How to Calculate Your SPRS Score

Every DoD contractor handling CUI must calculate a cybersecurity score using the DoD Assessment Methodology and submit it to the Supplier Performance Risk System. Scores range from -203 to +110 — here's exactly how the math works and how to submit your results.

What Is SPRS and Why Does It Matter?

The Supplier Performance Risk System (SPRS) is a DoD database that aggregates contractor performance and risk data. Since November 2020, DFARS 252.204-7019 has required contractors to assess their implementation of NIST SP 800-171 and post the results to SPRS before contract award. Contracting officers can view your score during source selection — a low or missing score can be a disqualifying factor.

The score posted to SPRS is called a Cybersecurity Assessment score, sometimes referred to as a Basic Assessment score. It is calculated using the DoD Assessment Methodology, a point-deduction system applied against the 110 security requirements in NIST SP 800-171 Rev 2.

The Starting Point: 110 Points

Every contractor starts with a score of 110 — one point for each NIST 800-171 requirement, assuming full compliance. Points are deducted for each requirement that is not fully implemented. The deductions are not uniform: requirements are weighted based on their security impact, and the weighting table is published in the DoD Assessment Methodology document (available on the CMMC website).

Requirements range in weight from 1 point to 5 points. The highest-weight controls include multi-factor authentication, system access controls, and audit logging — areas where gaps create the most security risk. When you add up the maximum possible deductions across all 110 requirements, the total exceeds 310 points, which is why the minimum possible score is -203 (if every single requirement is unimplemented).

Scoring Partial and Planned Controls

Under the DoD Assessment Methodology, each of the 110 practices is scored in one of three ways:

Met: The control is fully implemented as described in NIST 800-171. No points are deducted.
Not Met: The control is not implemented. The full weight of that control is deducted from your score.
Planned: The control is not currently implemented but is documented in a Plan of Action and Milestones (POA&M) with a specific target completion date. In the Basic Assessment methodology, planned controls are still scored as Not Met — no partial credit is given for having a POA&M. However, the existence of a POA&M is required documentation for controls that are not Met.

This is a critical distinction that surprises many contractors: having a roadmap to implement a control does not improve your SPRS score. The score reflects the current state of implementation, not your intentions. The POA&M is still essential because it documents your path to compliance and is reviewed during C3PAO assessments, but it does not change the number posted to SPRS.

Walking Through the Calculation

Consider a simplified example. Suppose a contractor has implemented 95 of the 110 NIST 800-171 requirements. The 15 unimplemented requirements carry a combined weight (from the DoD weighting table) of 32 points. The contractor's SPRS score would be 110 minus 32, or 78.

To calculate your actual score, you need to go through each of the 110 NIST 800-171 requirements systematically, determine your implementation status for each, and apply the corresponding deduction from the weighting table. This process is documented in your System Security Plan and should be performed by personnel with detailed knowledge of your technical environment.

How to Submit to SPRS

To submit your score, you must have an active registration in SAM.gov and a SPRS account. The submission process requires a senior official (typically a company officer or the individual responsible for cybersecurity) to log into SPRS at sprs.pt.lu.mil using a CAC or ECA certificate, or through a PKI certificate. The submission includes your score, the assessment date, the scope of the assessment (what systems and facilities were included), and the date by which all POA&M items will be resolved.

Once submitted, the score is visible to DoD contracting officers. You can update the score at any time as your implementation improves. The DoD expects contractors to update their scores as they complete POA&M items and reach full compliance.

Common Mistakes to Avoid

The most frequent errors in SPRS score calculations are: claiming a control as Met when the implementation is incomplete or not documented; failing to scope the assessment correctly (leaving out cloud environments or remote access infrastructure); and submitting a score before completing the supporting SSP. The score and the SSP must be consistent — an assessor who finds your documented score does not match your actual implementation will flag the discrepancy, which can have serious contractual consequences.