Fettle logoFETTLEPeople · Process · Proof
Sign inStart Free Trial

SPRS Scores and CMMC Self-Assessments, Explained

Last reviewed by Fettle Editorial Team

What SPRS is

The Supplier Performance Risk System (SPRS) is the DoD system where contractors' cybersecurity assessment results are recorded. Contracting officers check it before award and before exercising options. If the result they need is not there, or is out of date, the contract cannot move forward.

Two kinds of entries matter here, and they are easy to confuse:

  • The NIST SP 800-171 DoD Assessment score, required by DFARS 252.204-7019 and 252.204-7020 for contracts that include DFARS 252.204-7012. Most contractors post a "Basic" assessment, which is a self-assessment. It must not be more than three years old.
  • CMMC assessment results: your CMMC level, status, and scope, posted for Level 1 and Level 2 self-assessments (and by the assessor for certifications), together with an affirmation.

How the score works

The Level 2 score uses DoD's scoring methodology:

  • You start at 110, one point for each NIST SP 800-171 requirement.
  • Each requirement not met subtracts 1, 3, or 5 points, depending on how much its absence would expose you. The worst possible score is negative.
  • A few requirements give partial credit. For example, multi-factor authentication used only for remote and privileged users costs 3 points instead of 5; encryption that is not FIPS-validated costs 3 instead of 5.
  • A requirement that genuinely does not apply in your environment is treated as met.
  • A plan of action does not count as a requirement met. It records how and when you will fix it.

Each requirement is broken into smaller assessment objectives in NIST SP 800-171A (320 of them across the 110 requirements). A requirement is met only when all of its objectives are.

Running a self-assessment

  1. Define your scope. Which systems, people, and locations handle the information? See Scoping and enclaves.
  2. Have a current System Security Plan. Without one, the assessment cannot be completed. See What is an SSP?
  3. Work through every assessment objective. For each, decide met or not met, and note the evidence that shows it. See Evidence basics.
  4. Calculate the score using the methodology above.
  5. Write a plan of action for anything not met. See What is a POA&M?
  6. Enter the results in SPRS and, for CMMC, have your senior official submit the affirmation.

Keep the evidence. For CMMC self-assessments, the artifacts used as evidence must be kept for six years from the status date.

Affirmations

An affirmation is a statement, made in SPRS by a senior official of your company (the Affirming Official), that you have implemented and will maintain all the applicable requirements for everything in scope.

  • It is required at each assessment, after a plan-of-action closeout, and every year after that.
  • It covers the present and the future: "will maintain", not just "had in place on assessment day".

Keeping your score honest and current

  • Reassess when things change: new systems, new providers, staff turnover in key roles, or a requirement that has quietly stopped happening.
  • Update SPRS when your score changes meaningfully, rather than waiting for the three-year mark.
  • Remember the recurring requirements. Many controls are activities (reviews, training, scans), not settings. A control you met last year is not met this year if the activity stopped.

Sources