The Supplier Performance Risk System is the Department of Defense database where a contractor's NIST SP 800-171 assessment score and CMMC results are recorded. For a company new to defense work it is usually discovered the wrong way: a prime asks for "your SPRS score" a few days before a proposal is due, and nobody in the company has heard of it. This page covers what the system is, what the number means, how to get access, and what to enter, so that request is answered in minutes rather than weeks.
DFARS 252.204-7019 requires an offeror to have a current NIST SP 800-171 assessment, not more than three years old, posted in SPRS for each covered contractor information system before it can be considered for a contract that involves Controlled Unclassified Information. DFARS 252.204-7020 requires the contractor to give the Department access for Medium and High assessments when requested and to flow the same requirement down to subcontractors that handle CUI. Together they mean a prime cannot award a CUI subcontract to a company with no score on record, which is why primes check SPRS before they check anything else.
SPRS also holds CMMC results: the Level 1 and Level 2 self-assessment results and the annual affirmations that the CMMC program requires are entered there by the contractor. A C3PAO or DIBCAC assessment result reaches SPRS through the Department's assessment systems. One system, several records, and the contractor is responsible for the self-entered ones.
Start the PIEE registration and the role request as soon as the SAM.gov registration is Active, before any solicitation needs the result. Nothing in the process is difficult, but every step waits on an approval, and a proposal deadline does not.
A perfect score with no System Security Plan, no evidence, and no assessment record is the pattern the Department's reviewers look for first. A negative score with a real plan of action is a better position than a perfect score that cannot be supported.
The score describes the systems as they are on the assessment date. Counting a control that is licensed but not deployed, or documented but not operating, overstates the score and turns an honest gap into a false representation.
A score entered for an enclave that the contract's CUI never touches, or against a CAGE code that is not the one on the award, does not satisfy the clause. The scope on the record has to be the scope that handles the information.
The assessment must be no more than three years old at award. A company that scored once in its first year and never updated it will find the record expired when the renewal contract comes up.
The most common reason a first submission misses a deadline is not the assessment; it is that nobody at the company could log in. Get the role first.
A SPRS score is a NIST SP 800-171 assessment result required by DFARS 7019. CMMC Level 1 and Level 2 are separate assessment results, also recorded in SPRS, required where DFARS 7021 is in the contract. A company can need one, the other, or both.
It is the result of a NIST SP 800-171 assessment, scored under the DoD Assessment Methodology, recorded in the Supplier Performance Risk System. Every organization starts at 110 and subtracts 5, 3, or 1 for each of the 110 requirements not fully implemented, down to a minimum of −203. A Basic assessment is the contractor's own self-assessment.
Where the contract involves Controlled Unclassified Information and includes DFARS 252.204-7019, a current assessment score must be in SPRS before award, and primes require it of subcontractors that handle CUI. A contract involving only Federal Contract Information does not require a NIST SP 800-171 score, although it may require a CMMC Level 1 self-assessment result, which is also recorded in SPRS.
Confirm the Electronic Business Point of Contact on your SAM.gov record, have that person (or someone they appoint in a signed letter) establish the company's Contractor Administrator in the Procurement Integrated Enterprise Environment (PIEE), then register the user who will enter assessments and request the SPRS Cyber Vendor User role. The Contractor Administrator activates the account and approves the role. That role is the one that can enter and edit NIST SP 800-171 and CMMC information.
A negative score is a legitimate result and is common for a first assessment. What matters is that it is accurate, that a System Security Plan exists, and that the plan of action date is realistic. An inflated score is a false representation to the government; an honest low score is a starting point.
DFARS 252.204-7019 requires an assessment that is not more than three years old at the time of award. Update the record whenever the environment changes materially, and reassess before the three years run out.
Cyberneza assesses the environment as it actually runs, builds the System Security Plan and plan of action the score rests on, and prepares the information your organization submits to SPRS. The self-assessment and the submission stay yours; the number behind them will hold up.
