Submitting an SPRS score can feel like the last administrative step before pursuing a DoD award. It is not. A score under the wrong CAGE code can cause problems. An incomplete scope can also cause problems. Treating a score as CMMC proof can also fail. Your organization may not meet a solicitation, flow-down, or annual affirmation requirement. This can happen even when NIST SP 800-171 work is mostly complete.
Determine whether your contract needs SPRS
Read the solicitation and flow-down clauses to identify the record your entity must hold. An SPRS Basic Assessment is often required when DFARS 252.204-7019 applies. Your assessed contractor system must meet NIST SP 800-171.
Classify the data and clauses
Classify the data handled by the specific system before calculating anything. FCI can trigger FAR 52.204-21 and a CMMC Level 1 path. CUI can trigger NIST SP 800-171 and DFARS 252.204-7012. It can also trigger assessment clauses that require an SPRS record.
The system boundary controls the correct compliance path.
Choose the correct compliance path
Use the matrix below to set the initial path. It does not replace the award language. A prime may impose valid controls beyond a supplier's expected data role.
| Organization situation | Data in contractor system | Likely record to validate | Immediate action |
|---|
| Prime contractor | CUI | SPRS assessment plus applicable CMMC record | Match each record to the awarded CAGE and CUI enclave |
| Subcontractor | CUI | Its own assessment path if its system handles CUI | Review the prime's clauses and system scope |
| Supplier | FCI only | FAR 52.204-21 and applicable CMMC Level 1 records | Confirm whether an SPRS score is actually called for |
| Supplier | Neither FCI nor CUI | No automatic SPRS requirement | Document the boundary decision and flow-down review |
Separate SPRS, CMMC, and affirmation records
Separate the three records now and assign a named owner to each one. An SPRS Basic Assessment differs from a CMMC assessment result. It also differs from a CMMC annual affirmation. Each has a different scope, authority, and renewal trigger.
Compare scope, owner, and trigger
| Record | What it states | Who owns it | Typical update trigger |
|---|
| SPRS Basic Assessment | NIST SP 800-171 implementation score | Contractor responsible official | New assessment, material scope or control change, or expiration context |
| CMMC assessment result | Required CMMC level outcome | Organization and required assessor path | Contract requirement and CMMC assessment cycle |
| CMMC affirmation | Authorized official's compliance affirmation | Authorized affirming official | Annual timing and material compliance change |
Retain evidence behind each statement
Retain evidence for every claimed control status. Keep the assessment worksheet and SSP version. Keep NIST SP 800-171A objectives, configuration evidence, tickets, policies, diagrams, and POA&M decisions. Store them in a controlled repository.
Evidence must match the assessed system boundary.
U.S. DoD compliance record flow
1. Assess
Define the CUI boundary and score NIST SP 800-171.
2. Submit
Enter the applicable assessment record in PIEE/SPRS.
3. Meet CMMC
Complete the assessment path required by the contract.
4. Affirm
Authorized official submits the required annual affirmation.
For a Basic Assessment, DoD can review the SPRS record. It can review the CAGE code, score, assessment date, and score-expiration information. Your detailed SSP and NIST SP 800-171A objectives usually remain internal. Screenshots, policies, diagrams, tickets, and other CMMC records also usually remain internal. They may be requested under the contract, assessment, or review process.
Recalculate and replace the SPRS entry after remediation changes the score. Replace it when the CUI boundary or relevant controls materially change. Replace it when the current assessment is no longer valid for the contract.
Treat CMMC separately. Confirm whether the clause requires a new assessment result or annual affirmation. Update the responsible official's records after a material change affects that affirmation.
Calculate and submit your SPRS score in PIEE
Calculate against the actual CUI boundary, then submit only after validating the entity data. Start at 110. Apply DoD Assessment Methodology deductions for unmet NIST SP 800-171 requirements.
Build the assessment package
Define the boundary in one short scope statement before opening PIEE. Include CUI repositories and endpoints. Include cloud tenants, remote access, managed service providers, and administrative workstations. Include interfaces that store, process, or transmit CUI.
Scope errors often take longer to correct than scoring errors.
Enter and verify the SPRS record
Confirm that the designated user has PIEE access and the relevant SPRS role. Login access does not prove submission authority. A wrong role can block record creation after scoring is complete.
⚠️ Never treat PIEE account access as proof that the user can submit or update the required SPRS record for the intended CAGE code.
Before submitting, run one record-level check. Confirm the legal entity and applicable CAGE code. Identify the exact contractor system or CUI enclave assessed. Record the assessment date. Verify that the user has proper PIEE/SPRS permissions for that entity.
Keep the signed scoring worksheet internally before publishing the result. Keep the current SSP, POA&M status, scope statement, and supporting evidence. Common failures include selecting the wrong CAGE, missing SPRS roles, and expired assessment dates.
Another common failure is leaving an older score after remediation. A score may also fail when its boundary differs from the SSP or from a related CMMC assessment result.
Resolve those mismatches before relying on the record. Do this before meeting a DoD solicitation requirement or prime-contractor flow-down.
A simple scoring example shows why the final number needs a documented boundary. Begin at 110. One unmet NIST SP 800-171 requirement may carry a 1-point deduction. Another unmet requirement may carry a 3-point deduction. A third may carry a 5-point deduction.
The resulting DoD SPRS score is 101. Subtract 1, 3, and 5 from 110. The assessment worksheet should identify each unmet requirement. It should list its deduction and supporting evidence.
A later remediation can support a new calculation and updated SPRS Basic Assessment. But a score of 101 does not establish award eligibility. No other score does either. A score alone does not prove CMMC compliance or POA&M acceptance.
Common questions
What is an SPRS score?
An SPRS score is a NIST SP 800-171 assessment result under the DoD Assessment Methodology. It ranges from -203 to 110. It applies to the assessed system boundary, not every company system.
How do I submit my SPRS score?
Complete the assessment and validate the CAGE code and boundary. Then enter the record through authorized PIEE and SPRS access. Retain the SSP, scoring worksheet, POA&M, and evidence internally after submission.
What is a good SPRS score?
A score of 110 shows full implementation of assessed NIST SP 800-171 requirements. No score alone guarantees contract eligibility. Clauses, CMMC status, scope, and evidence must also align.
Is an SPRS score required for CMMC?
An SPRS score and CMMC are separate requirements that a contract may require together. CMMC results and annual affirmations do not automatically replace an applicable DFARS 252.204-7019 assessment record.
How is the SPRS score calculated?
Start at 110 and subtract 1, 3, or 5 points for unmet requirements. Use the DoD Assessment Methodology. The score must reflect the defined boundary on the documented assessment date.
How long is an SPRS score valid?
A NIST SP 800-171 Basic Assessment is generally valid for up to three years. This follows the DoD assessment requirement. Update it sooner after a material change to the CUI boundary, controls, remediation status, or contract requirement.
What matters most:- An SPRS score is a DoD NIST SP 800-171 assessment record, not CMMC certification.
- Match the score, scope, date, and submission authority to the correct U.S. CAGE code.
- Keep detailed SSP and control evidence internally, ready for a contractual or assessment request.
- Review the CMMC assessment and annual affirmation as separate obligations with separate owners.
Further reading
If you want to learn more about this topic, these sources may interest you:
