What is SPRS?
SPRS is the Supplier Performance Risk System, the DoD application that holds supplier risk data. For cybersecurity it stores two things: the summary of your NIST SP 800-171 assessment and, under CMMC, your CMMC status and the annual affirmation. Contracting officers and prime contractors look you up there before they award work that involves Controlled Unclassified Information (CUI).
You reach SPRS through the PIEE portal with an account tied to your CAGE code. Only a summary is posted: the score, the date, the scope and the date you expect to reach 110. Your System Security Plan (SSP) and evidence stay with you.
Who needs an SPRS score?
Any contractor whose contract includes DFARS 252.204-7012 and who handles covered defense information. DFARS 252.204-7019 tells the contracting officer to check that you have a current assessment, no more than three years old, before award. DFARS 252.204-7020 requires you to flow the same requirement down to subcontractors that handle CUI, and lets DoD run its own Medium or High assessment of you.
Under CMMC the same database records Level 1 and Level 2 self-assessment results. Level 1 results are entered every year; Level 2 results every three years, with an affirmation from a senior official each year in between.
How is the SPRS score calculated?
The DoD Assessment Methodology weights each of the 110 requirements in NIST SP 800-171 Rev 2 by how much damage a gap would cause. You begin at 110 and subtract the weight of every requirement that is not fully met.
| Weight | What it covers | Examples |
|---|---|---|
| 5 points | Gaps that can lead directly to network exploitation or CUI leaving the company | 3.1.1 limit access to authorized users, 3.5.3 multi-factor authentication, 3.13.11 FIPS-validated encryption |
| 3 points | Gaps with a specific, more limited effect on security | Supporting requirements in the same families |
| 1 point | Gaps with an indirect effect | 3.1.9 privacy and security notices |
A requirement is either met or not met; partial implementation counts as not met. The methodology makes two narrow exceptions, for multi-factor authentication and for encryption that is in place but not FIPS-validated, where a smaller deduction applies. A missing SSP is different: without one, the methodology treats the assessment as not complete at all.
Basic, Medium and High assessments
- Basic: your own self-assessment against the methodology. It carries a “low” confidence level in SPRS, and it is the one almost every small supplier posts.
- Medium: DoD reviews your Basic assessment and your SSP, usually remotely.
- High: DoD assessors test your implementation directly, with evidence, demonstrations and interviews.
DoD chooses when to run a Medium or High assessment; you do not apply for one. Any of the three stays current for up to three years.
How to do the SPRS self-assessment
- Scope it. Find every system, person and place that stores, processes or sends CUI. The score only covers the scope you name.
- Write or update the SSP. It describes the boundary and how each requirement is met. It is also requirement 3.12.4.
- Test each requirement. NIST SP 800-171A breaks the 110 requirements into 320 assessment objectives. A requirement is met only when all of its objectives are.
- Score it. Subtract the weights of the unmet requirements from 110.
- Write the POA&M. For every open item: the fix, the owner and a date. The latest date becomes the date you expect to reach 110.
- Post it. In SPRS, enter the assessment date, the score, the SSP it covers, the CAGE codes in scope and the expected completion date.
For a small supplier with contained CUI, the first pass usually takes weeks, not days, because most of the effort is collecting evidence that each objective is met.
How does the SPRS score relate to CMMC Level 2?
CMMC Level 2 assesses the same 110 requirements with the same 1, 3 and 5 point weights, set out in 32 CFR 170.24. A score of 110 earns Final status. A score of at least 88 earns Conditional status, but only if every open item is one the rule allows on a POA&M, and those items must be closed within 180 days.
Phase 1 began on 10 November 2025: self-assessments, DFARS 7012 and SPRS scores are in force. Third-party certification is paused and out of solicitations and contracts for now under a September 2026 class deviation, not cancelled. Either way, a current, accurate SPRS score is what primes ask for today. See the CMMC levels compared for what each level requires.
Mistakes that undermine a score
- Scoring the policy, not the practice. A written policy with no evidence that it runs does not meet the requirement.
- Posting 110 with open POA&M items. Open items are unmet requirements, and they come off the score.
- A scope that does not match the CAGE codes. The SPRS entry names the codes and the SSP; they have to describe the same environment.
- Posting once and forgetting it. A score older than three years is not current, and a score that no longer matches your environment is inaccurate.
Accuracy matters beyond the contract. The Department of Justice’s Civil Cyber-Fraud Initiative has used the False Claims Act against contractors that misrepresented their cybersecurity, and has settled several of those cases.
With AccuSights: we scope the CUI, test the 110 requirements against all 320 objectives, write the SSP and the POA&M, and give you a score you can defend, with the evidence behind each point.