If your SPRS score is negative, the instinct is to work through NIST 800-171 from the top. That is the slowest possible route, because the controls are not equally weighted.

Start with the five pointers. Forty two of the 110 controls carry a weight of five. Fixing one of those moves your score as much as fixing five one pointers. Pull the list, sort by weight, and work down.

Remember there is no partial credit. A control is implemented or it is not. This changes the strategy: finishing three controls completely beats making progress on ten. Resist the urge to spread effort.

Some of the heaviest are also the cheapest. Multi factor authentication, account management, session lock and audit logging are all high weight and mostly configuration rather than purchase. Firms are often surprised how far the number moves in the first fortnight.

Then the ones that need real work. Media protection, physical access, incident response and system monitoring usually mean process rather than settings, and process takes longer because people have to change what they do.

What to do about the ones you cannot close

You can record a control as a planned item rather than pretending it is done. A plan of action with a realistic date is a legitimate position and it is far better than an inflated score. The purpose of the exercise is an accurate picture, not a flattering one.

The part people skip

Write down your evidence as you go. Not for an assessor, since under the current class deviation nobody is coming until at least November 2028. Write it down because in eighteen months you will not remember which controls you closed, how, or when, and because if the Defense Contract Management Agency does run an assessment, its result overrides your posted score.

The firms that get hurt are not the ones with low scores. They are the ones who cannot explain the score they have.