You have a Department of Defense contract, or you want one. Someone mentions your SPRS score. Now you’re wondering what it is, what number you need, and who is going to look at it.
Here’s the short version. An SPRS score is a number between -203 and 110. It shows how many of the 110 security requirements in NIST SP 800-171 you’ve put in place. 110 means all of them. The lower you go, the more gaps you have. And contracting officers can see it.
This guide walks through what the score is, how it’s calculated, which number you need, and how to submit it.
TL;DR
- An SPRS score comes from a self-assessment against the 110 requirements in NIST SP 800-171. It starts at 110 and loses points for each unmet requirement.
- The lowest possible score is -203. A score of 110 means everything is implemented.
- For Conditional CMMC Level 2 status, you need at least 88 (80% of 110), and the open items must be eligible for a POA&M.
- Your assessment must be posted in SPRS and be no more than 3 years old for each covered system tied to a contract award.
- Submit through PIEE. Treat the score as a record you can defend, not a number you guess.
Table of Contents
- What an SPRS score is
- The requirement: a current assessment in SPRS
- How the score is calculated
- What score do you need?
- The three assessment levels
- SPRS score versus CMMC
- How to submit or update your score
- Perspective: where we see small contractors get stuck
- How to raise your score without guessing
- Getting help with your SPRS score
- FAQ
- Sources
What an SPRS score is
SPRS stands for Supplier Performance Risk System. It’s the DoD’s system for supplier information. DoD Instruction 5000.79 designates SPRS as the authoritative source for acquisition professionals to retrieve supplier and product assessment information. SPRS also tracks price risk and item risk, not just cyber performance.
For most small businesses, the part that matters is the cybersecurity assessment. That’s the SPRS score.
The score reflects how well you protect Controlled Unclassified Information (CUI). That’s sensitive government information that isn’t classified, like technical drawings, specifications, or export-controlled data. If you handle it, you need to protect it with NIST SP 800-171.
One detail trips people up. Scores are tied to systems, not just companies. Guidance from Johns Hopkins APL notes that scores must be maintained for each separate enterprise or enclave that handles CUI tied to contract performance. If you keep CUI in one corner of your network, that’s the part being scored.
Who needs one
Any prime or subcontractor whose contract involves CUI on its own systems. DFARS 252.204-7019 requires contractor self-assessments to be submitted to SPRS. And the flow-down matters. If you’re a subcontractor, your prime will ask for your status too.
Not sure whether you handle CUI? Check your contract and ask your contracting officer or prime. Don’t assume. Our guide to CMMC Level 2 scope shows how to figure out what’s in and what’s out.
The requirement: a current assessment in SPRS
The rule itself is simple. Under DFARS 252.204-7020, a contractor needs an assessment no more than 3 years old posted in SPRS for each covered contractor information system relevant to a contract award.
That’s the baseline. A few things sit on top of it.
The number has to be honest. A self-assessment is a statement you make to the government. Inflating it is a serious problem, not a rounding choice.
The date matters. Three years is the outer limit. If your environment changes a lot, an old score tells the reader very little.
CMMC raises the stakes. The CMMC rule in the DFARS took effect on November 10, 2025, and phase one began then. Contractors must keep current self-assessment results in SPRS, plus an annual affirmation of continuous compliance. Contracting officers are expected to check SPRS before award. The phases roll out over time, so check each solicitation for the level it requires.
Want the bigger picture? Our CMMC 2.0 timeline and CMMC levels guide cover what applies to you.
How the score is calculated
The math is easy. The honest assessment is the hard part.
The DoD Assessment Methodology says the SPRS score comes from a self-assessment of the 110 requirements in NIST SP 800-171. You start at 110. Then you subtract points for every requirement that isn’t fully implemented.
Not every miss costs the same. Per the methodology, some requirements are worth 5 points, some 3, and the rest 1 if they’re unmet.
| Weight if unmet | What it tends to cover |
|---|---|
| 5 points | Foundational controls with the broadest impact, such as multifactor authentication and encryption of CUI |
| 3 points | Important controls that support the foundation, such as logging, monitoring and incident handling pieces |
| 1 point | Lower-impact controls, often process or documentation items |
The exact weight for each requirement is listed in the methodology. Use that document as your scoring sheet, not a summary from a blog, including this one.
The range
The top score is 110. The floor is -203, which means none of the NIST SP 800-171 requirements are met. Yes, scores go negative. A negative score isn’t unusual for a small shop that has never done this work. It’s a starting point.
A worked example
Say you review your environment and find three gaps. You don’t enforce multifactor authentication for all users (5 points). Your log review isn’t happening on a schedule (3 points). One policy hasn’t been written down (1 point).
Your score is 110 minus 9, so 101. Simple. But notice what that shows. The big loss came from one missing control that a decent managed security setup could close in weeks.
This is also why weights matter when you plan. Fixing one 5-point item beats fixing five 1-point items.
What score do you need?
The honest answer: it depends on what the contract and CMMC level require. But there are clear markers.
110. All requirements implemented. This is the target. It’s what full compliance looks like.
88 or higher. This is the practical threshold for Conditional CMMC Level 2 status. AWS guidance explains that a score of 88 or higher with all unmet items on eligible POA&Ms can achieve Conditional status. The federal rule frames it as a score-to-total-requirements ratio of at least 0.8, and 0.8 of 110 is 88.
Below 88. You don’t qualify for conditional status. You have remediation work to do before an assessment, not after.
POA&Ms: what they can and can’t do
A Plan of Action and Milestones lists your open gaps and how you’ll close them. It’s not a free pass.
According to 32 CFR 170.21, a POA&M is not permitted for CMMC Level 1 assessments. For Level 2 it may be used only when specific conditions are met. Not every requirement is eligible. The rule limits which ones can sit on a POA&M, so a low score made of the wrong gaps can still block you.
The clock matters too. A POA&M closeout assessment must be completed within 180 days of the Conditional status date, or the status expires. Conditional means temporary.
For a deeper look at how plans and conditional status fit into a longer path, see this CMMC versus ISO 27001 roadmap. And our own page on NIST 800-171 controls, SSP, POA&M and SPRS walks through the documents you’ll keep.
The three assessment levels
Not all scores carry the same weight with the government. The methodology defines three levels:
- Basic: your own self-assessment. Lowest confidence.
- Medium: DoD personnel review your system security plan and how you implemented the controls.
- High: a thorough government verification.
Each step gives more confidence in what you’ve actually done. Most small contractors start at Basic. But a Basic score still needs evidence behind it, because it can be checked later.
SPRS score versus CMMC
People mix these up. They’re related, but they’re not the same thing.
Your SPRS score is a record of your NIST SP 800-171 status. CMMC is the program that verifies it. Depending on the level and contract, that means a self-assessment or a third-party assessment, plus affirmations. The score you post feeds the CMMC status the contracting officer sees.
Think of the SPRS score as the number on the scoreboard. CMMC is the referee.
If you want to sort out which level applies to you, start with our overview of CMMC, then the levels breakdown.
How to submit or update your score
You have two paths, per the SPRS guidance from JHU APL. Enter it in PIEE by selecting the SPRS icon, or email the score to the Navy SPRS help desk with the required details. Most companies use PIEE.
Here’s the order that works:
- Confirm your scope. Decide which systems handle CUI.
- Write or update your system security plan. Your score should match what the plan says.
- Score each requirement using the DoD Assessment Methodology.
- Record your gaps in a POA&M, with owners and dates.
- Get PIEE access for your company, with the right role.
- Post the score, the date of the assessment, and the date you expect to reach 110.
- Set a reminder to refresh it when your environment changes and before it ages out.
Don’t treat step 6 as the finish line. A posted score with no plan behind it is a risk.
Perspective: where we see small contractors get stuck
We work with small and mid-sized businesses that want to do defense work without hiring a full security department. A few patterns come up again and again.
First, people treat the SPRS score like paperwork. It isn’t. It’s a claim, and claims get tested. When a company scores itself by gut feel, the number falls apart the first time someone asks for evidence.
Second, the gaps are rarely exotic. They’re usually the basics: multifactor authentication not turned on everywhere, logs nobody reads, access that nobody has reviewed in a year. That’s why we build security into managed services instead of bolting it on later. A team of senior security people, not just IT generalists, sees these gaps early.
Third, scope is the lever. Shrinking the number of systems that touch CUI can cut cost and effort more than any single control. Ask the scope question first.
Fourth, don’t wait for the contract. Fixing things after an award notice is stressful and expensive. Doing it as a steady program is calmer.
If your score is lower than you hoped, that’s normal. It means you now know where to start.
— Alden
How to raise your score without guessing
Start with the biggest point values. A short plan beats a long one.
- Turn on multifactor authentication everywhere it’s required. This is one of the heaviest items.
- Encrypt CUI at rest and in transit.
- Centralize logs and review them on a schedule.
- Limit access. Give people only what they need. Our least privilege playbook shows how.
- Write it down. Policies and your system security plan should describe what you really do.
- Test your defenses. A vulnerability analysis finds weak spots before an assessor does.
- Train your people. Cyber awareness training closes the human gaps.
Recheck your score after each round. You’ll see it climb.
And keep the rest of your risk picture in mind. Our piece on government contractor cybersecurity covers the wider context for small business owners.
Getting help with your SPRS score
Most small contractors don’t have a compliance team. That’s fine. You can still get this done.
Our policy compliance work helps with the documents and the scoring. Managed cybersecurity services cover the day-to-day controls, such as monitoring and incident response, that keep the score true after you post it. We’re veteran-owned, with U.S.-based 24/7 support. Compliance readiness is part of how we operate, not an add-on.
Ready to find out where you stand? Talk to our team and we’ll help you get an honest number and a plan to improve it.
FAQ
What is the lowest SPRS score?
The lowest possible score is -203. It means none of the 110 NIST SP 800-171 requirements are implemented. Few real businesses sit at the very bottom, but negative scores are common for companies starting from scratch.
Is 110 the only acceptable SPRS score?
No, but it’s the goal. 110 means every requirement is met. For Conditional CMMC Level 2 status you need at least 88, and the open items must be eligible for a POA&M. Conditional status expires if you don’t close out within 180 days.
How do I access SPRS?
You enter your assessment through PIEE by selecting the SPRS icon. You can also email your score to the Navy SPRS contact with the required details. Your company will need the right PIEE role set up first.
How often do I need to update my score?
An assessment posted in SPRS can be no more than 3 years old for contract awards under DFARS 252.204-7020. Under the CMMC rule, you also keep self-assessment results current and affirm compliance annually. Update sooner if your environment changes in a big way.
Does an SPRS score replace CMMC?
No. The score records your NIST SP 800-171 implementation. CMMC is the program that verifies it at the level your contract requires. The two work together.
Sources
- Supplier Performance Risk System (SPRS) Guidance, JHU APL
- NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
- DFARS 252.204-7000 Disclosure of Information
- 32 CFR 170.21 Plan of Action and Milestones
- SPRS scoring and POA&M eligibility, AWS Prescriptive Guidance
- SPRS Frequently Asked Questions
- CMMC Final Rule to Update the DFARS, Sheppard Mullin
- CMMC versus ISO 27001 roadmap, ISMS Calculator