How your SPRS score is calculated, and why the number on file may be wrong
SPRS is the Supplier Performance Risk System, the Department of Defense system of record where your NIST 800-171 self-assessment score is stored. Prime contractors and contracting officers can see it. For most DIB subcontractors, the number sitting in SPRS is the single most consequential compliance figure they have, and many do not know how it was derived or whether it still holds.
The scoring method, in plain terms
The DoD Assessment Methodology scores the 110 security requirements in NIST SP 800-171. It does not award points for what you have done. It starts you at a perfect score and subtracts for what you have not.
Each requirement is weighted 1, 3, or 5 points by risk
Subtract the weighted value of every requirement not fully met
Result range: 110 down to a floor of -203
A perfect, fully implemented environment scores 110. The weights are not equal: higher-risk requirements, such as multifactor authentication on privileged accounts, carry 5 points, so a single unmet high-weight control can move your score more than several minor ones. A few requirements allow partial credit under specific conditions. Because the deductions are weighted, two contractors with the same number of open controls can post very different scores.
Why the number on file is often wrong
An SPRS score is a self-attestation captured at a moment in time. It is a snapshot, not a live reading. It does not recalculate on its own when reality changes, and reality always changes:
- Configurations drift. A setting that was compliant at submission gets changed during normal operations.
- People turn over. The person who implemented a control leaves, and the control quietly lapses.
- The environment grows. New systems, new SaaS tools, and new endpoints enter scope without being assessed.
- The original score was optimistic. Self-scoring without measured evidence tends to overstate readiness.
Reported score versus your measured evidence
When a C3PAO assesses you, they do not take the SPRS number at face value. They measure your live environment against the same 110 requirements and compute what they find. If that measured number is lower than what is on file, the conversation stops being about certification and starts being about why the attested score was wrong. The way to avoid that conversation is to measure your own posture before anyone else does.
Find out what your environment actually scores
The free gap check gives you a directional read against the 110-control baseline in about 2 minutes. The CMMC Readiness Snapshot measures your environment against all 110 NIST 800-171 controls and returns a PDF within minutes of intake, for $799 one time.
Enclave AI™ builds AI-driven CMMC Level 1 and Level 2 readiness software. We are not a C3PAO and we will not seek C3PAO authorization, that separation is permanent. The free gap check is a directional self-assessment and is not an official SPRS score. Patent Pending. ElasticD3M, LLC, Texas.