SPRS Scoring Explained: How the Number Is Calculated and What It Signals to Primes

A prime asks for your SPRS score. You look it up, read back a number, and hope that is the end of it.

It usually is. But almost nobody I talk to can explain where that number came from, what it would take to move it, or what the person on the other end of the phone can and cannot verify. That is a bad position to be in, because the number is a self-report you sign your name to — and in June 2026 the Justice Department collected half a million dollars from a company over exactly that.

So here is the whole thing: the arithmetic, the clause changes almost nobody has noticed, and what a prime actually sees when they go looking for you.

Start at 110 and subtract

The scoring rules live in the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, dated June 24, 2020. That is still the current version — there is no newer one.

The method is simple enough to do on paper:

• You start at 110 — one point for each of the 110 requirements in NIST SP 800-171.
• For each requirement you have not implemented, you subtract 5, 3, or 1 points.
• The methodology states plainly that “the score of 110 is reduced by each requirement not implemented, which may result in a negative score.”

The weights are not arbitrary, and the logic is now codified at 32 CFR 170.24. A requirement is worth 5 points if failing to implement it “could lead to significant exploitation of the network, or exfiltration of CUI.” It is worth 3 if the effect is “specific and confined.” It is worth 1 if the effect is “limited or indirect.”

The authoritative list of which requirement carries which weight is Annex A of the Methodology. Not a vendor blog table. I compared several of those tables while writing this and they disagree with each other on the counts. Score against Annex A.

The two requirements that give partial credit

Only two out of 110. Both are worth 5 points if you have done nothing and 3 points if you have done part of it.

Requirement	Subtract 3 if…	Subtract 5 if…
IA.L2-3.5.3 — Multifactor Authentication	MFA is implemented for remote and privileged users, but not for general users	MFA is not implemented for any users
SC.L2-3.13.11 — CUI Encryption	Encryption is employed, but it is not FIPS-validated	Encryption is not employed

Both of these are worth knowing because they are the cheapest points on the board. Extending MFA from your admins to everyone is usually a configuration change and a week of user grumbling. It is worth 3 points. And the encryption one has a second consequence I will come back to when we get to POA&Ms.

The one requirement that is not scored at all

CA.L2-3.12.4 — the system security plan — carries no point value. Do not read that as good news. The methodology says the absence of an SSP “would result in a finding that an assessment could not be completed due to incomplete information.”

No SSP, no assessment. Not a low score. No score. It is the one item that does not cost you points because failing it ends the exercise instead.

How low can it actually go?

You will see “the floor is -203” repeated everywhere. It is worth being precise about where that number comes from, because it is not where people assume.

DoD has never published a minimum score. It is not in the Assessment Methodology, not in the SPRS guides, and not in 32 CFR 170.24 — all any of them say is that the score can go negative.

Where -203 does appear in an official document is a Justice Department press release. In the LOGZONE settlement of June 18, 2026, DoJ described the company’s DIBCAC score of -170 as “at the low end of the possible score range of -203 to 110.”

So: cite it as the range the government uses, which is defensible, and do not cite it as a published DoD scoring rule, which it is not. The practical point does not depend on the exact floor anyway. A company that has done essentially nothing does not score zero. It scores somewhere around negative two hundred. That is what makes an unprepared self-assessment so revealing — there is nowhere to hide in the middle.

Three kinds of assessment, and how to tell them apart

Level	Who performs it	Confidence	Who enters it in SPRS
Basic	You — a self-assessment against the DoD Assessment Methodology	Low	You
Medium	The Government — a review of your SSP by trained personnel	Medium	The Government
High	The Government — on-site or virtual verification, examination and demonstration against NIST SP 800-171A	High	The Government

A detail worth knowing because it lets you read a record at a glance: every saved assessment gets a ten-digit DoD Unique Identifier, and the first two letters encode the confidence level — SB for Basic, SM for Medium, SH for High. If someone shows you a screenshot, you can tell in one second whether it was a self-assessment or a government one.

Two more mechanics from the SPRS user guides. Basic is the only confidence level a vendor can add, edit or delete — you cannot touch a government-entered score. And assessment results turn red in SPRS once the assessment date is more than three years old. That is your renewal alarm, and it is visible to the government before it is visible to you.

The High assessments are performed by DCMA’s DIBCAC. I will note that the clause text itself only ever says “the Government” — DIBCAC is universally reported as the assessing body but is not named in the regulation.

The clause you are citing probably does not exist anymore

This is the part I most want small contractors to hear, because nearly every article on SPRS still gets it wrong.

Under the DFARS Overhaul, implemented by class deviations effective February 1, 2026:

• DFARS 252.204-7019 was deleted outright.
• DFARS 252.204-7020 was renumbered to 252.240-7997, with the references to Basic (self) Assessments stripped out.
• The safeguarding subpart moved from DFARS 204.73 to 240.370; the CMMC subpart from 204.75 to 240.371.
• 252.204-7012 and 252.204-7021 kept their numbers.

Both old clauses still appear on acquisition.gov and in the eCFR, because a class deviation does not amend the CFR. That is exactly why the mistake persists — you can look up 7019, find it, and reasonably conclude it is current.

Your self-assessment obligation did not go away. It moved. It now flows from CMMC — DFARS 252.204-7021 and 32 CFR Part 170 — rather than from 7019. The renumbered 252.240-7997 keeps the Medium and High assessment obligations and drops Basic, because CMMC now owns self-assessment.

32 CFR 170.16 states it directly: “The OSA must conduct a Level 2 self-assessment every three years and submit the results in SPRS, within three years of the CMMC Status Date,” and affirmation “is required for all Level 2 self-assessments at the time of each assessment, and annually thereafter.”

Same three-year cadence, same SPRS posting, same annual affirmation, different regulatory home. If your proposal boilerplate or compliance matrix references 7019, update it.

What a prime can actually see

Here is the thing that surprises almost everyone, on both sides of the relationship.

A prime cannot look up your NIST SP 800-171 score in SPRS.

SPRS vendor access is scoped to your own CAGE hierarchy. The access page says it in one sentence: “This access is only for Supplier, Vendor, and Awardee to access only their own company data.” The two vendor roles — Cyber Vendor User, who can add, edit and affirm assessments, and Contractor/Vendor Support Role, who is view-only — reach your CAGE and any CAGEs beneath it. Subsidiaries. Not unaffiliated suppliers.

So how does a prime verify you? Contractually, not technically. The obligation was always structured as a bar on award: the prime cannot award a subcontract unless the sub has a current assessment. In practice that means the prime requires you to state your score and assessment date in writing, often asks for an SPRS screenshot or the DoD Unique Identifier, and flows the clause down.

Two consequences fall out of that, and they cut in opposite directions.

• Nobody is checking your homework in real time. There is no dashboard where a prime discovers your score is inflated.
• Which is precisely why misstating it is a False Claims Act problem rather than a procurement problem. The number is a written representation, made to obtain business, that the recipient has no independent way to verify. That is the classic shape of a false claim.

One caveat I will flag rather than overstate: SPRS release 4.1.5, in April 2026, mentions a “new data incorporated EVP subcontractor view” in the Enhanced Vendor Profile. I could not determine whether that exposes subcontractor cyber data to primes or only to government users. Do not assume it changed anything yet.

And do not confuse the two different SPRS scores. Your Supplier Risk Score is a delivery, quality and price performance metric. Your NIST SP 800-171 assessment score is the cybersecurity number. They live in different modules and measure completely different things. I have watched two people have an entire conversation at cross purposes because one meant each.

The number that gates CMMC: 88

32 CFR 170.21 sets the bar for Conditional Level 2 status. Note that the rule never says “88.” It says the assessment score divided by the total number of Level 2 security requirements must be greater than or equal to 0.8. With 110 requirements, that works out to 88.

And 88 is necessary but not sufficient. All three of these must be true:

1. Score divided by total requirements is at least 0.8.
2. Nothing on your POA&M is worth more than 1 point — with one carve-out, SC.L2-3.13.11, which may be on a POA&M at its 3-point value if you employ encryption that is not FIPS-validated.
3. None of six specifically named requirements is on your POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5.

You can score 95 and still be denied Conditional status because one 3-point item sits on your POA&M. The score is a gate, not a grade.

And once you have Conditional status, the closeout must be confirmed within 180 days or the status expires.

What the number actually signals

A prime reading your score is not doing arithmetic. They are reading three things off it.

Whether you have done the work at all. The gap between a company that has genuinely assessed itself and one that has not is enormous — the difference between 85 and negative 140, not the difference between 85 and 80. There is no accidental middle.

Whether the number is plausible. A perfect 110 from a fifteen-person shop that has never had an outside assessment reads as a company that scored itself optimistically. An 84 with a dated, specific remediation plan reads as a company that measured honestly. I would rather flow work to the second one. So would most program managers I have talked to.

Whether they are inheriting your risk. The clause flows down. If you spill, the prime’s contract is implicated. Your score is their proxy for how likely that is.

Why the honest number is the safe one

DoJ’s cyber-fraud docket is now substantially about self-reported scores.

• MORSECORP, March 2025, $4.6 million — submitted a score of 104 when the actual score was -142, had no consolidated SSP for three years, and did not correct the SPRS entry until after receiving a subpoena.
• Georgia Tech Research Corporation, September 2025, $875,000 — submitted a score of 98 claiming campus-wide applicability when there was no campus-wide IT system, derived from what DoJ called a fictitious environment.
• LOGZONE, June 2026, $507,144 — DIBCAC assessed -170 against controls the company was contractually required to implement.

The LOGZONE case is the one to watch, and not because of the dollar amount, which is small. It was government-initiated — not a whistleblower case. DoJ appears to be working from assessment results directly. That is a meaningfully different risk model than waiting for a disgruntled insider to file.

And none of this was touched by the July 2026 CMMC suspension. Third-party certification assessments were suspended. Self-assessments, SPRS score posting, annual affirmation, DFARS 7012 and all 110 NIST SP 800-171 Rev. 2 requirements were not. If anything, with the audit gate lifted, the affirmation you sign is now carrying more enforcement weight than it was in June.

Which brings me back to where I started. The score is a number you generate about yourself, that almost nobody can independently check, and that you personally attest to. There is exactly one strategy that survives contact with a DIBCAC assessment or a Civil Division attorney: make the number true, write down how you got it, and fix the gaps on a schedule you can actually meet.

---

Where to go next

• Not sure what your real score would be? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks through scoping and scoring from the beginning.
• Need the SSP that makes an assessment possible at all? Start with our CMMC packets.
• What it costs is published, including the free Level 1 tier — see the Level 2 readiness packet price.