New advisory HARDAC-ADV-2026-01 FIPS 140-2 Certificates Are Now Historical: What Changes for CMMC Control 3.13.11 All advisories
HARDAC Industries LLC
NIST SP 800-171 · DFARS

How SPRS scoring works.

The DoD Assessment Methodology turns 110 security requirements into one number. Here is how that number is calculated, and what it takes to defend it.

HARDAC IndustriesOctober 20, 20266 min read

Key points

  • Every score starts at 110 and loses 5, 3, or 1 point for each requirement not implemented.
  • A plan of action does not count as an implemented requirement.
  • Without a system security plan, an assessment cannot be completed at all.

What SPRS is

The Supplier Performance Risk System (SPRS) is the Department's authoritative source for supplier and product performance information. For cybersecurity, it holds the summary-level score from your NIST SP 800-171 DoD Assessment, which acquisition officials use to evaluate contractors that handle Controlled Unclassified Information.

Who needs a score

Under DFARS 252.204-7019, an offeror that is required to implement NIST SP 800-171 must have a current assessment for each covered contractor information system relevant to the offer in order to be considered for award. "Current" means not more than three years old, unless the solicitation specifies a shorter period.

Basic, Medium, and High assessments

DFARS 252.204-7020 defines three assessment levels. All three use the same scoring methodology. They differ in who performs them and how much confidence the government places in the result.

Basic
A self-assessment by the contractor, based on its system security plan. Confidence level: Low.
Medium
A government review of the Basic Assessment, a thorough document review, and discussion with the contractor. Confidence level: Medium.
High
Everything in a Medium Assessment, plus government verification, examination, and demonstration that the requirements are implemented as described. Confidence level: High.

How the score is calculated

A contractor that implements every requirement scores 110, one point for each NIST SP 800-171 security requirement. For each requirement not implemented, a weighted value is subtracted. The score can go below zero.

−5Requirements whose absence could lead to significant exploitation of the network or exfiltration of CUI, such as limiting access to authorized users (3.1.1).
−3Requirements with a specific and confined effect, such as encrypting CUI on mobile devices (3.1.19).
−1All remaining derived requirements, which have a limited or indirect effect, such as preventing reuse of identifiers (3.5.5).

The methodology does not give credit for partial implementation, with two exceptions described below. A requirement that is 75 percent rolled out is scored as not implemented.

The two requirements with partial credit

  • Multi-factor authentication (3.5.3). 3 points are subtracted if MFA is implemented only for remote and privileged users; 5 points if it is not implemented for any users.
  • FIPS-validated cryptography (3.13.11). Where encryption is required to protect CUI, 3 points are subtracted if encryption is used but not FIPS validated; 5 points if no encryption is used. Using an approved algorithm is not enough; the cryptographic module itself must be validated under FIPS 140.

System security plans and plans of action

The methodology is built on review of your system security plan, required by security requirement 3.12.4. Without one, the assessment cannot be completed, and the result is a finding of noncompliance with DFARS 252.204-7012.

Plans of action, required by 3.12.2, must describe how and when each unimplemented requirement will be met. They are not a substitute for implementation: a requirement with a plan of action is still scored as not implemented. A missing plan of action causes 3.12.2 itself to be scored as not implemented.

The methodology allows two narrow exceptions. A temporary deficiency, such as a patch that invalidates a module's FIPS validation after implementation, can be scored as implemented when an appropriate plan of action addresses it. An isolated enduring exception, such as specialized manufacturing equipment, can be scored as implemented when it is described with its mitigations in the system security plan.

What you submit

For a Basic Assessment, DFARS 252.204-7019 lists what must be reported for posting in SPRS:

  • The standard assessed and the organization that conducted the assessment.
  • For each system security plan, the CAGE codes it covers and a brief description of its architecture if there is more than one plan.
  • The date the assessment was completed.
  • The summary-level score, such as 95 out of 110, not the value of each requirement.
  • The date by which all requirements are expected to be implemented, based on your plans of action.

Your SPRS score is a representation to the government, so it should be one you can defend line by line. HARDAC calculates scores using the DoD Assessment Methodology and builds the documentation behind them. Learn about our NIST SP 800-171 services.

Get started

Get a score you can defend.

Tell us about the CUI you handle and your current score, if you have one.

Book a consultation