What the SPRS Score Is
The Supplier Performance Risk System score is a self-reported number between −203 and 110 that represents how completely you have implemented the 110 controls of NIST SP 800-171. Defense contractors handling Controlled Unclassified Information are required to keep a current score in SPRS, and contracting officers can see it when evaluating you.
It is the cheapest signal in the entire CMMC programme, and the one most contractors treat carelessly. You can hold a perfectly good security posture and still lose work because your score is stale, missing, or obviously assembled without evidence.
How the Calculation Actually Works
Start at 110, one point for each control in NIST SP 800-171. Subtract the weighted value of every control that is not fully implemented. What is left is your score.
| Starting point | Deduction per unmet control | Range |
|---|---|---|
| 110 (all controls implemented) | 1, 3 or 5 points depending on weight | −203 to 110 |
The floor is −203 rather than 0 because the deductions are weighted: if every control were unmet, the weighted total subtracted from 110 would take you well below zero. A negative score is not a rounding artifact, it is a statement that foundational controls are absent.
Partial implementation does not earn partial credit. A control is either fully implemented or it is not, and "mostly" scores the same as "not at all". This is the single most common reason a self-calculated score is wrong and optimistic.
Why Some Controls Cost Five Points
The weighting reflects how much risk a missing control actually creates, not how hard it is to implement. The heaviest deductions cluster around the controls that, if absent, make the others largely decorative.
| Weight | Character of the control | Effect on your score |
|---|---|---|
| 5 points | Foundational — multi-factor authentication, boundary protection, FIPS-validated cryptography | A handful of these will put you underwater on their own |
| 3 points | Significant risk reduction if implemented | Meaningful but recoverable |
| 1 point | Supporting and procedural controls | Individually small, collectively substantial |
The practical consequence: fix the 5-point controls first. Closing a dozen 1-point procedural gaps feels productive and moves your score less than implementing multi-factor authentication properly. It is also the sequencing a C3PAO expects to see, because high-weighted controls generally cannot sit on a POA&M at assessment time.
How to Submit It, and Who Signs
The self-assessment is submitted through PIEE (Procurement Integrated Enterprise Environment), which is the access route to SPRS. An authorized official inside your company affirms the score — not your consultant, not your MSP.
We calculate the number, show you the arithmetic control by control, and make sure you can defend every deduction. You submit it. That division is not a formality: affirming a score you cannot substantiate is a representation to the government.
You will need your assessment date, your score, the scope it covers, and the date you expect to reach 110.
What Counts as a Good Score
A perfect score is 110. There is no official pass mark, which is exactly why the number gets misread.
Negative: foundational controls are missing. This is visible, and it is the shape of score that costs awards.
Zero to 80: a real programme with real gaps. Defensible if your POA&M is credible and dated.
80 to 110: close. Usually a small number of high-weighted controls between you and a clean assessment.
Increasingly, primes set a minimum score as a condition of subcontract award under the DFARS 252.204-7021 flow-down. That makes the score a commercial gate long before certification is due.
How to Raise Your Score
Get the number calculated properly first. A score built from an evidence-backed gap assessment is usually lower than the one a team estimates for itself, and it is the only version worth acting on.
Close the 5-point controls. Multi-factor authentication, boundary protection, FIPS-validated encryption. This is where the points are.
Shrink the boundary. Fewer systems in scope means fewer controls to implement everywhere. A CUI enclave raises your score and lowers your CMMC cost at the same time.
Update SPRS when you close gaps. Contractors routinely do the remediation and never revise the score, so the improvement is invisible to exactly the people it was meant to reach.
SPRS Score FAQs
What is an SPRS score?
The Supplier Performance Risk System score is a self-reported figure between −203 and 110 that represents how completely you have implemented the 110 controls of NIST SP 800-171. Defense contractors handling CUI are required to have a current score in SPRS, and contracting officers can see it.
How is the SPRS score calculated?
You start at 110, one point for each control, and subtract the weighted value of every control not fully implemented. Most unmet controls cost 1 point, some cost 3, and a small set of foundational controls cost 5. Because the deductions are weighted and the maximum is 110, the lowest possible score is −203.
What is a good SPRS score?
A perfect score is 110 and means every control is fully implemented. There is no official pass mark, but a negative score signals that foundational controls are missing, and many primes now set a minimum score as a condition of subcontract award. Treat 110 as the target and anything below zero as urgent.
Who submits the SPRS score?
You do. Your consultant can calculate it and show you the arithmetic, but the self-assessment is submitted by your organization through PIEE, and an authorized official within your company affirms it. No consultant can submit it on your behalf.
How often does the SPRS score need updating?
A self-assessment is generally valid for three years, but you should update it whenever your environment changes materially or you close gaps that raise the score. A stale score that no longer matches your environment is worse than a low one you can defend.
Does a POA&M affect the SPRS score?
Yes. Controls sitting on a Plan of Action & Milestones are not implemented, so their weighted value is still deducted. The POA&M documents your plan to close them, it does not restore the points until the control is actually in place.
Get Your Real Number
A NIST SP 800-171 gap assessment produces an evidence-backed SPRS score and a costed roadmap to raise it. See how it fits into a full CMMC engagement, or what CMMC certification costs.
Official reference: DoD, Supplier Performance Risk System.
Know your score before a contracting officer does
An evidence-backed SPRS score and a roadmap to 110.