Your SPRS score is visible to every DoD contracting officer who pulls your record. Knowing what it should be before a C3PAO confirms it lets you make informed decisions about remediation spending and contract pursuit.
What the SPRS Score Is
The Supplier Performance Risk System (SPRS) score represents your self-assessed implementation of NIST SP 800-171. It starts at 110 and loses points for each requirement that is not fully implemented. Point values range from 1 to 5 per requirement depending on how DoD has weighted each control’s risk impact.
A score of 110 means all 110 requirements are fully implemented. Scores below 0 are possible and common for organizations that have not prioritized compliance. The score you submit to SPRS is based on your honest self-assessment, signed off by a senior official.
How the Point Deductions Work
DoD’s scoring methodology assigns each of the 110 requirements a weight of 1, 3, or 5 points based on risk. Requirements that are not implemented deduct their full point value. Requirements that are partially implemented also deduct their full value – partial credit is not given in the standard methodology.
This means a small number of high-weight unimplemented controls can significantly drag your score. Multi-factor authentication, audit logging, and incident response planning are among the higher-weighted requirements. Organizations that have not implemented these can find themselves well below zero before accounting for the rest of the gap.
How to Run Your Own Pre-Assessment Calculation
Go through each of the 110 NIST 800-171 requirements and mark each as fully implemented, partially implemented, or not implemented. For each that is not fully implemented, note its DoD-assigned point value from the NIST scoring methodology. Subtract those values from 110.
The result is your projected SPRS score. Use the SPRS Calculator on initcyber.com (https://initcyber.com/sprs-calculator/) to run the numbers by domain and see where your biggest point losses are concentrated. This tells you where remediation spending will have the highest score impact before your official assessment.
What Happens If Your Score Is Very Low
A low or negative score may not automatically disqualify a company from contract pursuit, but contracting officers do review SPRS scores and can factor them into source selection. Your score must also reflect reality – submitting an inflated SPRS score is a False Claims Act exposure, not just a compliance issue.
If your score is low, submit it accurately with a POA&M that shows a credible remediation plan and timeline. Update the score in SPRS as you close gaps. Assessors and contracting officers will look more favorably at an organization with a -30 score and a substantive plan than one with an unexplained 95 that does not match observed controls.
Init Cyber’s gap assessments include a projected SPRS score and prioritized POA&M so you know exactly where you stand before your C3PAO date. Fixed-fee or hourly.