SPRS Score Explained: How DoD Sees Your NIST 800-171 Posture

Short answer: Your SPRS score (Supplier Performance Risk System) is a single number — between -203 and +110 — that DoD uses to gauge your NIST 800-171 posture. You start at 110 and subtract a weighted point value (1, 3, or 5) for every control you have not fully implemented. The score lives in the Supplier Performance Risk System portal and is required by DFARS 252.204-7019 before award on most CUI contracts. Negative scores are normal early on; primes use the number to triage risk, not to disqualify.

What SPRS actually is

SPRS is a DoD-run portal at sprs.csd.disa.mil that stores supplier risk data, including your self-assessed NIST 800-171 score. DFARS 252.204-7019 requires that score to be no more than three years old at time of award. Primes can pull your score before issuing a subcontract — and most now do.

How the score is calculated

Start at 110. For every one of the 110 controls in NIST 800-171 r2 that you have not fully implemented, subtract its DoD-assigned weight from the scoring template:

• 5 points — high-impact controls (multi-factor auth, FIPS-validated crypto, audit logging)
• 3 points — moderate-impact (configuration management, vulnerability scanning)
• 1 point — lower-impact controls

A handful of controls have partial credit (3 of 5, 1 of 5) if you have a partial implementation. The maximum possible deduction sums to 313, so the floor is -203.

What a negative score actually means

It means you have meaningful gaps — but it does not automatically lose you the contract. A small shop honestly self-scoring before any remediation often lands between -80 and -120. What matters is the trajectory and the POA&M (Plan of Action & Milestones) attached to it. Primes worry far more about contractors who post a +110 with no evidence than about a -90 with a credible 6-month plan.

How to post your score

1. Complete a self-assessment against all 110 controls using the official DoD scoring template.
2. Request a SPRS account (your CAGE code holder does this through PIEE).
3. Enter the summary-level score, the date assessed, the assessment scope, and the projected score-of-record date (when you expect to hit 110).
4. Keep the underlying SSP and POA&M on file — DoD or a prime can request them.

How to improve it fast

The 5-point controls give you the biggest score lift per dollar spent. In rough priority: enforce MFA on all privileged and remote access, deploy FIPS 140-validated encryption for CUI at rest and in transit, centralize audit logging with at least 90 days retention, and document a configuration baseline for every system in scope.