If you hold a DoD contract that involves controlled unclassified information, you probably have a number in the Supplier Performance Risk System, or SPRS. It is a summary of how much of NIST SP 800-171 you have implemented, and contracting officers can see it before they award.
The number is simple to read and easy to get wrong. It starts at 110, can go far below zero, and ignores whatever is on your plan of action. This article covers what the score is, how it is calculated, what the three assessment levels mean, what you post, and how to keep the score defensible. It uses the DoD Assessment Methodology as published. Check your contract and current DoD guidance for anything that has changed since.
Where the score comes from
Two DFARS clauses create the obligation.
DFARS 252.204-7019 is a solicitation provision. It requires an offeror subject to DFARS 252.204-7012 to have a current assessment posted in SPRS for each covered contractor information system relevant to the offer. Current means not more than three years old, unless the solicitation sets a shorter period.
DFARS 252.204-7020 is the contract clause. It requires you to give DoD access for deeper assessments if asked, and to flow the requirement down to relevant subcontractors.
SPRS itself is a DoD application. Contractors reach it through DoD's Procurement Integrated Enterprise Environment, with a role that permits entering assessment results. Set that access up well before a proposal is due.
How the score is calculated
The DoD Assessment Methodology scores against the 110 requirements in NIST SP 800-171 Rev. 2.
Start at 110, the maximum score.
Subtract a weight for each requirement not implemented. Each requirement carries a weight of 5, 3, or 1 points, reflecting how much its absence would affect the security of the system and the CUI it holds.
Do not add anything back for a plan of action. A requirement on your POA&M is still not implemented and still loses its points.
The result can be negative. If nothing were implemented, the score would be -203, the lowest possible.
A requirement counts as implemented only when every one of its assessment objectives, as set out in NIST SP 800-171A, is met. Partial implementation generally earns nothing. A handful of requirements are exceptions with partial deductions written into the methodology. The best known is 3.13.11: if you encrypt CUI but the cryptography is not FIPS-validated, the deduction is smaller than if you do not encrypt at all.
The system security plan is a special case. Without one, the methodology treats the assessment as impossible to complete, so there is no valid score at all.
Weights matter for prioritization. The 5-point requirements include many of the foundational ones, such as multi-factor authentication, audit logging, and boundary protection. Closing a few of them moves the score far more than closing many 1-point items. Use the published weights to order your plan of action, while remembering that the weights measure scoring impact, not your specific risk.
Basic, Medium, and High assessments
The methodology defines three assessment levels, which differ in who performs them and how much confidence DoD can place in the result.
| Level | Who performs it | What it involves | Confidence |
|---|---|---|---|
| Basic | The contractor | Self-assessment against the methodology, based on the system security plan | Low |
| Medium | DoD | Review of the Basic assessment, the plan, and descriptions of how requirements are met | Medium |
| High | DoD | Medium-level review plus verification, examination, and demonstration, on site or virtually | High |
Every contractor subject to DFARS 252.204-7019 needs at least a Basic assessment. Medium and High assessments are conducted by DoD, through the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), at DoD's choice. DFARS 252.204-7020 is the clause that obliges you to give access when DoD chooses.
"Low confidence" is not a criticism. It describes the method: DoD knows a self-assessment is a self-assessment. That is the gap CMMC was created to close.
What you post
For a Basic assessment, DFARS 252.204-7019 lists what goes into SPRS. In summary:
- Not done:
the standard assessed, NIST SP 800-171
- Not done:
who conducted the assessment, which for a Basic assessment is you
- Not done:
for each system security plan, the CAGE codes it covers and a brief description of its architecture
- Not done:
the date and level of the assessment
- Not done:
the summary score
- Not done:
the date by which you expect to reach 110, based on your plans of action
The CAGE code mapping is easy to get wrong. If your company has several CAGE codes and more than one system security plan, each code needs to be tied to the plan that covers the work done under it. The completion date needs to be supported by an actual plan of action with real milestones; our guide to writing a POA&M assessors accept covers that.
The score and CMMC
CMMC builds on the same foundation. Level 2 assessments, whether self-assessed or performed by a certified third-party assessment organization, are scored using the method in 32 CFR 170.24, which follows the same weighted approach. Results are recorded so they are visible in SPRS. The CMMC scoring rules differ from the DoD Assessment Methodology in places, and CMMC sets a minimum score for conditional status, so read the rule text rather than assuming the two are identical. Our CMMC framework page explains how the program is structured.
Keeping the score honest
The score is a representation to the government. Treat it with the care that implies.
Score the whole scope. A requirement is implemented only if it is met across every in-scope asset. MFA on most systems is MFA not implemented. Your CUI scoping defines what "every" means.
Use the assessment objectives. Test each requirement against its 800-171A objectives, not against your recollection of what was configured.
Keep the worksheet. Record, for each requirement, met or not met, the evidence you relied on, who assessed it, and the date. That record is what you will need if anyone asks how you reached the number.
Make the plan match. The score and your system security plan should describe the same system in the same state.
Update when things change. Nothing stops you from posting a new assessment after you close gaps, and a stale score helps nobody. If your implementation gets worse, for example after an acquisition brings new systems into scope, reassess.
A few scoring errors come up repeatedly in self-assessments. Counting a requirement as met because a policy exists, when the technical control is not in place everywhere. Marking requirements not applicable without a reason that would survive questioning. Posting one score against every CAGE code when the plan behind it covers only part of the business. Each of these produces a number that a Medium or High assessment would not reproduce, and DoD posts the results of those assessments in SPRS too.
Overstating a score has consequences beyond a failed audit. The Department of Justice has pursued False Claims Act cases involving misrepresented cybersecurity compliance by federal contractors. Where your situation raises a legal question, confirm with counsel. The practical advice is the same either way: post the number your evidence supports.
How TrustLynce helps
TrustLynce tracks each 800-171 requirement with its implementation status, owner, and evidence, collected on a schedule from connected systems, so the inputs to your score are documented and dated. The readiness dashboard shows gaps per framework. See the readiness dashboard.