Your SPRS Score and NIST SP 800-171: What You Represent Matters
An SPRS score is the result of a NIST SP 800-171 assessment, recorded in the DoW (DoD) Supplier Performance Risk System on a scale from 110 down to -203. Since September 2026, a self-posted score applies only where a contract requires it.
What is an SPRS score?
An SPRS score is the result of a NIST SP 800-171 assessment, recorded in the Supplier Performance Risk System of the Department of War (DoW, also DoD). It runs from 110, every requirement implemented, down to -203. You start at 110 and subtract 1, 3 or 5 points for each requirement not yet implemented.
The method comes from the DoD Assessment Methodology for NIST SP 800-171. SPRS holds summary-level results only: the total score, the standard assessed, the date and level of the assessment, and the date open items are expected to be closed. It does not record the detail of each requirement.
Scores come from four kinds of assessment. A self-assessment is performed and posted by the contractor, where a contract requires it. A Medium assessment is a DCMA document review and discussion; a High assessment adds verification and demonstration of your System Security Plan, and both are posted by DoW. A CMMC Level 2 (C3PAO) assessment is a third-party assessment, voluntary for new contracts during the suspension.
How do you calculate a self-assessment score?
1
Scope Your Systems
Identify every system that stores, processes or transmits CUI, and the systems that protect them.
2
Assess Each Requirement
Test all 110 requirements against the assessment objectives in NIST SP 800-171A.
3
Subtract the Weights
Start at 110 and subtract 1, 3 or 5 points for each requirement not implemented.
4
Plan the Open Items
Record every open item in a plan of action with a completion date.
5
Post and Affirm
Post the score in SPRS and, under CMMC Level 2 (Self), affirm it every year.
Which requirements cost the most points?
Several of the heaviest requirements are where contractors most often fall short. SENTRE implements each of them inside the enclave.
| Requirement | What it covers | Points deducted if not met |
|---|---|---|
| 3.12.4 System Security Plan | A plan describing the boundary and how each requirement is met | Without an SSP, the assessment cannot proceed |
| 3.5.3 Multi-factor authentication | MFA for privileged accounts and for network access | 5, or 3 if only partly implemented |
| 3.13.11 FIPS-validated cryptography | FIPS-validated cryptography wherever it protects CUI | 5, or 3 if encryption is used but not FIPS-validated |
| 3.6.1 Incident handling | An operational incident-handling capability | 5 |
| 3.6.2 Incident reporting | Tracking, documenting and reporting incidents | 5 |
| 3.14.1 Flaw remediation | Identifying and correcting system flaws in time | 5 |
| 3.14.2 Malicious code protection | Protection against malicious code at designated locations | 5 |
| 3.14.6 Monitoring for attacks | Monitoring systems and traffic to detect attacks and indicators of attack | 5 |
When do you still post a self-assessed CMMC SPRS score?
Only where a contract requires it. Since Class Deviation 2026-O0025 Rev 3 (September 3, 2026), a self-posted score arises where a contract includes CMMC Level 2 (Self) under DFARS 252.204-7021, or where an existing contract still carries DFARS 252.204-7019 or 7020 until it is modified.
Every offer under DFARS 252.204-7008 still represents that you implement NIST SP 800-171, with or without a posted score DFARS 7012 guide →. DoW (DoD) is removing or revising CMMC requirements in its contracts; NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline. DCMA Medium and High results are posted by DoW and take precedence over any other assessment.
With fewer third-party assessments, DoW relies more on what contractors represent and on its own assessments. The number you post, or the representation in your offer, carries more weight, not less. Primes can also ask for your score when they choose subcontractors. CMMC status →
What you represent is a legal statement
Every offer under DFARS 7012 represents that you implement NIST SP 800-171. If that overstates what is actually in place, the False Claims Act can reach any contract that requires you to protect CUI, with treble damages plus per-claim penalties. The DOJ Civil Cyber-Fraud Initiative has pursued these cases since 2021, and the CMMC suspension did not pause it. False Claims Act risk →
How does SENTRE put evidence behind your score?
SENTRE is a managed CUI enclave built by ITG, based on the environment a C3PAO assessed at 110 of 110. Your enclave starts from requirements that are already implemented and documented, so the score you post and the controls you run describe the same thing.
The 110 requirements are implemented inside the enclave, and the Shared Responsibility Matrix shows which ones your team is responsible for. Evidence is produced by daily operations and organized by requirement: logs, changes, incidents, training records and scans.
Work instructions keep daily practice matched to your documentation, which is what an affirmation rests on. If DCMA conducts a Medium or High assessment, it looks at the same environment and the same evidence, not a separate set prepared for the visit. When something changes, the change is recorded in CENTRE and your SSP and score are updated with it, so the number you affirm next year is still true.
SPRS score FAQs
What is a good SPRS score?
110 is the maximum and means every requirement is implemented. A lower score means open items that belong on a plan of action with completion dates. What matters most is that the score matches what is actually in place, because a DCMA assessment can test it.
Do we still need to post a score?
Only where your contract requires it: CMMC Level 2 (Self) under 7021, or a legacy contract still carrying 7019 or 7020. Your offer still represents NIST SP 800-171 implementation under 7008, so the requirements apply whether or not a score is posted.
Who can see our SPRS score?
Authorized government users see summary-level scores in SPRS, and your company sees its own records. Scores are not published, but a prime can ask you for yours as part of choosing subcontractors, and DCMA assessment results are visible to the government users who rely on them.
What if our posted score is wrong?
Update your assessment and plan of action and correct the posted score as soon as you find the gap. An overstated score left in place is what creates legal exposure, so treat a correction as routine rather than something to defer.
How does a DCMA assessment affect our score?
DCMA Medium or High results are posted by DoW and take precedence over any other assessment, including your own self-assessment. If DCMA scores you lower than you scored yourself, the DCMA number is the one that counts for your contracts.
How long does a self-assessment last?
Self-assessments under the legacy clauses and under CMMC Level 2 (Self) run on a three-year cycle, and CMMC adds an annual affirmation by a senior official. Your contract’s clauses set the exact requirement, so check each active contract and note when each assessment and affirmation falls due.
See how SENTRE would put evidence behind the score you represent. Discovery is a no-obligation fit and integration review.