Your SPRS score is a signed statement: what DoD suppliers should know before they post a number

A number with a name behind it

Most companies treat the SPRS score like a form field. Someone works through a spreadsheet, lands on a number, sends it in, and everyone goes back to shipping parts. Then a prime or a contracting officer looks it up, and that number starts speaking for the whole company.

That number is a representation your company makes to the Department of Defense about how you protect its information. Where a contract carries a CMMC Level 2 (Self) requirement, the program rule says the self-assessment in SPRS comes with an affirmation from an Affirming Official, defined as a senior level representative of the company who is responsible for compliance. The affirmation includes that person's name, title, and contact information, plus a statement that the company has implemented, and will maintain, the applicable security requirements for every system in scope. It is submitted after each assessment and again every year.

So before anyone posts or updates a score, make sure the person whose name goes on it understands what they are signing.

First, does this apply to you?

Not every manufacturer needs to think about SPRS. This applies if you hold DoD contracts or subcontracts that include DFARS 252.204-7012 and you receive, create, or store Controlled Unclassified Information (CUI), such as controlled drawings, specifications, or technical data. If you only handle Federal Contract Information, your baseline is the 15 basic safeguarding requirements in FAR 52.204-21 (CMMC Level 1). If you have no defense work at all, treat this as background reading.

If you are unsure which group you are in, read your contracts and flow-downs, then ask your prime and your counsel.

What the submission actually says

DFARS provision 252.204-7019 says that if you are required to implement NIST SP 800-171, you need a current assessment (generally not more than three years old) posted in SPRS for each covered system relevant to an offer in order to be considered for award. The companion clause, 252.204-7020, tells primes not to award subcontracts involving 800-171 unless the sub has at least a current Basic Assessment.

A Basic Assessment submission is more than a score. It includes:

• The version of NIST SP 800-171 you assessed against
• Who performed the assessment (for example, a contractor self-assessment)
• The CAGE codes tied to each system security plan
• The date the assessment was completed
• The summary score out of 110
• The date you expect to reach 110, based on your plans of action

Every line points back to a document: an SSP that covers those CAGE codes, a dated assessment, and a POA&M with dates someone could actually hit. The clause itself calls a Basic Assessment "Low" confidence because it is self-generated, and it requires contractors to give the government access to facilities, systems, and personnel if DoD decides to run a Medium or High assessment. Your self-score is where the conversation starts, not where it ends.

Phase 2 being suspended does not change this. The DoD CIO's About CMMC page says Phase 1 self-assessment requirements remain in place and that NIST 800-171 Rev 2 will be enforced through self-assessments and select government-led assessments.

"Implemented" means implemented

Under the CMMC scoring rule, a requirement counts as MET only when all of its assessment objectives are satisfied based on evidence, and that evidence has to be in final form. Drafts, working papers, and unofficial or unapproved policies do not qualify. A requirement that is not implemented is NOT MET whether or not it shows up on a POA&M. The POA&M is how you track the fix. It is not credit for the fix.

Scoring starts at 110 and subtracts 1, 3, or 5 points for each requirement not met, which means a score can go negative. MFA gets partial credit: if it covers remote and privileged users but not everyone, the deduction is 3 points instead of 5.

POA&Ms have limits, too. To reach a Conditional Level 2 (Self) status, the score has to be at least 80 percent of the total (88 of 110). Only certain 1-point items can sit on the POA&M, with a narrow exception for encryption that is in place but not FIPS-validated. Some requirements, including the system security plan itself, can never be on it. And the POA&M has to be closed out within 180 days or the conditional status expires.

Why the evidence cannot be built the month before

Much of 800-171 is not a setting you switch on. It is work you repeat and keep a record of:

• Reviewing audit logs and acting on what you find
• Running vulnerability scans and fixing the results
• Training people and tracking completion
• Reviewing access and removing what is no longer needed
• Recording changes to in-scope systems

A policy written last week says you intend to do these things. It does not show you have been doing them. If a reviewer asks for your last several log reviews or your last few rounds of scans, the only way to have them is to have started earlier. You cannot backdate a habit, and creating records after the fact is a far bigger problem than a lower score.

That is the case for starting now, even with no assessment on the calendar. Every month the controls run normally is a month of evidence you will not have to scramble for later.

How to sanity-check your number

Before you post or reaffirm, put the Affirming Official in a room with whoever did the scoring:

1. Which systems does this score cover? Can you point to the SSP and the CAGE codes?
2. For the 5-point controls marked MET, where is the proof? Pick three at random and pull the evidence on the spot.
3. Is MFA really everywhere you said it is? Include admin, remote, email, and vendor accounts.
4. Is encryption FIPS-validated where it needs to be, or simply turned on?
5. Do the POA&M dates support the "date to reach 110" you are submitting? Does every item have an owner?
6. What has changed since the last assessment? A new ERP, a cloud move, or a new building can each change scope.

If an answer is "I think so," score that control as not met until someone can show it. Since 2021, the Department of Justice's Civil Cyber-Fraud Initiative has used the False Claims Act to pursue contractors that knowingly misrepresent their cybersecurity practices. How that applies to your situation is a question for your counsel. The operating rule is simpler: post what you can prove.

What to do this quarter

• Confirm applicability. List the contracts that carry 7012 and map where CUI lives.
• Name the Affirming Official and make them part of the scoring, not just the signature.
• Rescore against reality using the NIST SP 800-171A objectives. Anything without final evidence is NOT MET.
• Rebuild the POA&M with owners, dates, and a monthly review.
• Start the recurring controls now so evidence builds on its own.
• Update SPRS if the score has changed, and calendar the annual affirmation.
• Budget the gaps. Our CMMC Level 2 cost breakdown can help frame the numbers.

For background, see our NIST 800-171 overview and CMMC Level 2 guide. For a quick first pass, the free compliance checklist takes about ten minutes.

A second set of eyes before you sign

If you want someone outside the company to walk through your score and the evidence behind it before your Affirming Official signs off, you can book time with our team. We will tell you plainly what holds up and what needs work.