Last reviewed October 13, 2026.
Your SPRS score is the number DoD sees when it looks up your cybersecurity posture. It is calculated from NIST SP 800-171 using the DoD Assessment Methodology, and it must reflect what you have actually implemented. This guide explains how the score works and how to calculate it.
Estimate your score now. Use the free SPRS score calculator to tick the requirements you have implemented and see your score, the 88-point minimum check and your biggest gaps. Nothing you enter leaves your browser.
What SPRS is
The Supplier Performance Risk System (SPRS) is the DoD application where contractors post the results of their NIST SP 800-171 assessments. Contracting officers can use the score when evaluating offers. The score ranges from 110 down to -203.
How the score works
A perfect score is 110, one point for each of the 110 requirements in NIST SP 800-171 Rev. 2. For every requirement that is not fully implemented, you subtract its weight under the DoD Assessment Methodology. Each requirement carries a weight of 1, 3 or 5 points, based on how much it affects the security of the system. The lowest possible score is -203.
How to calculate it
- Define the scope. Identify the systems that store, process or transmit CUI, and the assets that protect them.
- Write or update the system security plan (SSP). The SSP describes how each requirement is met and is the basis of the assessment.
- Assess all 110 requirements. For each one, check the objectives in NIST SP 800-171A against the real environment. Mark it met or not met.
- Subtract the weights. Start at 110 and subtract the point value for every requirement that is not met.
- Document the gaps. Record each unmet requirement in a plan of action and milestones with an owner and a date.
- Submit to SPRS. Post the score with the assessment date, the scope and your CAGE code, and keep it current. Assessments are expected to be no more than three years old.
Common scoring mistakes
- Scoring policy instead of practice. A written policy is not an implemented control. Score what is running today.
- Scoping too narrowly. Leaving out systems that touch CUI produces a score you cannot defend.
- Treating partial as complete. If multi-factor authentication covers most accounts but not all, the requirement is not met.
- Letting the score go stale. Major changes to your environment or fixes to your gaps should lead to a reassessment and an updated score.
- Rounding up. Overstating a score creates legal risk. The Department of Justice has used the False Claims Act against contractors that knowingly misrepresented their cybersecurity compliance.
How the SPRS score connects to CMMC
Level 2 self-assessment results are posted to SPRS. Under the CMMC rule, a conditional Level 2 status requires a minimum score of 88 out of 110, and only certain requirements can be carried on a POA&M. See CMMC POA&M rules. For the current status of the program, see our update on the Phase 2 suspension.
A gap assessment is the fastest way to get a defensible number, and the NIST SP 800-171 checklist shows what is being scored. Cyberix supports scoring and remediation through our CMMC and NIST SP 800-171 compliance services.
A worked example
Suppose an assessment finds three requirements not fully implemented, with weights of 5, 3 and 1. The score is 110 minus 9, which is 101. This example is only arithmetic. The weights are illustrative, so use the table in the DoD Assessment Methodology for the actual value of each requirement you score.
What to do after you post the score
- Keep the evidence behind the number. Store the system security plan, assessment records and proof for each requirement you marked met.
- Re-score after remediation. When you close gaps or your environment changes materially, update the score instead of waiting for the next contract.
- Name an owner. Someone should be responsible for keeping the score, the plan and the evidence current.
Who looks at your score
DoD can use SPRS results when evaluating offers, and prime contractors may ask their subcontractors for a current score. A score that cannot be supported by evidence is a liability in both settings, which is why an honest number matters more than a high one.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
What is a good SPRS score?
110 means all requirements are implemented. Under the CMMC rule, conditional Level 2 status requires at least 88 out of 110, with the remaining items eligible for a plan of action. A score below that signals significant gaps.
Can an SPRS score be negative?
Yes. The lowest possible score is -203. A negative score is allowed, but it signals substantial gaps and should come with a credible remediation plan.
Do I need a system security plan before I can score?
Yes. The assessment is based on the system security plan, so you need one that accurately describes your environment.
Who should sign off on the score?
A senior company official should review it, because the score is a representation to the government. Consult counsel about your affirmation obligations.
Does the Phase 2 suspension remove the need for an SPRS score?
No. Self-assessment scoring continues under Phase 1. Check your contract for the DFARS assessment clauses that apply.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.