Does a SPRS score expire?

SPRS scores do not have a formal expiration date, but contractors are required to maintain an accurate score that reflects their current implementation status. A score that was accurate when posted but no longer reflects current conditions due to system changes or lapses in control implementation should be updated. DoD assesses currency during contract performance reviews and formal assessments.

Can a contractor submit a bid with a SPRS score below 110?

Yes. There is no minimum score threshold that automatically disqualifies a contractor from bidding. However, Contracting Officers consider the score and associated POA&M as part of source selection risk assessment. A score significantly below 110 with a credible remediation plan is typically more competitive than the same score with no plan.

How does NIST SP 800-171 Rev 3 affect SPRS scoring?

The DoD Assessment Methodology currently governs scoring against NIST SP 800-171 Rev 2. Rev 3 restructures and adds requirements. DoD has indicated transition guidance will be issued; until that guidance is final and reflected in contract clauses, contractors should maintain their Rev 2 assessment and monitor DFARS updates for transition requirements.

How the SPRS Score Is Calculated Under 800-171

by Jessica D. Miller · 7 min read · 800-171 Remediation

The SPRS score runs from -203 to 110. Here is how each 800-171 requirement maps to a point value and what it signals to government customers.

What SPRS Is and Who Requires It

The Supplier Performance Risk System (SPRS) score is the numerical result of a self-assessment against all 110 requirements in NIST SP 800-171 Rev 2. Defense contractors handling Controlled Unclassified Information (CUI) are required to post their SPRS score in the SPRS database and maintain it as an accurate representation of their current implementation status. DFARS clause 252.204-7012 and the associated DoD Assessment Methodology establish this requirement.

Contracting Officers review SPRS scores during source selection. A low or missing score introduces risk to an award decision. A score that cannot be substantiated by a System Security Plan and supporting evidence during a DoD assessment creates compliance exposure that extends beyond the individual contract.

The Scoring Model

The maximum score is 110, representing full implementation of all 110 requirements. The score begins at 110 and decrements based on non-compliant requirements. Each requirement carries a point value of 1, 3, or 5 based on its criticality to CUI protection — as defined in the NIST SP 800-171 DoD Assessment Methodology documentation.

Partial implementation of a requirement does not receive partial credit under the DoD Assessment Methodology. A requirement is either implemented (no deduction) or not implemented (full deduction applied). The minimum possible score is -203, reached only if every requirement is non-compliant and all maximum deduction values are applied. In practice, most organizations starting an initial 800-171 assessment score between 50 and 95, with common gaps in access control automation, multi-factor authentication, and media protection controls reducing scores most frequently.

High-Value Controls

Three control families carry the highest aggregate point values and represent the most common scoring gaps for defense contractors:

Access Control (AC) contains 22 requirements covering account management, access enforcement, least privilege, and remote access controls. Automated account management, role-based access enforcement, and privileged account controls are consistently among the highest-value gaps in assessed organizations. Partial implementations — where policy exists but technical enforcement is absent — do not receive credit.

Identification and Authentication (IA) contains 11 requirements. Multi-factor authentication for privileged accounts and for network access from non-organizational systems each carry significant point values under the methodology. Implementing MFA is one of the highest-impact single steps a contractor can take to improve their SPRS score relative to the investment required.

System and Communications Protection (SC) contains 16 requirements. Architectural controls — network segmentation, CUI boundary definition, encrypted transmission for CUI in transit — appear in this family. These requirements tend to carry higher individual point values and require infrastructure investment, making them the costliest to remediate but also among the highest-scoring opportunities for organizations that have deferred them.

Self-Attestation and Its Limits

The DoD Assessment Methodology allows contractors to self-attest their SPRS score without an independent assessment. Self-attestation requires that the score be based on an honest, documented review of each requirement against actual system configurations — not an estimate. The System Security Plan must support the score; a score without a credible SSP is not defensible during a DoD assessment or a False Claims Act proceeding.

Medium and High assessments conducted by the Defense Contract Management Agency or other authorized organizations use the same methodology with independent verification. Discrepancies between self-assessed and independently assessed scores that suggest intentionally inflated self-reporting carry significant legal and contractual risk. The Department of Justice has pursued False Claims Act cases under this provision.

What to Do With a Low Score

A low SPRS score is a starting point, not a disqualification. Document the current score accurately, develop a Plan of Action and Milestones that reflects a realistic remediation schedule, and focus early remediation effort on the highest-value requirements achievable within existing budget and operational constraints. Posting an honest score with a credible POA&M is a stronger position than posting an inflated score that cannot be substantiated. Government customers and Contracting Officers understand that remediation takes time; they have less tolerance for scores that are demonstrably inconsistent with observable system configurations.

Verified on NIST SP 800-171 Rev 2 DoD Assessment Methodology.

Frequently Asked Questions

Does a SPRS score expire?: SPRS scores do not have a formal expiration date, but contractors are required to maintain an accurate score that reflects their current implementation status. A score that was accurate when posted but no longer reflects current conditions due to system changes or lapses in control implementation should be updated. DoD assesses currency during contract performance reviews and formal assessments.
Can a contractor submit a bid with a SPRS score below 110?: Yes. There is no minimum score threshold that automatically disqualifies a contractor from bidding. However, Contracting Officers consider the score and associated POA&M as part of source selection risk assessment. A score significantly below 110 with a credible remediation plan is typically more competitive than the same score with no plan.
How does NIST SP 800-171 Rev 3 affect SPRS scoring?: The DoD Assessment Methodology currently governs scoring against NIST SP 800-171 Rev 2. Rev 3 restructures and adds requirements. DoD has indicated transition guidance will be issued; until that guidance is final and reflected in contract clauses, contractors should maintain their Rev 2 assessment and monitor DFARS updates for transition requirements.

Work With Winston & Miller