Decoding SPRS Scoring for Defense Contractors: A Comprehensive Guide

What Is an SPRS Score and Why Does It Matter for Defense Contractors?

The Supplier Performance Risk System (SPRS) is the Department of Defense database that stores, among other things, the summary score from your NIST SP 800-171 assessment. If your company handles Controlled Unclassified Information (CUI) under DFARS 252.204-7012, you are expected to implement the 110 security requirements in NIST SP 800-171 Revision 2. Your SPRS score is the number that tells contracting officers how much of that work is actually done.

That number has real consequences. Under DFARS 252.204-7019, an offeror that is required to implement NIST SP 800-171 must have a current assessment posted in SPRS to be considered for award. An inaccurate score can also create legal exposure. Understanding how the score is calculated, where it is posted, and how it relates to CMMC is the first step to managing it well. Explore more DoD contractor resources here.

How Is an SPRS Score Calculated?

The score comes from the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1. The math is simple, even if the work behind it is not:

• You start at 110. That is one point for each of the 110 requirements in NIST SP 800-171 Rev 2. A score of 110 means every requirement is fully implemented.
• Each unimplemented requirement subtracts 5, 3, or 1 points. Requirements whose absence could lead to significant exploitation of the network or exfiltration of CUI, such as limiting system access to authorized users (3.1.1), are worth 5 points. Requirements with a more specific and confined effect, such as limiting access to CUI on system media (3.8.2), are worth 3. The rest are worth 1.
• There is no partial credit, with two exceptions. Multifactor authentication (3.5.3) costs 3 points if it covers only remote and privileged users and 5 if it covers no one. Encryption of CUI (3.13.11) costs 3 points if encryption is used but is not FIPS validated and 5 if there is no encryption at all.
• A plan of action does not restore points. The methodology is explicit: a requirement that is not fully implemented is scored as not implemented, whether or not a plan of action is in place. If your MFA rollout is 75 percent complete, it still counts as missing.
• The score can go negative. Because the weights add up to more than 110, a company that has implemented nothing would land at -203, the lowest possible score.

You also need a system security plan (3.12.4) for each covered system. Without one, the methodology says an assessment cannot be completed at all.

How Do You Post Your Score in SPRS?

SPRS stores results; it does not perform the assessment. You conduct the assessment against your system security plan first, then enter the summary score. Access runs through the Procurement Integrated Enterprise Environment (PIEE). According to the SPRS program office, a person at your company needs the "SPRS Cyber Vendor User" role in PIEE to enter or edit Basic self-assessment results, and that role is approved by your company's Contractor Account Administrator.

Each entry includes the assessment date, the score, the scope and CAGE codes covered, your system security plan details, and the date you expect to reach 110. Summary scores are visible to DoD personnel, and a score turns stale once the assessment date is more than three years old.

What Do DFARS 252.204-7019 and 252.204-7020 Require?

Two DFARS rules drive SPRS reporting:

• DFARS 252.204-7019 is a solicitation provision. To be considered for award, an offeror required to implement NIST SP 800-171 must have a current assessment, meaning not more than three years old unless the solicitation sets a shorter period, posted in SPRS for each covered contractor information system relevant to the offer.
• DFARS 252.204-7020 is a contract clause. It requires you to give the government access to your facilities, systems, and personnel if DoD decides to conduct a Medium or High assessment. It also must be flowed down to subcontractors, and a prime may not award a covered subcontract unless the subcontractor has completed at least a Basic assessment within the last three years.

Basic, Medium, and High Assessments: What Is the Difference?

The methodology defines three assessment levels, and each produces a different confidence level in the score:

• Basic Assessment. Your own self-assessment, based on a review of your system security plan. Because it is self-generated, it carries a confidence level of "Low."
• Medium Assessment. Conducted by the government. It includes a review of your Basic Assessment, a thorough document review, and discussions with your team. It results in "Medium" confidence.
• High Assessment. Also conducted by the government, typically by DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). It adds verification and demonstration that requirements are implemented as described in your plan, and it results in "High" confidence.

Vendors can only enter and maintain Basic results. Medium and High scores are posted by DoD after you have had a chance to review and rebut the findings.

Is There a Passing SPRS Score?

No. There is no official passing SPRS score. The methodology does not set a minimum, and a contracting officer may weigh your score along with everything else in your proposal. The goal is an honest score backed by a real system security plan and real plans of action, with a credible date for reaching 110.

Accuracy matters more than a high number. The Department of Justice pursues inaccurate cybersecurity representations under the False Claims Act. In March 2025, MORSECORP agreed to pay $4.6 million to resolve allegations that included submitting an SPRS score of 104 when a consultant later calculated its actual score at -142. If your score changes, update it.

How Does SPRS Relate to CMMC?

SPRS reporting under 7019 and 7020 and the Cybersecurity Maturity Model Certification (CMMC) program are related but separate. Both build on NIST SP 800-171, and CMMC results are also recorded in SPRS, but your NIST SP 800-171 DoD Assessment score is a distinct requirement with its own clauses.

• The CMMC program rule, 32 CFR Part 170, took effect December 16, 2024.
• The DFARS CMMC rule took effect November 10, 2025, which started Phase 1. Phase 1 allows solicitations to require CMMC Level 1 or Level 2 self-assessments.
• Phase 2 is suspended. On July 13, 2026, the Department of War announced the immediate suspension of the CMMC Phase II requirements that were scheduled for November 10, 2026, along with pending and future CMMC milestones, while a CMMC Reform Task Force reviews the program. All Phase I self-assessment requirements remain in place, and the Department says it will enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. Check the DoD CIO CMMC page for the latest status.

One common misunderstanding is worth clearing up. A CMMC Third-Party Assessment Organization (C3PAO) conducts CMMC Level 2 certification assessments. It does not "validate" SPRS scores. Your Basic score is your own self-assessment, and Medium and High assessments are conducted by the government.

What Steps Can You Take to Improve Your SPRS Score?

• Start with an honest self-assessment. Score every requirement against the DoD Assessment Methodology and your system security plan. NorthStar can help you prepare. Explore our DoD and CMMC services.
• Fix the 5-point items first. Access control, MFA, FIPS-validated encryption, audit logging, and boundary protection carry the most weight and the most risk.
• Keep plans of action current. They will not restore points, but a missing plan of action is itself scored as an unimplemented requirement (3.12.2).
• Update SPRS when your score changes. Do not wait for a contract cycle. Reassess at least every three years, and sooner after significant changes.
• Check your posture regularly. Run a security check to see where your environment stands today.

For a look at what ongoing IT support for defense contractors includes and costs, see our guide to managed IT for DoD contractors.

Wrapping Up: Getting Your SPRS Score Right

Your SPRS score is a snapshot of how much of NIST SP 800-171 you have actually implemented, and DoD uses it at award time. Get the math right, post it through PIEE, keep it current, and treat accuracy as a legal obligation rather than a marketing number. With CMMC Phase 2 suspended, self-assessments and SPRS scores carry even more weight. If you want help building a defensible score and a realistic path to 110, visit our DoD and CMMC compliance page.