SPRS Score: How the DoD Scores Your NIST 800-171 Work, and How to Calculate Yours

What is an SPRS score?

An SPRS score is the summary number from your NIST SP 800-171 assessment, posted in the DoD’s Supplier Performance Risk System. It tells a contracting officer how much of the 110-requirement standard you’ve actually put in place. A perfect score is 110. Contracting officers check SPRS before award, so a missing or stale score can cost you the contract.

SPRS holds a lot more than cyber scores, but this number is the part that matters to most small defense suppliers. If your contract includes DFARS 252.204-7012, you’re required to implement NIST SP 800-171 on the systems that handle covered defense information. The score is how you prove it. It’s the same 110 requirements that CMMC Level 2 is built on.

How do you calculate an SPRS score?

Start at 110 and subtract points for every requirement that isn’t fully met. Each requirement is worth 1, 3, or 5 points depending on how much damage its absence could do. Partly done counts as not met, except in two places. The rules come from the DoD Assessment Methodology (version 1.2.1) and the CMMC version of the same method in 32 CFR 170.24.

The weights:

• 5 points (42 requirements). These are the ones that, if missing, “could lead to significant exploitation of the network, or exfiltration of CUI.” Examples: limiting system access to authorized users (3.1.1), security training (3.2.1), audit logging (3.3.1), baseline configurations (3.4.1), user identification and authentication (3.5.1, 3.5.2), incident response (3.6.1, 3.6.2), controlling removable media (3.8.7), and malware protection (3.14.2).
• 3 points (14 requirements). These have “a specific and confined effect,” like encrypting CUI on mobile devices (3.1.19) or protecting CUI on media (3.8.2).
• 1 point (the remaining 51). Things like preventing reuse of identifiers (3.5.5) and password complexity (3.5.7).

Then there’s the SSP. Requirement 3.12.4, the system security plan, isn’t scored at all. If you don’t have one, the methodology says “an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012.” No SSP, no score. Our SSP template guide covers what goes in one.

What's the lowest possible SPRS score?

The lowest possible SPRS score is -203. Both the methodology and 170.24 say the subtraction “may result in a negative score.” Neither prints a floor. Add up every deduction in the rule’s own lists, though, and you get 313 points: 42 five-pointers, 14 three-pointers, the two adjustable requirements at their full 5, and 51 one-pointers. 110 minus 313 is -203.

Nobody with a working IT setup scores that low. But a shop with no MFA, no logging, no written plan, and no training can be deep in the negatives without knowing it. The number moves fast because the heavy requirements are the basic ones.

Which requirements get partial credit?

Only two. The 170.24 text says the method credits partial implementation “only in limited cases,” and it names these:

• MFA (3.5.3). If MFA covers remote and privileged users but not everyone else, you lose 3 points. With no MFA for anyone, you lose 5. The methodology also gives an example: an MFA rollout that’s 75% done is still “not implemented.” Partial credit is for the remote-and-privileged split, not for being partway through. We wrote about MFA that holds up against phishing separately.
• FIPS-validated encryption (3.13.11). If you encrypt CUI but the cryptography isn’t FIPS-validated, you lose 3 points. With no encryption, you lose 5. Turning on BitLocker is the easy half. Checking that the module is validated is a separate step. That’s what we cover in our BitLocker rollout report.

Everything else is all or nothing. A plan of action doesn’t earn points either. The methodology says requirements not implemented are “not implemented” whether “a plan of action is in place or not.” If you’re using a POA&M to get a conditional CMMC status, our POA&M guide covers the 88-point floor and the 180-day clock.

What do DFARS 252.204-7019 and 7020 require you to post?

DFARS 252.204-7019 says an offeror needs a “current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation)” in SPRS to be considered for award. DFARS 252.204-7020 defines three assessment levels. A Basic assessment is your own self-assessment. Medium and High are done by the government. It also lists what goes into SPRS for a Basic score:

• The version of NIST SP 800-171 you assessed against.
• Who did the assessment.
• Every CAGE code tied to the system security plan.
• A short description of the architecture, if you have more than one SSP.
• The date you finished the assessment.
• The summary score, “e.g., 95 out of 110,” not the score for each requirement.
• The date you expect to reach 110.

7020 also requires you to give the government access for a Medium or High assessment. You get 14 business days to rebut the findings.

One thing has changed in 2026. Under Class Deviation 2026-O0025, part of the FAR overhaul and effective February 1, 2026, new DoD solicitations use a rewritten DFARS Part 240. The 7020 text now lives on as 252.240-7997, which covers only the government-run Medium and High assessments. 7019 isn’t in the new clause list. For new contracts, your self-assessed score goes into SPRS through the CMMC clause. Older contracts and solicitations can still carry 7019 and 7020, so read the clauses in yours.

How do CMMC Level 2 self-assessments get entered and affirmed?

You enter a CMMC Level 2 self-assessment in SPRS, and then a senior official at your company affirms it. Under 32 CFR 170.16, the entry has to include the CMMC level, status date, assessment scope, CAGE codes, your overall score (“e.g., 105 out of 110”), and POA&M status if you have one. You redo the self-assessment every three years.

The affirmation is separate. Section 170.22 says an Affirming Official, the “senior level representative” responsible for compliance, affirms in SPRS after each assessment, after a POA&M closeout, and every year after that. The affirmation states that you have implemented, and will keep in place, every requirement that applies.

This is still live. The July 13, 2026 memo suspended the Phase 2 move to C3PAO certification. The September 3, 2026 revision of the class deviation still lets programs ask for Level 1 (Self) or Level 2 (Self). The DoD’s 60-day review results weren’t public as of October 2, 2026.

Can a wrong SPRS score get you in legal trouble?

Yes. On October 6, 2021, the Justice Department announced its Civil Cyber-Fraud Initiative. It uses the False Claims Act against contractors “knowingly misrepresenting their cybersecurity practices or protocols.” An SPRS score is that kind of statement.

The clearest example is Georgia Tech. When DOJ joined a whistleblower suit, it alleged that a summary score of 98 reported in December 2020 was false because it covered a “fictitious” or “virtual” environment, not a real system that handled covered defense information. The release notes that a False Claims Act violation carries “three times the government’s losses, plus applicable penalties.” Georgia Tech Research Corporation settled on September 30, 2025. Per DOJ, the claims are allegations only, with no determination of liability.

The lesson isn’t that a low score is dangerous. A low, honest score with a real plan is fine. What gets contractors in trouble is a score that doesn’t match the systems it describes.

Key takeaways

What this looks like when we do it

Limehawk isn’t a C3PAO, an RPO, or an assessor, and we don’t post your score or sign your affirmation. Your Affirming Official does that.

What we do is the IT that makes the number true. We scope the systems that touch CUI, enforce MFA for everyone instead of just admins, roll out encryption and check the validation status, turn on logging, and keep patching and baselines on record. Then we pull the evidence from the same tools that run those controls. Shrinking the scope helps too. Our CMMC enclave guide covers that option. On the plant floor, we document and segment OT instead of pretending it isn’t there. Our manufacturing IT page explains how.

If a prime is asking for your SPRS score and you’re not sure what it really is, our manufacturing IT support team can help you count it. Book a call and we’ll go through it.