Updated September 2026
SPRS Score: NIST 800-171 Scoring
The Supplier Performance Risk System (SPRS) score is a 110-point self-assessment of NIST SP 800-171 implementation status required by DFARS 252.204-7019. It interlocks with the CMMC 2.0 implementation timeline and remains in force regardless of the Phase 2 suspension: with the mandatory C3PAO requirement (was November 2026) paused pending a DoD review, self-assessed SPRS scoring is still the operative Level 2 mechanism.
The 110-point scoring math
DoD's Assessment Methodology assigns a weight to each of the 110 NIST SP 800-171 requirements. The score starts at 110 (full implementation) and decreases as unimplemented controls are deducted.
| Weight | Example requirement families | Deduction per unimplemented |
|---|---|---|
| High | MFA on privileged accounts, FIPS-validated encryption, audit logging on CUI | -5 points |
| Medium | Access controls, configuration management, vulnerability scanning | -3 points |
| Low | Policy documentation, awareness training, low-risk physical security | -1 point |
Reference: DoD Assessment Methodology (DAM) v1.2.1 in the NIST SP 800-171 ecosystem, accessible via DoD CIO CMMC programme office.
What does 110 mean
110 is the maximum SPRS score and means every NIST SP 800-171 requirement is fully implemented at the time of self-assessment. It does not certify ongoing compliance, does not authorise CMMC certification, and would not substitute for the Phase 2 C3PAO assessment once that requirement is in force (its scheduled November 10, 2026 start was suspended by DoD on July 13, 2026 pending review).
A score below the contracting officer's threshold (commonly 80, 100, or 110 depending on contract value and CUI sensitivity) can disqualify a bid, defer award until a POA&M is in place, or trigger a flow-down obligation to subcontractors.
Common SPRS scoring errors
Partial implementation scored as implemented
A control implemented on some assets but not all should score as unimplemented unless a POA&M closes the gap on the remaining assets. Partial credit is not the rule.
Missing the POA&M caveat
POA&M is acceptable up to the contracting officer's threshold, but partial implementation with a POA&M is still scored as unimplemented; the POA&M is the bridge, not the score.
Miscounting MFA on privileged accounts
MFA on privileged accounts is a high-impact requirement and deducts 5 points when unimplemented. Contractors sometimes score this as medium and lose the bid threshold.
Inherited-control miscounting
Controls inherited from a cloud service provider (CSP) must be documented in the SSP with the responsibility matrix. Counting CSP-provided controls as fully implemented without inheritance documentation is a common audit finding.
Stale score
SPRS scores should refresh on material in-scope changes (new system, new CUI flow) or at least annually. A stale score is grounds for re-bid in solicitation review.
Confusion with the CMMC level score
SPRS uses the 110-point NIST SP 800-171 score, not the CMMC Level (1, 2, 3). The two are related but not the same; Level 2 contractors should report both during the transition to Phase 2.
SPRS and the Phase 2 timeline
- Phase 1 (since November 2025) requires Level 1 and Level 2 self-assessments in new DoD solicitations. SPRS is the channel for both.
- Phase 2, which would mandate C3PAO certification for Level 2, was scheduled for November 10, 2026 but DoD suspended it on July 13, 2026 pending a Reform Task Force review. Until it is reinstated, SPRS self-assessment remains the operative Level 2 mechanism.
- Phase 3 (was 2027) would extend C3PAO certification to option exercises and add Level 3 DIBCAC assessment requirements. It is part of the suspended schedule now under review.
- Phase 4 (was 2028) would apply CMMC certification to all DoD contracts. It is also part of the suspended schedule.