If you handle Controlled Unclassified Information on a Department of Defense contract, you have probably heard you need a "SPRS score" — and you may not be sure what it is, how it's calculated, or why a contracting officer keeps asking for it. The short version: the Supplier Performance Risk System (SPRS) is the DoD database where contractors post the results of their NIST SP 800-171 self-assessment, and under the DFARS, a current score is a precondition to winning covered work. It predates CMMC, runs alongside it, and is not going away.
The Two Clauses Behind the Score
Two DFARS clauses create the obligation, and they work as a pair:
- DFARS 252.204-7019 tells offerors that to be eligible for award on a covered contract, they must have a current NIST SP 800-171 DoD Assessment — generally one performed within the last three years — posted in SPRS. No current score, no award.
- DFARS 252.204-7020 sets out the NIST SP 800-171 DoD Assessment Requirements themselves: it requires contractors to provide the Government access for higher-level assessments, to keep the score current, and to flow the requirement down to subcontractors who will handle CUI.
Together they convert "implement NIST 800-171" (the substance, from DFARS 252.204-7012) into "prove it with a posted, current score" (the gate, from 7019/7020).
How the Number Is Calculated
The DoD Assessment Methodology produces a single score on a scale that tops out at 110 and can fall as low as -203. You start by assuming a perfect score of 110 — one point for each of the 110 requirements in NIST SP 800-171 Revision 2, the version DoD contracts still run on through a standing class deviation. Then, for every control you have *not* fully implemented, you subtract its assigned weight: 5 points for the controls with the greatest security impact, 3 points for moderate ones, and 1 point for the rest. Because the high-impact controls carry the heaviest penalty, a handful of gaps can pull the number well below zero.
A few practical consequences fall out of the math:
- A negative score is normal for companies early in their journey — it simply reflects unimplemented high-weight controls, not failure.
- Not every gap is equal. Closing one 5-point control moves your score more than closing five 1-point controls. Prioritize by weight.
- A POA&M doesn't erase the deduction. Controls on a Plan of Action and Milestones still count against the score until they are actually implemented; the methodology gives credit for *done*, not *planned*.
Three Assessment Levels
DFARS 252.204-7020 recognizes three assessment levels, distinguished by who performs them and how much confidence they carry:
- Basic — a contractor self-assessment using the DoD methodology. This is what most companies post in SPRS, and it is what 7019 requires for eligibility.
- Medium and High — assessments conducted by the Government (the Defense Contract Management Agency's DIBCAC), involving document review and, at the High level, an on-site or thorough examination. These carry more weight and are used for higher-risk programs.
The Basic self-assessment is honest self-reporting — but it is reported *to the Government*, which means an inflated score is not just an internal problem.
Why Accuracy Is Non-Negotiable
Your SPRS score is a representation to the Department of Defense. Posting a number you cannot support is exactly the kind of misstatement the DOJ's Civil Cyber-Fraud Initiative has pursued under the False Claims Act, where contractors have paid multimillion-dollar settlements for misrepresenting their cybersecurity posture. The discipline that protects you is the same discipline that improves the score: assess honestly against all 110 Rev 2 controls, document your evidence, fix the high-weight gaps first, and refresh the score as your environment changes. That work also positions you for CMMC, which verifies the very same controls.
Key Takeaways
- SPRS is where DoD contractors post their NIST 800-171 self-assessment score, and under DFARS 252.204-7019 a current score (generally within three years) is a condition of award on covered contracts.
- The score runs from 110 down to -203: start at 110 and subtract 5, 3, or 1 points per unimplemented control, weighted by security impact. POA&M items still count against you until implemented.
- Basic = self-assessment; Medium/High = government (DIBCAC) assessment. Whichever applies, the score is a representation to DoD — accuracy carries real False Claims Act exposure.
See how SPRS fits the broader standards on Frameworks and the DoD rollout on the Defense industry page, review enforcement risk on Enforcement & Penalties, and confirm what applies to your contracts with Find My Requirements.