Plenty of contractors have submitted a score to the Supplier Performance Risk System without ever walking through how that number actually gets built. That’s not unusual, and it’s not necessarily a problem on its own, but it does mean the score sitting in SPRS right now may be less examined than the contract decisions that depend on it. 

What SPRS Is 

The Supplier Performance Risk System is the DoD database where contractors report their NIST SP 800-171 compliance score under DFARS 7012. A prime contractor, a contracting officer, or DIBCAC can all pull that score when evaluating a company’s risk posture, which means it functions less like an internal compliance record and more like a public-facing credit score within the defense supply chain. 

How the Score Gets Built 

The DoD’s assessment methodology starts from a maximum of 110 points, one for each NIST SP 800-171 control, and deducts points for every control that isn’t fully implemented. Not every control is weighted equally; some deductions are worth more than others based on how much risk that specific control addresses, which means two contractors with the same number of unmet controls can land on meaningfully different scores. A score isn’t a percentage of controls met, it’s a reflection of which controls are missing and how much each one matters. 

Where Scores Usually Go Wrong 

The most common issue isn’t dishonesty, it’s imprecision. A control that’s partially implemented, a policy that exists but isn’t consistently followed, an access control that’s configured correctly in production but not in a secondary environment, often gets counted as fully met because it’s mostly true. A POA&M item that was addressed months ago but never had its remediation actually verified sometimes gets treated as resolved in the score even though nobody confirmed the fix held. Neither of these is fraud. Both of them produce a score that doesn’t match reality, which is exactly the gap a DIBCAC review is built to find. 

A Practical Walkthrough for Checking Your Own Score 

  • Pull your current System Security Plan and go control by control against the actual 110, not from memory or a summary. 
  • For every control marked fully implemented, ask whether there’s evidence you could hand someone today, not just a policy statement. 
  • For every open POA&M item, confirm it has a real owner and a real date, and recalculate your score as if every item without both were still fully open. 
  • Compare the resulting number to what’s currently reported in SPRS, and treat any gap as the thing worth addressing first, not the score itself. 

Why This Matters Beyond the Number 

An inflated score doesn’t just misrepresent your posture on paper. It’s the specific gap DOJ has pursued in multiple False Claims Act settlements against defense contractors this year, and it’s what a DIBCAC review is built to catch. A score that’s a few points lower but fully defensible is a stronger position than a higher score nobody could actually walk an assessor through. 

Common Questions About SPRS Scoring 

Do I need a QSA-equivalent third party to calculate my SPRS score? No. A Basic Assessment is self-conducted and self-reported; a third party isn’t required, though many contractors bring one in for an objective second look, particularly before a contract renewal or a known review. 

How often does an SPRS score need to be updated? Self-reported scores are expected to reflect current reality, and the assessment behind a Basic score generally shouldn’t be treated as valid indefinitely; a stale score that no longer matches your environment carries the same risk as an inaccurate one. 

Does a lower score hurt my chances of winning a contract? A defensible, accurate score is a stronger position than an inflated one that couldn’t survive a review. Contracting officers and primes are increasingly aware that a suspiciously perfect score invites scrutiny rather than confidence. 

What’s the difference between a Basic, Medium, and High Assessment? A Basic Assessment is self-conducted and self-reported. Medium and High Assessments are conducted by the government, generally carry more weight in SPRS, and are described further in our guide to how a DIBCAC review actually works. 

Contact us to schedule a scoping call, or read the full readiness guide for a practical framework covering every stage from scoping through ongoing monitoring.