Every defense contractor handling controlled unclassified information posts a score to the Supplier Performance Risk System. Most people who post one could not explain how it was calculated.
The arithmetic is simple and unforgiving. You start at 110, one point for each of the 110 controls in NIST SP 800-171. Each control you have not fully implemented subtracts its weight, which is 1, 3 or 5 points depending on how badly its absence exposes the network. There is no partial credit. A control you are halfway through costs you the full weight.
Because the weighted deductions total more than 110, the scale runs from -203 at the bottom to +110 at the top. A negative score is not a failing grade in the usual sense. It means the weighted value of what you have not done exceeds the total number of requirements.
A score of -100 is common and not shameful for a firm that has never done this work. What is not fine is posting +80 when the honest number is -100.
Why this got more serious in September 2026
Under the class deviation signed on September 3, Levels 1 and 2 are satisfied by self assessment through November 2028. Nobody from a third party assessment organisation is coming to check your arithmetic.
That sounds like less pressure. It is actually more, because the score you post is now the only assertion in the system, and it is an assertion you made to the government in order to be eligible for work.
Two settled cases show what that looks like. One contractor posted 104 when the actual figure was -142, with 22 percent of controls implemented. Another posted 98 for an environment that investigators described as fictitious. Both settled. In both, the information came from inside the company.
The specific trap
The most common way firms end up with a wrong score is not deliberate. It is that somebody else calculated it. An outgoing IT provider, a consultant, or a well meaning employee produces a number, it gets posted, and nobody revisits it. Years later the number is still there and the person who produced it is gone.
If you did not personally see the working, you do not know your score. Finding out costs you a day. Being wrong about it costs considerably more.