Short answer: An SPRS score is the summary score of your NIST SP 800-171 assessment, recorded in DoD’s Supplier Performance Risk System (SPRS). You start at 110, one point for each requirement, and subtract 5, 3, or 1 point for every requirement you haven’t fully implemented. The lowest possible score is −203. For a CMMC Level 2 self-assessment, you need at least 88 to reach Conditional status, with limits on what can stay open, and 110 for Final status.
What is SPRS?
The Supplier Performance Risk System is DoD’s database for supplier risk information. For cybersecurity, it holds your NIST SP 800-171 assessment results and your CMMC status. Contracting officers check it before award, before exercising options, and before extending a period of performance on contracts with CMMC requirements. Primes often ask subcontractors for their score as well.
A score is posted per system security plan (the environment you assessed) and tied to the CAGE codes it covers.
How is the score calculated?
The scoring rules come from DoD’s NIST SP 800-171 DoD Assessment Methodology (Version 1.2.1). For CMMC, they’re codified at 32 CFR 170.24. The weights match:
- Start at 110. If every requirement is implemented, your score is 110.
- Subtract for every requirement not fully implemented, based on its weight:
| Weight | Which requirements | Why |
|---|---|---|
| 5 points | Most “basic” requirements and high-impact derived requirements, such as limiting system access to authorized users (3.1.1), controlling removable media (3.8.7), and incident handling (3.6.1, 3.6.2) | Not implementing them could lead to significant exploitation of the network or exfiltration of CUI |
| 3 points | Requirements with a specific, confined effect, such as protecting CUI on system media (3.8.2) or encrypting CUI on mobile devices (3.1.19) | Puts some CUI at risk, but not the whole network |
| 1 point | All remaining derived requirements, such as preventing reuse of identifiers (3.5.5) | Limited or indirect effect |
- Apply the two partial-credit rules:
- Multi-factor authentication (3.5.3): subtract 3 if MFA covers only remote and privileged users; subtract 5 if no users have MFA.
- FIPS-validated encryption (3.13.11): subtract 3 if you encrypt CUI but not with FIPS-validated cryptography; subtract 5 if you don’t encrypt it.
There’s no partial credit otherwise. A requirement that’s 75% done counts as not implemented, even if you have a plan of action for it.
You must have a System Security Plan (3.12.4). It carries no point value, but without one the assessment can’t be completed. See SSP & POA&M.
Because so many requirements are weighted 5 points, scores fall quickly. Missing just ten high-weight requirements drops you from 110 to 60, and an organization with nothing in place lands at −203.
A worked example
A 40-person machine shop assesses its CUI environment and finds these gaps:
| Requirement not met | Deduction |
|---|---|
| MFA only for remote and admin accounts (3.5.3) | −3 |
| No audit log review process (3.3.5) | −5 |
| No security awareness training on insider threats (3.2.3) | −1 |
| CUI encrypted, but not with FIPS-validated cryptography (3.13.11) | −3 |
| No session lock after inactivity (3.1.10) | −1 |
| Score | 110 − 13 = 97 |
At 97, the shop clears the 88-point threshold. But for CMMC Conditional status, every open item must also be one that’s allowed on a POA&M. Here, 3.3.5 (5 points) and the partial MFA gap on 3.5.3 (3 points) aren’t eligible, so both must be fixed first. The two 1-point items and 3.13.11, the one stated exception at 3 points, can stay on the POA&M.
What score do you need?
| Situation | What’s required |
|---|---|
| CMMC Level 2 (Self), Conditional | At least 88 (80% of 110). Only 1-point requirements, plus 3.13.11 when encryption isn’t FIPS-validated, can remain open, and a few requirements can never be left open: 3.1.20, 3.1.22, 3.10.3–3.10.5, and 3.12.4. Close them within 180 days or Conditional status expires. |
| CMMC Level 2 (Self), Final | 110: everything met, either at assessment or after a POA&M closeout. |
| Contracts with DFARS 252.204-7019 / 7020 (mostly older awards) | A current Basic Assessment score, no more than 3 years old, posted in SPRS. No minimum score is set, but the score must be accurate. |
| DoD Medium or High assessment | DoD assesses you (now under DFARS 252.240-7997) and posts the score. DCMA results take precedence over your self-assessment. |
The CMMC Level 2 self-assessment is repeated every three years, with an annual affirmation by a senior official in SPRS.
Where is an SPRS score still required?
The rules shifted in 2026, so check your actual contracts:
- DFARS 252.204-7012 still requires you to implement NIST SP 800-171 Rev. 2. That obligation hasn’t changed. See DFARS 252.204-7012 Explained.
- CMMC Level 1 and Level 2 self-assessments can still be required in contracts, and their results are entered in SPRS. The CMMC Phase II suspension paused mandatory third-party certification, not self-assessments.
- Under DoD’s FAR overhaul class deviations, effective February 1, 2026, the standalone requirement to post a Basic self-assessment score (DFARS 252.204-7019 and 7020) no longer appears in new solicitations. Contracts awarded earlier may still contain those clauses until modified.
- Primes frequently ask for your score regardless of which clauses apply.
How to calculate your SPRS score
- Define the scope. Identify every system, person, and location that touches CUI. See What Is CUI?
- Assess all 110 requirements using the assessment objectives in NIST SP 800-171A. Mark each one met or not met, honestly.
- Apply the weights and partial-credit rules above.
- Document it. Update your System Security Plan and write a POA&M for every gap.
- Post it in SPRS (through PIEE) where your contract requires, with the assessment date, scope, and CAGE codes.
- Re-assess when your environment changes, and on the required cycle.
Frequently Asked Questions
Can my SPRS score be negative?
Yes. Because many requirements are worth 3 or 5 points, deductions can exceed 110. The lowest possible score is −203.
Is a low SPRS score a problem if it’s accurate?
An honest low score is far better than an inflated one. Misrepresenting your compliance, including an inaccurate score or affirmation, carries contractual and False Claims Act risk. But a low score can cost you work: CMMC Level 2 Conditional status needs at least 88, and primes may screen out low scorers.
Does a plan of action (POA&M) raise my score?
No. A requirement with an open plan of action still counts as not implemented until it’s fully done. A POA&M is what lets you hold Conditional CMMC status while you close eligible gaps within 180 days.
How long is an SPRS score valid?
Under DFARS 252.204-7019 and 7020, a Basic Assessment had to be no more than three years old. CMMC Level 2 self-assessments are also repeated every three years, with an annual affirmation in between. Update your score sooner if your environment or implementation changes significantly.
How USCIBER can help
USCIBER calculates a defensible NIST SP 800-171 score as part of a CMMC Readiness Review (from $7,500): every requirement assessed against NIST SP 800-171A, scored with DoD’s weights, and turned into a prioritized remediation plan. We then help you document it in a System Security Plan and POA&M. Learn more about our NIST 800-171 & DFARS compliance work, or compare CMMC Level 1 vs. Level 2.
Sources
- DoD — NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
- 32 CFR Part 170 — § 170.16 (Level 2 self-assessment), § 170.21 (POA&M), § 170.24 (scoring)
- acquisition.gov — DFARS 252.204-7019 and DFARS 252.204-7020
- DoD (DPCAP) — Class Deviation 2026-O0025, Revision 3: DFARS Part 240
- NIST — SP 800-171 Rev. 2 and SP 800-171A
- Supplier Performance Risk System (SPRS)
This article is general information, not legal advice.