What Is an SPRS Score? Understanding DFARS 252.204-7012, NIST 800-171, and CMMC Level 2 Requirements

Why Your SPRS Score Determines DoD Contract Eligibility

For defense contractors that handle Controlled Unclassified Information, cybersecurity compliance is a foundational requirement for working with the Department of Defense. One of the primary ways the government evaluates compliance is through the SPRS score.

Required under DFARS 252.204-7012, this score measures whether a contractor has implemented the security requirements defined in NIST Special Publication 800-171, which also serve as the basis for CMMC Level 2 requirements outlined in MAD Security’s overview of CMMC compliance. 

The SPRS score directly affects a contractor’s ability to compete for, retain, and renew Department of Defense contracts. It also serves as a key readiness indicator for Cybersecurity Maturity Model Certification Level 2. An unsupported, outdated, or inaccurate score can result in increased scrutiny, delayed awards, or loss of contract eligibility. 

This article explains what an SPRS score represents, how it is calculated, what documentation supports it, and why accuracy is essential. It also outlines how the score factors into CMMC Level 2 preparation and long-term contract viability. 

What Is An SPRS Score? A Clear Definition For DoD Contractors

SPRS refers to the Supplier Performance Risk System, a Department of Defense platform used to collect and assess contractor risk information, including cybersecurity posture. An SPRS score is the numerical result of a contractor’s required self-assessment against the 110 security requirements outlined in NIST SP 800-171, which are further explained in MAD Security’s breakdown of CMMC requirements. 

Scores range from -203 to +110. A score of +110 indicates that all 110 requirements are fully implemented with no deficiencies. Lower scores reflect gaps in implementation, with point deductions applied based on the severity and impact of each unmet requirement. 

Contractors are required to maintain an active, current SPRS score to demonstrate compliance with DFARS 252.204-7012. This obligation applies to both prime contractors and subcontractors that store, process, or transmit Controlled Unclassified Information. The score must be supported by verifiable documentation rather than estimates or plans. 

The Compliance Framework Behind The SPRS Score

The SPRS score stems directly from DFARS 252.204-7012, which requires contractors handling Controlled Unclassified Information to implement NIST SP 800-171. The clause mandates that contractors assess their security posture, document control implementation, and report the results to the Department of Defense.

NIST SP 800-171 defines 110 security requirements across 14 control families, including access control, incident response, audit and accountability, and system integrity. These same requirements form the foundation of CMMC Level 2 and are central to the guidance provided on MAD Security’s CMMC hub. 

Because of this alignment, the SPRS score functions as a practical snapshot of CMMC Level 2 readiness. When security requirements are not fully implemented, those deficiencies are reflected in the score. For organizations preparing for certification, the score helps identify areas where remediation is still needed. 

Understanding The DoD Scoring Methodology

The Department of Defense scoring methodology begins with a maximum of 110 points, representing full implementation of all NIST SP 800-171 requirements. Point deductions are applied for each requirement that is not fully implemented. 

Deductions fall into three categories: 

Requirements associated with access enforcement, multifactor authentication, audit logging, and system integrity typically carry higher deductions because failures in these areas introduce greater risk. 

As deficiencies accumulate, the overall score decreases. Negative scores indicate widespread gaps and limited security maturity. A score of +110 reflects full implementation and represents the expected benchmark for CMMC Level 2 certification. 

What You Must Have Before Calculating Your Score

Before calculating an SPRS score, contractors must have accurate and complete documentation. The most important artifact is the System Security Plan, which defines the system boundary and describes how each NIST SP 800-171 requirement is implemented. Developing and maintaining this documentation is a common focus of MAD Security’s CMMC consulting services. 

Contractors must also clearly identify which systems fall within scope for Controlled Unclassified Information. Poorly defined boundaries lead to inaccurate scoring and failed assessments. For each requirement, supporting evidence such as policies, configurations, logs, or screenshots should exist to validate implementation claims. 

During Department of Defense reviews, prime contractor validations, or CMMC assessments, the submitted score, the System Security Plan, and supporting evidence must align. Inconsistencies can raise concerns about compliance and credibility. 

How To Calculate And Submit An SPRS Score

Calculating an SPRS score requires a detailed review of each of the 110 NIST SP 800-171 requirements. For every requirement, contractors determine whether it is fully implemented, partially implemented, or not implemented. When a requirement is not fully implemented, the appropriate point of deduction is applied according to the Department of Defense scoring methodology.

Once all deductions are accounted for, the final score is submitted through the SPRS portal. Scores must be submitted at least annually and before contract award, and they must be updated when significant system changes occur. Both prime contractors and subcontractors are responsible for keeping their submissions current and accurate. 

Submitting a score represents a formal attestation that the assessment is accurate and supported by evidence. 

Prime Contractors’ Responsibility To Validate Subcontractor Scores

Prime contractors have additional obligations under DFARS when subcontractors handle Controlled Unclassified Information. Primes must ensure that subcontractors meet the same NIST SP 800-171 requirements, a responsibility often supported through structured validation processes described on MAD Security’s CMMC Authorized RPO page. 

This responsibility extends beyond collecting a numerical score. Prime contractors are expected to evaluate whether subcontractor scores are reasonable, current, and defensible. Unsupported or inflated scores increase risk across the supply chain. 

To manage this risk, primes often request System Security Plans, supporting documentation, or independent validation. Security gaps at the subcontractor level can affect contract eligibility for all parties involved. 

Required Score For CMMC Level 2 Certification

CMMC Level 2 certification requires full implementation of all 110 NIST SP 800-171 requirements. In practical terms, this means achieving a score of +110. Although limited Plans of Action and Milestones may be permitted under specific conditions, they cannot be used to defer high-weight requirements. Unresolved gaps in critical areas prevent certification. 

A score below 110 signals that remediation is still required. Contractors preparing for CMMC Level 2 should view the SPRS score as a readiness indicator rather than a minimum threshold. 

Why Your SPRS Score Affects Contract Awards And Renewals

Contracting officers consider SPRS scores as part of their broader risk evaluation process. Lower scores can raise concerns about a contractor’s ability to safeguard Controlled Unclassified Information, even when other qualifications are strong. Inaccurate scores present additional risk. If reviews reveal that documentation does not support the submitted score, consequences may include audits, corrective action requirements, or contract termination. 

Maintaining an accurate, defensible score helps reduce friction during procurement and renewal cycles while demonstrating a consistent commitment to compliance. 

Common Errors Contractors Make When Self-Scoring

Many contractors encounter difficulties due to avoidable mistakes. Common issues include misunderstanding requirement intent, marking controls as implemented without sufficient evidence, and relying on outdated System Security Plans. Other frequent problems involve poorly defined system boundaries and overlooked subcontractor dependencies. These issues often surface during audits rather than during internal reviews. 

Accurate scoring requires technical understanding, thorough documentation, and disciplined evaluation. Treating the process casually increases long-term compliance risk. 

How MAD Security Helps You Build A Defensible SPRS Score

MAD Security supports Department of Defense contractors by validating NIST SP 800-171 implementation and strengthening SPRS submissions. Services include System Security Plan development, evidence validation, and structured remediation planning, often paired with ongoing oversight through managed security services. 

By aligning technical controls with documentation, MAD Security helps organizations prepare for DFARS compliance and CMMC Level 2 certification. The objective is to produce a score that withstands scrutiny from prime contractors, auditors, and assessors. 

Preparing For A Defensible And Accurate SPRS Score

An SPRS score represents more than a numerical value. It reflects an organization’s cybersecurity posture and its ability to protect Controlled Unclassified Information. For contractors pursuing CMMC Level 2, accuracy and documentation are foundational, and many organizations rely on structured risk and compliance support to maintain that foundation. 

By understanding the scoring methodology, maintaining strong evidence, and addressing gaps early, organizations reduce compliance risk and improve contract readiness. Contractors that approach SPRS scoring with discipline are better positioned for sustained success within the defense industrial base. 

Frequently Asked Questions (FAQs)

Original Publish Date: February 17, 2026

By: MAD Security