If you sell IT, software, or technical services to the Department of Defense and handle Controlled Unclassified Information, there’s a database deciding whether you’re even eligible for award before a human reads your proposal. It’s called SPRS — the Supplier Performance Risk System — and the single number it holds about your cybersecurity posture can quietly disqualify you. We bid federal IT work every week and maintain our own NIST 800-171 posture, so here’s the honest, jargon-free version: what SPRS is, how the score is built, who has to post one, and how it feeds the new CMMC program. When you’re ready to run your own number, the SPRS score calculator does the math in your browser.
What SPRS Actually Is
A government scoreboard for supplier risk — and one of its columns is your cybersecurity score.
The Supplier Performance Risk System is a Department of Defense application that consolidates supplier performance and risk information into one place that acquisition officials can query. Think of it as the DoD’s standing file on you as a vendor.
SPRS pulls together several risk signals — past performance, delivery, quality, and price risk among them — but for IT and software contractors the column that matters most is your NIST SP 800-171 DoD Assessment score. That score is the government’s shorthand for “how well has this company implemented the cybersecurity controls required to protect Controlled Unclassified Information (CUI)?” When a contracting officer evaluates an offer that involves CUI, they can open SPRS and see whether you have a current, posted score — before your technical approach gets a second look.
How the 110-Point Score Works
You start at a perfect score and lose weighted points for every control you haven’t implemented.
The NIST 800-171 Basic Assessment is a self-assessment scored under the DoD Assessment Methodology against the 110 security requirements in NIST SP 800-171 Revision 2 — the revision the DoD methodology and SPRS scoring still use. The math is deliberately simple, and it runs in one direction — downward.
Every control met
If you fully implement all 110 NIST SP 800-171 security requirements, your score is 110 — the maximum.
Weighted deductions
Each unmet control subtracts a weighted value — 5, 3, or 1 point — based on its impact under the methodology. Higher-impact controls cost more.
No floor at zero
Because deductions stack, a system with many unmet high-value controls can land well below zero. A negative score is real and common for firms early in their compliance journey.
A handful of controls carry the 5-point weight, a middle band carries 3 points, and the remainder carry 1 point — so which controls you’ve missed matters as much as how many. Closing a few high-value gaps moves the number far more than closing many low-value ones. That weighting is precisely what our SPRS calculator models, so you can see where your points are actually leaking.
Who Has to Post a Score
If you touch CUI on a covered DoD contract, the clauses pull you in — primes and subs alike.
The obligation comes from two DFARS clauses. 252.204-7019 tells offerors that, to be considered for award on a covered contract, they must have a current assessment posted in SPRS. 252.204-7020 obligates the contractor to keep that assessment current and to flow the requirement down to subcontractors that will handle CUI.
- DoD prime contractors required to implement NIST SP 800-171 (i.e., contracts carrying the underlying DFARS 252.204-7012 safeguarding clause).
- Subcontractors at any tier that will store, process, or transmit CUI — a prime cannot award covered work to a sub that hasn’t completed at least a Basic Assessment.
- Established firms re-competing whose previously posted score has aged out.
“Current” has a clock on it
A posted assessment is treated as current for a defined window (DFARS sets this at not more than three years, unless a solicitation specifies less). A score that’s gone stale is, for award purposes, no score at all — confirm the exact window in 252.204-7019 and your solicitation.
Self-assessment vs. higher tiers
Most small businesses post a Basic (self) assessment. DoD may also conduct Medium or High assessments — the High tier is run by the DCMA DIBCAC — which carry higher confidence and override your self-score.
How SPRS Connects to CMMC
Same 110 requirements, raised stakes — and the same database holds the result.
SPRS isn’t being replaced by the Cybersecurity Maturity Model Certification — it’s the system of record CMMC plugs into. CMMC Level 2 is built on the identical 110 NIST SP 800-171 requirements that drive your SPRS score, so the work you do for one directly serves the other.
| Dimension | NIST 800-171 / SPRS today | CMMC Level 2 |
|---|---|---|
| Control set | 110 NIST SP 800-171 requirements | Same 110 requirements |
| Who attests | You (Basic self-assessment, “Low” confidence) | Self or a third-party C3PAO, depending on data sensitivity |
| Where results live | SPRS | SPRS (CMMC status is recorded there too) |
In practice, a clean, honest SPRS score is the foundation a CMMC Level 2 assessment is graded against. Firms that treated their Basic Assessment as a paperwork formality — posting an optimistic number with no real System Security Plan behind it — are the ones facing the hardest scramble as CMMC requirements phase into contracts. The fix is the same either way: implement the controls for real, document them, and let the score reflect the truth.