How to Calculate Your SPRS Score Honestly

How do you calculate an SPRS score?

Start at 110, subtract the point value of every NIST SP 800-171 Rev 2 requirement you have not met, and post the result in the Supplier Performance Risk System. Each requirement is worth 1, 3 or 5 points, per the DoD Assessment Methodology and 32 CFR 170.24, so the lowest possible score is negative 203 according to the same DoD methodology.

That is the whole formula. The difficulty is in the word "met".

The weights

Weight	What it covers	Examples
5 points	Requirements that, if missing, "could lead to significant exploitation of the network, or exfiltration of CUI"	Access control basics (3.1.1, 3.1.2), MFA (3.5.3), audit logging (3.3.1), incident handling (3.6.1), malicious code protection (3.14.2)
3 points	Requirements with "a specific and confined effect on the security of the network and its data"	Audit record review (3.3.2), media protection (3.8.1, 3.8.2), risk assessment (3.11.1)
1 point	Remaining derived requirements with "a limited or indirect effect"	Most of the rest

The quoted phrases are from 32 CFR 170.24. Two requirements carry partial credit. MFA (3.5.3) costs 3 points if it covers only remote and privileged users and 5 if nobody has it. Encryption of CUI (3.13.11) costs 3 points if you encrypt without FIPS-validated modules and 5 if you do not encrypt at all. Nothing else is partial.

The method, step by step

1. Fix the boundary. The score covers the systems that store, process or transmit CUI, as described in your system security plan. No SSP means no score; the rule says an assessment "could not be completed" without one.
2. Take each of the 110 requirements and its assessment objectives from NIST SP 800-171A. A requirement with six objectives is Met only if all six are satisfied by final, approved evidence. Drafts do not count, per 170.24.
3. Mark each requirement Met, Not Met or N/A. N/A is allowed only where the requirement truly does not apply, and the SSP must say why.
4. Subtract the weight of every Not Met requirement from 110.
5. Record the assessment date and the date you expect every POA&M item to be closed. SPRS asks for both.
6. Have a senior official affirm it.

A worked example. A 30-person supplier has MFA for admins and VPN but not for everyday logins (3 points), no FIPS-validated encryption on CUI laptops (3 points), no audit log review (3 points), no incident response plan (5 points) and eleven one-point gaps. The score is 110 minus 25, which is 85, whatever the last vendor's sales deck said.

What 7019 and 7020 require

DFARS 252.204-7019 is the notice clause: a current score, not more than three years old, must be in SPRS before award of any contract that carries it. DFARS 252.204-7020 is the operating clause: the Department may conduct its own Medium or High assessment of your environment, you must give DCMA's assessors access, and the arrangement flows down to any subcontractor that handles CUI.

Read together: you post a Basic (self) score, and the government reserves the right to check it with the same 110 requirements and the same weights.

Why rounding up is a legal problem, not a shortcut

An SPRS score is a statement to the federal government made to win federal money. The Department of Justice's Civil Cyber-Fraud Initiative, announced on 6 October 2021, says in plain terms that it will use the False Claims Act against contractors that "knowingly provide deficient cybersecurity products or services, knowingly misrepresent their cybersecurity practices or protocols, or knowingly violate obligations to monitor and report cybersecurity incidents and breaches".

A score of 110 with an SSP that describes controls nobody turned on is a misrepresentation. So is a score that marks a requirement Met because a policy exists while the setting it describes does not. The False Claims Act has a whistleblower provision, and the person most likely to use it is the systems administrator who knows the score is inflated.

An honest 85 posted today with a dated POA&M is a stronger position than a 110 you cannot defend. Primes read SPRS. So does DCMA.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

The pause makes the score more important, because for now it is the only number the government sees. Why you are not paying a C3PAO yet explains the mechanics, and what can stay open on a POA&M covers which gaps the rule lets you carry. Our NIST SP 800-171 self-assessment guide walks through the objectives.

Where AccuSights fits

We assess the 110 requirements at the objective level, write the SSP and the POA&M, and hand you a score worksheet you can defend, with a named engineer rather than a ticket queue and a fixed fee in writing within 24 hours of the intake form. We are not a C3PAO. Start on the CMMC framework page, read the NIST SP 800-171 page, or book a free Risk Diagnosis and we will tell you what your real number is.