Back to Knowledge Center
Documentation6 min read
SPRS Scores: How to Calculate and Submit Your Score
The Supplier Performance Risk System score is your self-assessed compliance number — ranging from -203 to 110. Here's how it's calculated, where to post it, and what a realistic score looks like.
The Supplier Performance Risk System (SPRS) is a DoD application that stores contractor assessment results, including CMMC self-assessment scores. Under DFARS 252.204-7019 and 7020, contractors must have a current NIST SP 800-171 self-assessment score in SPRS before contract award. Access the portal at sprs.csd.disa.mil.
How the SPRS score is calculated
- ✓Start with a score of 110 (full compliance)
- ✓For each control that is NOT implemented: subtract the control's assigned point value
- ✓Point values range from 1 (minimal impact) to 5 (critical)
- ✓Total possible deduction is 313 points — minimum possible score is -203
- ✓A partially implemented control counts as not implemented for scoring purposes
| Score range | Interpretation |
|---|---|
| 110 | Full compliance — all 110 controls implemented |
| 70–109 | Strong posture — most controls in place, minor gaps |
| 30–69 | Moderate posture — significant gaps exist |
| 0–29 | Weak posture — fundamental gaps across multiple domains |
| Below 0 | Critical deficiencies — numerous high-weight controls unimplemented |
Honesty matters
An inflated SPRS score is fraud. The DoJ has pursued contractors under the False Claims Act for knowingly submitting inaccurate SPRS scores. Submit the score that honestly reflects your current posture — even if it is low.
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in Documentation