Submitting Your SPRS Score: What DoD Contractors Need to Know About FCA Liability

The Score DoD Is Watching

The Supplier Performance Risk System (SPRS) is how the Department of Defense tracks your cybersecurity posture across the defense industrial base. Your SPRS Cybersecurity Assessment score — ranging from −203 to 110 — is visible to contracting officers when they review your bids. Under DFARS 252.204-7019, most DoD contractors are required to post a current score before contract award. There is no grace period and no minimum threshold to bid; the requirement is simply that a score exists and is accurate.

Many contractors don't realize their score is already on file — or that what they posted months ago may no longer reflect their actual environment. That gap is where legal exposure begins.

What the False Claims Act Actually Says

The False Claims Act (31 U.S.C. §§ 3729–3733) makes it illegal to submit a false or fraudulent claim to the federal government, or to make a false statement material to such a claim. In plain terms: if you certify something to the government that isn't true in order to obtain a contract or payment, you've potentially violated the FCA.

Submitting an inflated SPRS score — one that claims controls are implemented when they are not — is a false statement material to a government contract. The penalties are significant: up to three times the value of the contract, plus civil penalties of $13,000 to $27,000 per false claim. These aren't theoretical numbers.

In 2022, Aerojet Rocketdyne settled a False Claims Act case for $9 million after a whistleblower alleged the company had misrepresented its compliance with DFARS cybersecurity requirements while holding DoD contracts. The Health Net Federal Services case similarly put a spotlight on cybersecurity misrepresentation as an FCA trigger. The government has made clear it views inflated self-assessments as fraud, not paperwork errors.

The Three Most Common Submission Mistakes

Most SPRS submission problems aren't the result of deliberate fraud — they're the result of contractors not fully understanding what the score represents. The three patterns that create the most risk:

• Marking controls as implemented when they're only planned or partially done. Under the DoD Assessment Methodology, a control is either Met or Not Met. There is no partial credit for having started. If a control is documented in your POA&M but not yet technically implemented, it must be scored as Not Met — even if you plan to finish it next month.
• Submitting before your SSP is complete and current. Your SPRS score and your System Security Plan must tell the same story. If an assessor pulls both and finds contradictions — a control marked Met in your score that your SSP describes as planned — that discrepancy is a problem. The score is only as credible as the documentation behind it.
• Not keeping a record of what you submitted and when. If a contracting officer or auditor questions your score, you need to be able to show exactly what score you submitted, the date of your self-assessment, who authorized the attestation, and what your environment looked like at that time. Contractors who can't produce this record are in a much more difficult position to defend themselves.

Who Should Submit

The SPRS submission is a legal attestation. It must be made by someone authorized to bind the company — typically a senior executive, a CISO, or a formally designated authorized representative. It cannot be delegated to your IT vendor, a junior compliance analyst, or anyone who cannot personally attest to the accuracy of the score across the organization.

This matters because the attestation carries weight in any subsequent FCA action. The person who submitted the score is the person who made the representation. Before anyone clicks submit, they need to understand what they're signing and have direct visibility into the implementation evidence supporting the score.

What to Have Ready Before You Submit

Submitting without the right documentation in place is how contractors end up with indefensible scores. Before you post to SPRS, confirm you have:

• A completed, current System Security Plan that accurately describes your technical environment — not a generic template, but a document that reflects your actual systems, boundaries, and implemented controls as they exist today.
• A Plan of Action and Milestones (POA&M) that documents every control that is not yet fully implemented, with realistic target completion dates.
• Evidence for every control you've scored as Met. Screenshots of configurations, policy documents, training records, audit logs — whatever demonstrates implementation. Don't claim a control without being able to show it.
• A score calculated using the official DoD Assessment Methodology weighting table, not a rough estimate or a tool whose methodology you can't explain. The weighting table is publicly available and your score must be traceable back to it.

The Submission Process

SPRS submissions are made at sprs.csd.disa.mil. The process requires an active SAM.gov registration, a SPRS account tied to your CAGE code, and authentication via a DoD-approved PKI certificate or ECA certificate. Once logged in, you navigate to your CAGE code, enter your score, document the date of your self-assessment, and record the planned date by which all POA&M items will be resolved.

The portal is functional but not intuitive. Common errors include entering the assessment date incorrectly, associating the score with the wrong CAGE code if your company has multiple, and omitting the POA&M completion date. Each of these creates a record that may need to be corrected later — and corrections create a paper trail of their own.

Keeping Your Attestation Record

After you submit, immediately download or print a record of the transaction. At minimum, preserve: the score you submitted, the self-assessment date, the POA&M completion date you entered, and the name and title of the individual who authorized the submission. Store this with your SSP and POA&M in a compliance file you can retrieve on short notice.

This record is your first line of defense if a contracting officer ever questions your score, if a competitor files a protest, or if a qui tam relator — a whistleblower — brings an FCA action. The ability to show a documented, contemporaneous record of what you attested to and why is significantly more defensible than reconstructing it after the fact.

RegulatoryForge's SPRS Submission Wizard

RegulatoryForge's SPRS Submission Wizard is designed to reduce the risk of submission errors and make the process defensible. The wizard runs a preflight checklist against your Compliance Tracker data before you approach the portal, surfaces the FCA liability statement so the right authorized representative can review and acknowledge it, walks through the SPRS.mil submission steps with field-by-field guidance, and generates a downloadable attestation record at the end. The goal is that every submission is one you can stand behind if anyone ever asks.

Bottom Line

Your SPRS score is a legal attestation to the federal government about the state of your cybersecurity implementation. It is not a progress report, a best guess, or an aspirational target. Treat it with the same seriousness you'd give any sworn statement — because under the False Claims Act, that is effectively what it is. Get the documentation in order, have the right person submit, and keep a record. That's how you make a defensible submission.