How SPRS Scoring Works, Plus a Free NIST 800-171 Score Worksheet

If you hold a Department of War contract with DFARS 252.204-7012 in it, you have a number sitting in the Supplier Performance Risk System (SPRS). That number is your NIST SP 800-171 self-assessment score. It runs from 110 down to -203, and DoD personnel can see it.

Most small suppliers we talk to know they have a score. Far fewer can explain how it was calculated, who calculated it, or what evidence backs each line. That gap is where the risk lives. So we built a free worksheet that does the math the way the DoD methodology does it, and this guide explains how to use it.

Download the worksheet: SPRS Score Worksheet (Excel, auto-calculating) | Printable PDF version. Both list all 110 NIST SP 800-171 Rev. 2 requirements with their DoD point values, a status column, evidence notes and plan of action (POA&M) columns.

Key takeaways

• Your SPRS score comes from the DoD NIST SP 800-171 Assessment Methodology, Version 1.2.1. You start at 110 and subtract 5, 3 or 1 point for each requirement you have not implemented.
• Partial credit exists for only two requirements: multifactor authentication (3.5.3) and FIPS-validated cryptography (3.13.11). Everything else is met or not met.
• A plan of action does not earn points. The methodology is explicit that unimplemented requirements are scored as not implemented, whether or not a plan exists.
• CMMC Phase 2 was suspended on July 13, 2026, but DFARS 252.204-7012 and the SPRS self-assessment still apply (WilmerHale).
• The Justice Department settled two False Claims Act cases over NIST SP 800-171 compliance this year, for $507,144 and $2,042,518. Both resolved allegations only.

How SPRS scoring works

The scoring rules are in Section 5 of the DoD Assessment Methodology, and the point value for every requirement is in its Annex A. The requirements themselves come from NIST SP 800-171 Rev. 2, which has 110 of them across 14 families.

The math is simple. If every requirement is implemented, you score 110. For each requirement that is not, you subtract its value. The methodology weights requirements by how much damage a gap could do:

• 5 points for requirements that, if missing, could lead to significant exploitation of the network or exfiltration of CUI. Examples include limiting system access to authorized users (3.1.1), incident handling (3.6.1) and vulnerability scanning (3.11.2). There are 42 of these.
• 3 points for requirements with a specific and confined effect, such as encrypting CUI on mobile devices (3.1.19) or screening people before granting access (3.9.1). There are 14.
• 1 point for the remaining 51 requirements, which have a limited or indirect effect, such as preventing reuse of identifiers (3.5.5).

Add up every possible deduction and you get 313 points, which is why the floor is -203. That range shows up in real enforcement: the Justice Department noted that one contractor's DCMA assessment came in at -170, "at the low end of the possible score range of -203 to 110" (DOJ).

The two partial-credit requirements

The methodology says it is "not designed to credit partial implementation," with two exceptions:

• 3.5.3, multifactor authentication. Subtract 3 points if MFA covers remote and privileged users but not general users. Subtract 5 if MFA is not implemented for any users.
• 3.13.11, FIPS-validated cryptography. Subtract 3 points if you encrypt CUI but the cryptography is not FIPS-validated. Subtract 5 if you do not encrypt where it is required.

The system security plan has no points, and that is not good news

Requirement 3.12.4, the system security plan (SSP), carries no point value. But without one, the methodology says the result is a finding that "an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012." In other words, no SSP means no valid score at all.

Basic, Medium and High assessments

A score you calculate yourself is a Basic Assessment. Under DFARS 252.204-7020, it carries a confidence level of "Low" because it is self-generated. Medium and High Assessments are conducted by the government, and the same clause requires you to give the government access to your facilities, systems and personnel if it decides to run one. Scoring is the same at every level, so a government assessor will use the same values you use.

What actually gets posted in SPRS

SPRS does not hold your line-by-line answers. Annex B of the methodology and DFARS 252.204-7019 list what you submit for each system security plan:

• The standard assessed (NIST SP 800-171) and who did the assessment
• The date the assessment was completed
• The summary score, for example 95 out of 110
• The SSP it covers and every CAGE code mapped to it
• The date you expect to reach 110, based on your plans of action

Under DFARS 252.204-7019, an offeror must have a current assessment, meaning "not more than 3 years old unless a lesser time is specified in the solicitation," to be considered for award. DFARS 252.204-7020 also says a prime may not award a covered subcontract unless the subcontractor has completed at least a Basic Assessment within the last 3 years. If you are a subcontractor, your primes are checking. The SPRS reference page explains how to enter scores.

The scoring mistakes we see most

"Standard IT" treats the SPRS score as a form to fill out. Defensible IT treats it as a statement you may have to prove line by line. These are the mistakes that separate the two.

1. Counting partly done as done. The methodology's own example: an MFA roll-out that is 75% complete, with a plan of action still underway, is scored as not implemented. Partial credit only applies in the two specific cases above.
2. Scoring a POA&M item as met. The methodology states that plans of action "are not a substitute for a completed requirement." The narrow exception is a temporary deficiency that arises after a requirement was implemented, such as a patch that breaks a FIPS validation, which can be scored as implemented while a plan of action fixes it.
3. Assuming AES means FIPS-validated. Using an approved algorithm is not enough for 3.13.11. The methodology says the cryptographic module itself must be validated under FIPS 140.
4. Claiming not applicable without a policy. If you do not permit remote access, wireless access or mobile device connections, you do not lose points on 3.1.12, 3.1.13, 3.1.16, 3.1.17 and 3.1.18. But the methodology expects a policy and procedure that keeps those capabilities from being turned on by accident.
5. Forgetting 3.12.2. If you have gaps but no plan of action for them, 3.12.2 itself is scored as not implemented, which costs another 3 points.
6. Getting the scope wrong. Every CAGE code has to map to an SSP, and the SSP has to describe the system where CUI actually lives. Cloud email, file sharing and the shop-floor PC that stores drawings all count if CUI is on them.
7. Letting the score go stale. A score older than three years does not meet DFARS 252.204-7019. And a score that was accurate when you posted it can drift as staff, systems and vendors change.

Why accuracy matters more than the number

Your posted score is a representation to the government. When a company bills on a contract that requires these controls and its systems do not match what it reported, the government can pursue the claims under the False Claims Act. The law provides for civil penalties plus "3 times the amount of damages" the government sustains (31 U.S.C. § 3729). The Justice Department launched its Civil Cyber-Fraud Initiative in 2021 specifically to use the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices.

Two 2026 settlements show how this plays out:

• LOGZONE Inc. of Huntsville, Alabama agreed on June 18, 2026 to pay $507,144. The government alleged that from May 2021 to March 2025 it failed to implement NIST SP 800-171 controls on two Navy contracts. A DCMA assessment had scored the company -170 (DOJ press release).
• Honeywell Aerospace Inc. agreed on September 1, 2026 to pay $2,042,518 to resolve allegations that a Honeywell business unit failed to meet NIST SP 800-171 requirements on one of its networks from April 2020 through December 2023. The case began as a whistleblower suit by a former employee, who will receive $375,823 (DOJ press release).

In both cases, the Justice Department notes that the claims resolved are allegations only and there has been no determination of liability. The lesson for a 40-person machine shop is not that you will be sued. It is that a score you cannot back up with evidence is a liability, while a lower score you can explain, paired with a real plan, is defensible.

What the CMMC Phase 2 pause did and did not change

On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required third-party certification assessments starting November 10, 2026. According to WilmerHale's analysis, the suspension does not touch Phase 1 self-assessment requirements or DFARS 252.204-7012. The Department said it will enforce NIST SP 800-171 Rev. 2 "through self-assessments and select government-led assessments" while a task force reviews the program.

Nothing in the suspension changed the DFARS clauses behind the SPRS score, and WilmerHale notes contractors must still post their self-assessment scores in SPRS. DFARS 252.204-7012 still requires you to implement NIST SP 800-171 and to report cyber incidents within 72 hours. DFARS 252.204-7019 and 252.204-7020, both still in their November 2023 versions, require a current assessment posted in SPRS. We covered the pause in more detail in CMMC Phase 2 Is Paused. Your NIST 800-171 Score Still Counts.

How to use the worksheet

1. Make one copy per system security plan. Fill in your company, CAGE codes, SSP name and assessment date on the Summary tab.
2. Score what is true today. On the Worksheet tab, choose a status for every row: Met, Not Met, Partial (only offered on 3.5.3 and 3.13.11) or N/A - not permitted (only offered on the five remote, wireless and mobile rows).
3. Write down the evidence for every Met. A screenshot, a policy, a configuration export or a ticket. If you cannot point to it, it is probably not met.
4. Fill in the POA&M columns for every gap. Add the action, an owner and a target date. The Summary tab uses the latest target date as your planned date to reach 110.
5. Read the Summary tab. It shows your estimated score, points lost by family, how many rows are still blank and a warning if 3.12.4 is marked Not Met.
6. Check it against the source. The worksheet is an aid, not a substitute for the methodology or the NIST SP 800-171A assessment procedures. Have someone other than the person who did the work review it before you post.

Every point value in the worksheet was transcribed from Annex A of the methodology and cross-checked against the 5-point and 3-point lists in Section 5. The Sources tab links to both documents.

A 30-day plan for small defense suppliers

Days 1 to 7: Scope and SSP

List every system, cloud service and person that touches CUI. Confirm your CAGE codes. If your SSP is missing or out of date, start there, because nothing else counts without it.

Days 8 to 14: Score with evidence

Work through the worksheet one family at a time with the people who run each system. Mark anything you cannot prove as Not Met for now.

Days 15 to 21: Close the cheap 5-point gaps

Sort the Not Met rows by value. Items like MFA (3.5.3), malicious code protection updates (3.14.4) and audit logging (3.3.1) can often be fixed quickly, and each one recovers up to 5 points.

Days 22 to 30: Plan, review and post

Write a plan of action for every remaining gap so 3.12.2 holds up. Have leadership review the result, then post the summary score and your planned completion date in SPRS. Put a reassessment date on the calendar.

Frequently asked questions

What is a good SPRS score?

The DoD methodology does not set a passing score. The goal is 110, and the requirement is accuracy. For CMMC Level 2 self-assessments, conditional status requires a score of at least 80% of the maximum, which is 88, and limits which gaps can sit on a POA&M (32 CFR 170.21).

Can we claim points for work that is in progress?

No. The methodology says requirements not implemented are scored as not implemented whether or not a plan of action is in place. Only the two built-in partial-credit cases, 3.5.3 and 3.13.11, give partial points.

How often do we need to update our SPRS score?

DFARS 252.204-7019 requires an assessment not more than three years old unless the solicitation sets a shorter period. Updating sooner when your systems change keeps the score accurate, which is the point.

Is a negative SPRS score illegal?

No. The methodology expects that some scores will be negative; it says subtracting unmet requirements "may result in a negative score." An honest low score with a plan is far better than an inflated one. The legal risk in the 2026 settlements came from alleged gaps between required controls and actual practice, not from a low number alone.

Does the CMMC pause mean we can skip this?

No. The pause covers Phase 2 third-party certification. DFARS 252.204-7012, the SPRS self-assessment and Phase 1 requirements remain in effect.

Who should fill out the worksheet?

Someone who knows your systems, with evidence from the people who run them. An outside reviewer helps, because the person who built a control is rarely the best judge of whether it is fully implemented.

Get a second set of eyes

Emry Networks helps small and mid-sized defense suppliers build NIST SP 800-171 assessments they can defend, with evidence behind every line. See how we work with defense contractors preparing for CMMC, or call (603) 202-3200.

Book a 30-Minute Risk Assessment

This guide and worksheet are a self-assessment aid, not legal advice. Check your contract terms and consult qualified counsel about your specific obligations. Sources verified October 31, 2026.