Your SPRS Score Is More Than a Number: What Defense Contractors Need to Know

Your SPRS Score Is More Than a Number: What Defense Contractors Need to Know

For defense contractors handling Controlled Unclassified Information (CUI), cybersecurity compliance is more than a checklist. But one number carries real weight: your Supplier Performance Risk System (SPRS) score.

Under DFARS 252.204-7020, a Basic Assessment is a contractor self-assessment of NIST SP 800-171 implementation. It is based on your System Security Plan (SSP) and scored using the NIST SP 800-171 DoD Assessment Methodology. Because it is self-generated, DFARS assigns the Basic Assessment a Low confidence level. The summary score is posted in SPRS.

That score should be supported by what is actually happening in your environment: your controls, SSP, configurations, policies, scope, asset inventory, CUI flows, and evidence.

Your SPRS score should tell the same story as your actual cybersecurity environment.

SPRS and CMMC Are Related, but Not the Same

An SPRS score comes from the DFARS assessment framework (252.204-7019 and 252.204-7020). It measures compliance with the NIST SP 800-171 requirements that contractors must meet under DFARS 252.204-7012.

CMMC is a separate program, codified at 32 CFR Part 170 and implemented in contracts through DFARS 252.204-7021. It has its own scoping, assessment, POA&M, and status requirements.

Both are built on NIST SP 800-171, but saying “we have a 110 in SPRS” is not the same as saying “we have CMMC Level 2 status.” Be clear about which assessment, methodology, and program you’re discussing.

How the Score Works

The methodology starts at a maximum of 110 and deducts points for each requirement that isn’t implemented. Requirements are worth 1, 3, or 5 points, so the score is not a percentage. Implementing 90% of controls does not mean a score of 90. The possible range runs from -203 to 110. Additional DoW guidance is available on the Defense Pricing and Contracting safeguarding page.

A 110 means every requirement evaluated under the methodology is implemented. It should be the result of an honest assessment, not a target you work backward from.

Government Assessments Can Go Further

DFARS 252.204-7020 defines three assessment levels:

• Basic: your own self-assessment, based on your SSP
• Medium: a government review of your Basic Assessment, a thorough document review, and discussions with your team
• High: everything in a Medium, plus verification, examination, and demonstration of SSP implementation

Contractors must provide access to facilities, systems, and personnel when the government conducts a Medium or High Assessment. Your self-reported score may eventually be compared against your actual configurations, documentation, and people. Assess as though someone may ask you to prove it.

Your Score Is Only as Good as Your Scope

Before scoring anything, you need to know what environment you’re assessing. Excellent controls won’t help if you’ve misidentified where CUI lives or which systems protect it.

Keep Your SSP Current

NIST SP 800-171 requirement 3.12.4 requires SSPs that describe system boundaries, operating environments, control implementation, and connections to other systems, and that are periodically updated. If you’ve since migrated systems, added cloud services, opened new locations, switched MSPs, or changed how CUI moves, an older SSP may no longer support your score.

Know Your Asset Categories

The CMMC Level 2 Scoping Guide offers a useful framework even outside a formal CMMC assessment:

• CUI Assets process, store, or transmit CUI. You should know where CUI enters, where it’s stored and backed up, how it moves, and who can access it.
• Security Protection Assets provide security functions to the environment, such as SIEMs, hosted VPNs, cloud security tools, MSP personnel, and SOCs. They must be included in the inventory, SSP, and network diagram.
• Contractor Risk Managed Assets aren’t intended to handle CUI but technically could. They must be documented, along with how they’re managed.
• Specialized Assets and Out-of-Scope Assets have their own treatment rules.

“It doesn’t store CUI, so it doesn’t matter” is a common and costly assumption. Some assets matter because they protect CUI.

Make Your Documents Agree

Three documents should tell the same story:

• Asset inventory: what exists
• Network diagram: how it connects
• SSP: how the environment meets each requirement

If they describe different boundaries, assessors and internal reviewers won’t be able to tell what’s actually in scope.

Documentation Is Not Implementation

A policy stating “MFA is required for privileged access” doesn’t prove MFA is configured everywhere it should be. “Audit logs are reviewed regularly” doesn’t prove anyone reviews them. The same gap shows up in access control, training, incident response, vulnerability management, configuration management, and remote access.

For every requirement, ask: “If someone asked us tomorrow to demonstrate this, what would we show them?”

Useful evidence includes configuration exports, authentication settings, access records, security logs, training records, vulnerability scans, incident response documentation, and cloud configuration records. Not every requirement needs the same evidence, but each needs a reasonable, repeatable basis. NIST SP 800-171A outlines what each requirement should demonstrate.

When Scores Don’t Match Reality

On June 18, 2026, the Department of Justice announced that Huntsville, Alabama defense contractor LOGZONE Inc. agreed to pay $507,144 to resolve False Claims Act allegations tied to cybersecurity requirements on Department of the Navy contracts. According to DOJ, a Defense Contract Management Agency assessment scored the company at -170, near the bottom of the -203 to 110 range.

DOJ noted the claims were allegations only, with no determination of liability. The lesson isn’t that every scoring error leads to FCA liability. It’s that cybersecurity representations to the government need to be supportable.

Need CMMC & DOW Compliance Documentation?

Stop searching across multiple sources for the guidance you need. Access CMMC resources, DOW compliance documentation, DFARS information, SSP guidance, POA&M resources, and assessment materials in one place.

Download the CMMC & DOW Compliance Documentation PDF to help support your cybersecurity and compliance program.

Common Mistakes to Avoid

• Treating SPRS as paperwork instead of an honest evaluation
• Starting at 110 and working backward
• Assuming a written policy equals implementation
• Using an outdated SSP or an incomplete asset inventory
• Incorrectly scoping CUI by missing users, systems, locations, or cloud services
• Miscalculating the score as a simple percentage
• Reporting 110 while your POA&M lists unimplemented scored requirements. Your score and your POA&M must agree.
• Assuming any gap can go on a POA&M. Under CMMC, only specific low-point requirements are eligible, and only if you score at least 88.
• Missing your annual affirmation. Under CMMC, a senior official must reaffirm compliance every year to maintain status.
• Assuming your MSP owns compliance. They manage tools; you own the obligations.
• Skipping reassessment after major changes

Rev. 2 vs. Rev. 3

NIST published SP 800-171 Rev. 3 in May 2024 and withdrew Rev. 2. That doesn’t automatically change your contractual obligations. DFARS 252.204-7020 requires you to state which version you assessed against, and your contract and program requirements determine which revision applies. NIST’s newest publication and your contractual requirement are not necessarily the same thing, so verify rather than assume.

A Score Below 110 Isn’t Disqualifying, but It Must Be Accurate

Under the DFARS framework, a Basic Assessment can be submitted with unimplemented requirements. That’s why the submission includes a target date for reaching 110. That isn’t permission to ignore gaps. Identify deficiencies accurately, score correctly, maintain your POA&M, and work toward remediation.

CMMC Is Stricter: The 88-Point Floor and Conditional Status

Under the CMMC Program rule (32 CFR Part 170), POA&Ms are far more limited. To receive Conditional Level 2 status, through either a self-assessment or a C3PAO certification, a contractor must meet three conditions:

• Score at least 88 of 110 (80% of the maximum). Below 88, no POA&M is permitted and no Conditional status is available.
• Place only eligible requirements on the POA&M. Generally, only 1-point requirements qualify. The one exception is SC.L2-3.13.11 (FIPS-validated cryptography), which can be deferred when encryption is in place but not yet FIPS-validated. Six specific 1-point requirements, including the requirement to maintain an SSP (CA.L2-3.12.4), can never be placed on a POA&M.
• Meet both the 3- and 5-point requirements. If any non-POA&M-eligible requirement is unmet, Conditional status is not available, regardless of the overall score.

Conditional status lasts 180 days. Every POA&M item must be closed and verified through a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date, bringing the score to 110. If the window closes first, the Conditional status expires, and the contractor must start over.

Subcontractors Are Affected Too

DFARS 252.204-7020 flows down to applicable subcontractors, who must have at least a current Basic Assessment before certain subcontracts are awarded. Manufacturers, CNC machine shops, engineering firms, software providers, and service providers across the Defense Industrial Base should not assume these requirements only apply to primes.

How Long Is an Assessment Valid?

It depends on which requirement you’re meeting:

• CMMC Level 1: self-assessment and affirmation every year.
• CMMC Level 2 (self-assessment or C3PAO certification): full assessment every three years, plus an annual affirmation of continued compliance by a senior company official. Missing an affirmation can cost you your status.
• CMMC Level 2 Conditional status: valid for 180 days.
• DFARS Basic Assessment (252.204-7020): current for up to three years, unless the solicitation requires something shorter.

Don’t treat any of these windows as a reason to ignore major changes to your systems, scope, or CUI flows.

How to Validate Your SPRS Score

1. Confirm your requirements. Review your contract and DFARS clauses, confirm which NIST revision applies, and determine whether CMMC Level 2 applies.
2. Map your CUI. Identify where it’s received, processed, stored, transmitted, and backed up.
3. Align your scope documents. Verify that your asset inventory, network diagram, and SSP match reality and each other.
4. Evaluate each requirement. Test actual implementation, not just policy.
5. Gather evidence. Make sure you can demonstrate each conclusion.
6. Reconcile your POA&M. Make sure open items don’t contradict your score and, for CMMC, that each one is POA&M-eligible.
7. Calculate correctly. Apply the methodology’s point values.
8. Challenge the result. Ask whether you could defend it in a government assessment tomorrow.

Quick Readiness Checklist

• Is our assessment current, and have we confirmed the applicable NIST revision?
• Does our SSP describe the environment we actually operate?
• Are our asset inventory and network diagram complete and consistent?
• Do we know every system that touches or protects CUI?
• Can we demonstrate implementation with evidence?
• Does our POA&M align with our reported score?
• If we’re pursuing CMMC Level 2, are we at or above 88, with every 3- and 5-point requirement met?
• Is our annual affirmation up to date?
• Has our environment materially changed since our last assessment?

If several of these are hard to answer, it’s time to validate.

Frequently Asked Questions

What is an SPRS score?

A summary-level score from a NIST SP 800-171 assessment, posted in SPRS. The Basic Assessment is a contractor self-assessment under DFARS 252.204-7020.

What does an SPRS score of 110 mean?

It’s the maximum score under the DoD Assessment Methodology, representing implementation of all evaluated requirements. You should be able to support it with your SSP, configurations, and evidence.

What is the lowest possible SPRS score?

-203, as DOJ noted in its LOGZONE announcement.

How is an SPRS score calculated?

Start at 110 and deduct the assigned point value (1, 3, or 5) for each unimplemented requirement. Because values vary, it is not a percentage.

Is an SPRS score the same as CMMC compliance?

No. A 110 SPRS score does not by itself establish CMMC status under 32 CFR Part 170.

What is a CMMC Conditional status?

A temporary CMMC Level 2 status for contractors who score at least 88 of 110 and have only POA&M-eligible requirements outstanding. All POA&M items must be closed and verified within 180 days, bringing the score to 110, or the status expires.

Can I have POA&M items and still report 110?

Not if those items are unimplemented requirements that carry deductions under the methodology. Your score must reflect them. For CMMC Level 2, POA&Ms are only allowed for eligible requirements, and only with a score of at least 88.

Who can see my SPRS score?

Authorized government personnel and your organization’s authorized representatives. It is not public.

How long is an SPRS assessment valid?

It depends on the requirement. CMMC Level 1 requires a self-assessment and affirmation every year. CMMC Level 2, whether by self-assessment or C3PAO certification, requires a full assessment every three years plus an annual affirmation by a senior company official. Missing an affirmation can cost you your status. Conditional Level 2 status lasts only 180 days. A DFARS Basic Assessment is current for up to three years unless the solicitation requires something shorter.

Don’t Guess Your SPRS Score. Validate It.

Your score, SSP, asset inventory, network diagram, CUI scope, POA&M, evidence, and actual operations should all tell the same story. The higher the score you report, the more important it is to prove it.

Brea Networks helps defense contractors evaluate and strengthen the environment behind their SPRS score. Our services include NIST SP 800-171 readiness assessments, SPRS score validation, SSP development, CUI scoping, asset inventory and network diagram development, POA&M remediation, CMMC readiness, Microsoft GCC/GCC High support, ITAR cybersecurity, and continuous monitoring.

Contact Brea Networks to review your NIST SP 800-171 environment before gaps become compliance problems.

Government Resources

• DFARS 252.204-7012, 7019, 7020, and 7021
• NIST SP 800-171 DoD Assessment Methodology v1.2.1
• Supplier Performance Risk System and SPRS Quick Entry Guide
• NIST SP 800-171 Rev. 2, Rev. 3, and 800-171A
• CMMC Program Rule (32 CFR Part 170) and CMMC Resources & Documentation
• CMMC Level 2 Scoping Guide
• National Archives CUI Registry

Schedule a free consultation with the Brea Networks team to review your current environment, identify compliance risks, and determine the next steps. A short conversation can help you avoid costly mistakes and focus on what matters for contract eligibility and security.

About Brea Networks

Brea Networks is a cybersecurity and compliance-focused IT partner dedicated to supporting Defense Industrial Base (DIB) contractors. We help organizations understand and implement the security requirements outlined in FAR 52.204-21, DFARS 252.204-7012, and the CMMC framework from Level 1 self-assessments to Level 2 and Level 3 readiness. Our team works alongside contractors to strengthen system security, define assessment scope, prepare documentation such as System Security Plans (SSPs) and POA&Ms, and build sustainable cybersecurity programs that protect FCI and CUI. Whether you are preparing for a self-assessment or simply improving your security posture, Brea Networks provides practical guidance and technical expertise to help you move forward with confidence.

Brea Networks, LLC
471 W Lambert Rd Ste 105
Brea, CA 92821
https://www.cmmccompliance.us
https://www.breanetworks.com
Telephone: 714-592-0063