 years old," posted in SPRS to be considered for award. DFARS 252.204-7020 extends the same expectation to covered subcontractors, which is how a prime's requirement reaches a design subconsultant.

The Civil Cyber-Fraud Initiative has produced a steady line of settlements. In March 2025, MORSECORP agreed to pay $4.6 million; it had posted an SPRS score of 104, and a consultant later scored it at -142. In September 2025, Georgia Tech Research Corporation agreed to pay $875,000 over allegations that included a lab with "no system security plan." On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that a business unit failed to comply with NIST SP 800-171 on one of its networks. Apart from MORSECORP's admissions, these are allegations resolved without a determination of liability.

None of these cases depended on a C3PAO. They turned on what the contractor said about its own controls, which is exactly what continues under Phase 1.

What should you finish this quarter?

This quarter, finish a closure plan ordered by point value and POA&M eligibility, starting with the items the scoring rules weigh most.

• Confirm your SSP exists, is current, and describes the actual CUI boundary. Without it, nothing else counts.
• Score yourself honestly against all 110 Revision 2 requirements using the values in 32 CFR 170.24.
• Close every open 5-point and 3-point item and the six requirements that can never be on a POA&M.
• Turn on MFA for all users, not only remote and privileged accounts, to recover the full 5 points on 3.5.3.
• Verify that the encryption protecting CUI is FIPS-validated, and that your cloud services meet the 7012 FedRAMP Moderate equivalency requirement.
• Post the updated score in SPRS and put your next annual affirmation on the calendar.

If the CMMC Reform Task Force brings third-party assessment back, a firm that did this work will be ready to book one. If it does not, the same work is what keeps your self-assessment defensible.

How does s90 help?

s90 runs IT for architecture, engineering, and construction firms in Los Angeles and Orange County, including firms on defense work. We help scope CUI, maintain the controls behind a Revision 2 self-assessment, and keep the evidence that supports your SPRS score current between affirmations. If you want a second set of eyes on your score or POA&M, we are glad to help.