Documentation & Reporting

Your score. Engineered.

Most contractors do not learn their real SPRS score until a C3PAO tells them. The Assessment Summary calculates it in real time from your actual requirement statuses, so you walk into the assessment knowing the number instead of guessing it.

Request a Demo ← All modules
Real time SPRS score from live statuses
14 Domains scored and tracked
110 Practices covered
Capability

How the Score Stays Current

The Assessment Summary does not ask you to re-enter data. It reads directly from the Requirements Browser, and every time a requirement status changes the SPRS score recalculates automatically. The number on the dashboard reflects exactly what your current determinations say it should be, weighted by the DoD Assessment Methodology point values.

The score displays with a breakdown by domain: how many points are at risk, how many are fully met, and the point delta of every open POA&M item. Before you remediate anything, you can see which domains carry the highest point exposure and work the most valuable gaps first.

Dashboard Requirements Evidence POA&M Reports
1TEN Assessment Summary report showing overall readiness across the 14 domains
Capability

SPRS Score Projection

Knowing your current score is useful. Knowing what your score will be after your POA&M items close is what drives prioritization. The Assessment Summary includes a projection view that models your SPRS trajectory against your active POA&M milestone schedule, so you can see not just where you are but when you will be ready.

The projection is based on the point values of the requirements on your POA&M and their scheduled completion dates. If a high-value requirement is scheduled to close next month, the projected score reflects it. If a milestone slips, the projection shows the impact before it becomes a problem in your self-attestation.

Inside the Module

What You See Inside

Live SPRS score
Calculated from current requirement statuses using DoD Assessment Methodology point weights, shown against the -203 to 110 range.
Domain-by-domain status
Completion status and point exposure for each of the 14 CMMC domains, with Met, Not Met, POA&M, and Not Applicable counts.
Open POA&M exposure
Open POA&M item count with the total point value of everything still in remediation.
Evidence gap flag
Requirements marked Met with no attached evidence are surfaced separately, before an assessor asks for it.
Score projection
SPRS trajectory modeled against your active POA&M milestone schedule, plus a readiness indicator against certification thresholds.
Exportable summary
A summary report for leadership, the ISSO, or a C3PAO during pre-assessment planning.
The problem this solves

Defense contractors routinely self-attest SPRS scores that do not reflect their actual posture, because the score was calculated from a template, the shop floor was never included in the assessment, or nothing was tracking how the score changes as gaps close. When a C3PAO assessment comes back 40 points lower than what was self-reported, the gap is rarely in the controls. It is in the visibility. No more spreadsheets drifting out of sync, no more self-assessment scores with no traceable methodology, no more remediating gaps without knowing their point value.

Coverage

Domain Coverage

Every domain is scored for status and point exposure. Practice counts per domain:

Access Control
22 practices scored for status and point exposure.
AC
Awareness and Training
3 practices scored for status and point exposure.
AT
Audit and Accountability
9 practices scored for status and point exposure.
AU
Configuration Management
9 practices scored for status and point exposure.
CM
Identification and Authentication
11 practices scored for status and point exposure.
IA
Incident Response
3 practices scored for status and point exposure.
IR
Maintenance
6 practices scored for status and point exposure.
MA
Media Protection
9 practices scored for status and point exposure.
MP
Personnel Security
2 practices scored for status and point exposure.
PS
Physical Protection
6 practices scored for status and point exposure.
PE
Risk Assessment
3 practices scored for status and point exposure.
RA
Security Assessment
4 practices scored for status and point exposure.
CA
System and Comms Protection
16 practices scored for status and point exposure.
SC
System and Info Integrity
7 practices scored for status and point exposure.
SI
Practices

Practices Satisfied

Practice IDDescription
CA.L2-3.12.1 Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
CA.L2-3.12.3 Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Connected Modules

Related Modules

Assessment
Requirements Browser
The source of truth. Every status change in the Requirements Browser updates the Assessment Summary score instantly.
Remediation
POA&M Tracker
POA&M milestone schedules feed the SPRS score projection, showing when remediation work will translate into score improvement.
Evidence
Evidence Manager
The Assessment Summary flags Met practices with no attached evidence. The Evidence Manager is where those gaps get closed.
Reports
SSP Export
Assessment Summary data feeds directly into the SSP Export: domain scores, gap analysis, and the SPRS score all included.

Your SPRS score, live.

1TEN maps your documented controls to all 110 NIST SP 800-171 requirements and scores your posture in real time.

Request a Demo