Your SPRS score is often the first number a prime or DoD sees about your cybersecurity. Here is how the score is calculated, step by step.
If your defense contract includes DFARS 7012, you're required to protect Controlled Unclassified Information (CUI) using the 110 security requirements in NIST SP 800-171. DFARS 7019 and 7020 add one more step: you score yourself against those requirements and post the result in the Supplier Performance Risk System (SPRS).
The math is simple. The hard part is being honest about what's actually in place.
Start at 110
Every requirement is worth points. You start with a perfect score of 110 and subtract points for each requirement that isn't fully implemented.
Subtract by weight
Each requirement carries a weight from the DoD Assessment Methodology:
- 5 points for high-impact requirements, such as MFA, encryption of CUI, incident response, and limiting system access to authorized users
- 3 points for medium-impact requirements
- 1 point for lower-impact requirements
Partial credit doesn't count. If a requirement is only half done, you take the full deduction.
The two exceptions
Two requirements allow partial credit:
- MFA (3.5.3): subtract 5 if it isn't implemented, or 3 if it covers remote and privileged access but not all users
- FIPS-validated encryption (3.13.11): subtract 5 if CUI isn't encrypted at all, or 3 if it's encrypted but the module isn't FIPS-validated
No SSP, no score
Without a System Security Plan (requirement 3.12.4), you don't have a valid assessment at all. Write the SSP first, then score against it.
How low can it go?
If nothing is implemented, the score bottoms out at -203. Negative scores are common on a first honest pass, and that's fine. A real number gives you a starting point.
What a POA&M does (and doesn't) do
A Plan of Action and Milestones (POA&M) documents how you'll close gaps. It does not add points back. A requirement with an open POA&M item is still scored as not met.
Under CMMC Level 2, you need at least 88 points to get conditional status with a POA&M, some high-weight requirements can't be left open on a POA&M, and open items have to be closed within 180 days.
What you submit to SPRS
Your SPRS entry includes:
- Your score
- The assessment date
- The CAGE codes it covers
- Your SSP name and date
- The date you expect to reach 110
A Basic self-assessment stays valid for three years, but update it whenever your environment changes.
A worked example
Say you're missing MFA for regular users (-3), haven't tested your incident response plan (-1), and haven't added a system-use notice to your login screens (-1). That works out to 110 - 3 - 1 - 1 = 105.
Get a head start
We built a free SPRS Score Worksheet that walks through all 110 requirements with their weights already filled in.
If you'd like a second set of eyes on your score or your SSP, Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors with CMMC and NIST 800-171. Reach out here.
SPRS explained · SSP, POA&M and SPRS · Level 2 Self readiness