How to Submit Your SPRS Self-Assessment in PIEE: From Evidence to Posted Score

An SPRS self-assessment is the score your company gives itself against the 110 security requirements in NIST SP 800-171, posted in the Supplier Performance Risk System so the Department of Defense can see it. If you want to work with the DoD, that number follows every bid.

This post is about getting the score done and posted correctly: the evidence, the scoring, the PIEE account and the SPRS entry. For the scoring method in depth, read our SPRS score guide and how to calculate your SPRS score honestly.

What the SPRS self-assessment measures

SPRS stands for Supplier Performance Risk System. The DoD uses it to check whether the companies it hires protect sensitive information. Your self-assessment covers the 110 requirements in NIST SP 800-171, grouped into 14 families such as Access Control, Audit and Accountability and Incident Response.

The score runs from -203 to 110. A score of 110 means you meet every requirement.

How the SPRS score is calculated

The DoD Assessment Methodology does not add points. It takes them away:

• Start at 110.
• For each requirement you do not meet, subtract its weight: 5, 3 or 1 point. The weights follow how much damage the gap could do. Missing multi-factor authentication, for example, costs 5 points, or 3 if it is only partly in place.
• A requirement that does not apply to you, with the reason written down, does not reduce the score.

The worst case is -203. Most companies land somewhere in between, and a weighted score drops fast: ten unmet 5-point requirements take you from 110 to 60.

One requirement is different. If you have no system security plan (3.12.4), you cannot complete the assessment at all. Write the SSP first.

Step 1: Gather your evidence

You cannot sit down and guess your answers. The DoD or a prime can ask for proof of any requirement you marked as met, so collect it before you score:

• A written security policy that sets your rules for keeping data safe.
• An incident response plan for what to do if there is an attack or a data breach.
• Access records that show who can reach your systems and sensitive files.
• Encryption settings that show data is protected at rest and in transit.
• Training records that show your staff were trained on security basics.
• Password and MFA settings from your identity provider.

If you have an IT person or provider, ask them for the system settings. Don't worry if you don't have everything yet. The point is to see what you already have.

Step 2: Score all 110 requirements

Work one family at a time instead of all 110 in one sitting. For each requirement, ask three questions:

1. Do I have a policy for this? Is there a written rule that tells people how to handle it?
2. Do I have a technical control in place? A setting, a tool or a configuration that makes it happen?
3. Can I prove it? Logs, documents or settings you could show someone who asked?

If the answer to all three is yes, the requirement is met. If any answer is no, it is not met, and its weight comes off the score. That is not a failure. It is information.

The most important rule is to be honest. It is tempting to mark something as met because you probably do it. If you cannot find the proof, don't take the credit. A true score, even a low one, is worth more than a high score you cannot defend. A false score can cost you contracts, and the DoD has used the False Claims Act against contractors who misrepresented their cybersecurity.

Our post on why an honest 60 beats a fake 110 goes deeper on this.

Step 3: Write the plan of action (POA&M)

A Plan of Action and Milestones, or POA&M, lists every requirement you did not meet. For each one, write down:

1. What you will do to fix it. For example, "Write and approve an incident response plan."
2. When you will finish it. Set a realistic date.

A spreadsheet is fine. Keep it updated as you close items. The latest date on it becomes your plan of completion date in SPRS.

Start with the gaps that cost the most points: the 5-point requirements. Multi-factor authentication, incident response and security awareness training are common gaps in small companies and worth checking first.

Step 4: Get PIEE access with the right role

You post the score in SPRS, which you reach through PIEE, the Procurement Integrated Enterprise Environment. It is free, but approval can take days, so start early.

1. Go to the PIEE site and register as a vendor.
2. You will need your company's CAGE code, the five-character ID for your business location. If you don't have one, you get it through your registration in SAM.gov, which also issues your Unique Entity ID (UEI). The DUNS number is no longer used.
3. Request the SPRS Cyber Vendor User role for your CAGE code. Your company's Electronic Business Point of Contact (EB POC) in SAM has to approve it.

Step 5: Enter the score in SPRS

Log in to PIEE, open the SPRS application, and go to the NIST SP 800-171 assessment entry. SPRS asks for a summary, not your worksheet:

• Assessment date: the day you finished the assessment.
• Score: your final number.
• Scope: whether the score covers the whole enterprise, an enclave or specific contracts, and the CAGE codes it covers.
• System security plan: its name, version and date.
• Plan of completion date: when you expect to meet every requirement, if you scored below 110.

Before you save, check that the score matches your worksheet and that the SSP details match the document you assessed against. Then confirm the entry shows in SPRS.

Keep the worksheet, the SSP, the POA&M and the evidence on file. They are what you hand over if anyone asks how you got the number.

Common SPRS self-assessment mistakes

Scoring with +1 and -1

Some worksheets online count each requirement as one point either way. That is not the DoD method. Use the weighted method in the DoD Assessment Methodology, or your score will be wrong in both directions.

Being too optimistic

"We probably do that" is not evidence. If you are not sure you meet a requirement, mark it not met and put it on the POA&M.

Letting the score go stale

DFARS 252.204-7019 requires a current assessment, no more than three years old, for covered contracts. Under CMMC Level 2 self-assessment, an affirming official also affirms compliance in SPRS every year. Set a calendar reminder, and update the score whenever you close enough POA&M items to move it.

Getting help

You do not have to do this alone. Some companies use compliance software to track evidence and deadlines. Others bring in a consultant to run the assessment with them. The DoD's SPRS site has user guides for the entry screens.

How AccuSights helps

Our CMMC Self-Assessment and SPRS Score package is a guided self-assessment of all 110 NIST SP 800-171 controls with one of our engineers, using the DoD weights correctly, with the quick wins that move the score most and a number you can post in SPRS and defend to a prime.

If you are working toward Level 2, the CMMC Level 2 Gap Readiness package and the CMMC Accelerator take it from score to certification. The CMMC checklist and NIST SP 800-171 guide are free. Not sure where you stand? Take the Cyber Hygiene Test or book 30 minutes with an engineer.

Questions people ask

What is an SPRS self-assessment? A score your company gives itself against the 110 requirements in NIST SP 800-171, using the DoD Assessment Methodology, posted in SPRS.

How is the SPRS score calculated? Start at 110 and subtract 5, 3 or 1 point for each requirement you do not meet. The lowest possible score is -203.

Do I upload my score sheet to SPRS? No. SPRS takes the summary: date, score, scope, CAGE codes, SSP details and a plan of completion date. Keep the worksheet and evidence on file.

How often do I have to redo my SPRS self-assessment? DFARS 252.204-7019 requires an assessment no more than three years old. Under CMMC Level 2 self-assessment, an affirming official also affirms compliance in SPRS every year.