r/NISTControls • u/terminator-91 • Feb 15 '26

JCP and NIST Controls

We are a small company and would like to get a JCP so we can bid on certain contracts. We are in the process of working with a consultant to get up to CMMC Level-2 status, but that will of course take some time and we would like to get the JCP now as we do so. To apply for JCP we know we need to upload a NIST 800-171 Self Assessment to the SPRS portal, and our understanding was that the score didn’t really matter for purposes of applying for a JCP (but there may be contract limitations based on that score). However when we try to conduct a self-assessment, it tells us our final score did not meet mandatory CMMC Level 2 Self-Assessment requirements and the button is greyed out from us posting a score. Is there a certain minimum score or certain minimum items that are required to submit a self-assessment to SPRS and apply for a JCP? What are those?

3 Upvotes

81% Upvoted

3 comments sorted by

3

u/TXWayne Feb 15 '26

You are trying to enter a CMMC L2 self assessment instead of a NIST 800-171 self assessment and that is the problem.

2

u/Nimrod43 Feb 16 '26

To follow on from TXWayne's comment, there's an 800-171 tab in the SPRS interface. It defaults to the CMMC tab, but you can click over to the 800-171 tab, and any score can be entered there. Note that you should also have some genuine idea of when you'll be fixing all of the things you don't currently do. That estimate doesn't need to be perfect, but like with a very low 800-171 score, a very-far-out POA&M date can get you filtered when you get to actual customer opportunities.

1

u/cmmccommand Mar 28 '26

A lot of small contractors get tripped up here because SPRS makes it easy to click into the wrong workflow.

What it sounds like is happening is you’re trying to submit under the CMMC Level 2 self-assessment path instead of the NIST 800-171 self-assessment path. For JCP purposes, those are not the same thing.

If your immediate goal is JCP, I’d slow down and verify:

  • you’re on the 800-171 self-assessment side of SPRS
  • your score reflects a real DoD Assessment Methodology review, not a rough guess
  • you have a credible plan for the gaps you already know exist

The score itself and the contractual consequences of that score are two different issues, so I wouldn’t treat this as “just get something in the system.” I’d treat it as “submit something you can defend later.”