What is my SPRS score?

What the score is

SPRS is the Supplier Performance Risk System — the DoD database where contractor risk information lives. Contractors that handle CUI assess themselves against NIST SP 800-171 Rev 2 and post the result there. The duty comes from your contract: DFARS 252.204-7012 requires the NIST SP 800-171 Rev 2 safeguards; the CMMC clause, DFARS 252.204-7021, has you enter self-assessment results and an affirmation in SPRS; older contracts carry the earlier posting duty in DFARS 252.204-7019 and -7020. The score is computed with the DoD Assessment Methodology: start at 110 (one point per requirement in NIST SP 800-171 Rev 2) and subtract a fixed weight — 5, 3, or 1 — for each requirement not fully implemented. Nothing is "partially" implemented in the math: with two narrow exceptions (multifactor authentication and FIPS-validated encryption), an incomplete requirement deducts its full weight.

Under CMMC, the same number takes on more weight: a Level 2 self-assessment means posting your score in SPRS and affirming it annually, and a Level 2 certification assessment checks the same 110 requirements through a third-party assessor (C3PAO).

How to find the score you already have (if any)

1. Log into the PIEE portal (piee.eb.mil) — the same portal used for WAWF/invoicing. To enter or edit a basic self-assessment, SPRS says you need the "SPRS Cyber Vendor User" role; your company's PIEE administrator can grant it.
2. Open SPRS and go to the NIST SP 800-171 assessments view for your CAGE code.
3. If nothing is listed, your company has never posted a self-assessment — which means one likely needs to be done before your next CUI-handling award.

If someone else (an IT provider or consultant) submitted it, the entry shows the score, the assessment date, the scope, and the projected date you'll reach 110.

What counts as a good score

A perfect score is 110, and a first honest self-assessment at a small shop can land well below it — the scoring is deliberately front-loaded with 5-point requirements that small businesses rarely have formalized (incident response, training, access control policy). Three things matter more than the raw number: that the score is current, that it's honest (a score you can't support is worse than a low one), and that you have a credible plan to reach 110, which is what the POA&M documents.

In March 2025 the Department of Justice announced a $4.6 million False Claims Act settlement with a defense contractor that had reported a score of 104; a consultant later put it at −142. Read the Justice Department release. This page is not legal advice.

How to raise it fastest

Because deductions are weighted, the fastest path is fixing 5-point requirements that are cheap for a small business: enforcing MFA in Microsoft 365, writing the incident-response plan, turning on the built-in audit logging, running annual security awareness training. A gap assessment that sorts your unimplemented controls by weight and effort tells you where the points are — the "Fastest points first" list on WorkuGRC's gap dashboard shows the 5-point gaps that take the least effort, and our free SPRS score calculator gives you an estimated range in about three minutes.

Frequently asked questions

Do I need an SPRS score if I only handle FCI, not CUI?

The older DFARS 252.204-7019 and -7020 self-assessment requirement applies to contractors subject to DFARS 252.204-7012, i.e. those handling CUI. If you only handle Federal Contract Information, CMMC Level 1 applies instead — 15 basic safeguarding practices with an annual self-assessment and affirmation, but no 110-point score.

How long is an SPRS score valid?

Under CMMC, a Level 2 self-assessment is repeated every three years, and you must also affirm your compliance annually in SPRS. Many primes ask for a score dated within the last year regardless.

Who in my company can submit the score?

Anyone your PIEE administrator grants the "SPRS Cyber Vendor User" role, which SPRS requires to enter or edit basic self-assessment information — typically an owner or office manager at a small shop. Under CMMC, the annual affirmation must come from a senior official of the company (the Affirming Official).

Can I just post 110?

Only if it's true at the assessment-objective level — all 320 objectives in NIST SP 800-171A. In March 2025 the Department of Justice announced a $4.6 million False Claims Act settlement with a contractor that had reported 104 when a consultant later calculated −142. Post the honest number with a remediation plan instead.

Related

• Free SPRS score estimator: 12 questions, no signup
• SPRS score calculator: how the score is worked out
• CMMC Level 2 POA&M rules: what you can and cannot defer
• The CMMC affirmation: who signs, what they attest, and when

Informational only — not a compliance determination, an assessment, or legal advice. Requirements are defined by NIST SP 800-171 Rev 2, NIST SP 800-171A, the DoD Assessment Methodology, and 32 CFR Part 170; always verify against the official publications.