If you’re a defense contractor, you’ve got a number following you around. It sits in a federal database. Contracting officers can pull it up before they award you work. And if it’s wrong, the Department of Justice might come knocking. That number is your SPRS score.
Note: On July 13, 2026, DoD suspended CMMC Phase 2, pausing the November 2026 third-party certification deadline. But SPRS scores and NIST 800-171 compliance remain fully required under DFARS 252.204-7012. The DOJ is still actively pursuing false score claims. Nothing about SPRS enforcement has changed.
What Is SPRS?
SPRS stands for Supplier Performance Risk System. It’s a DoD portal where contractors submit their self-assessment scores based on NIST SP 800-171. Think of it as your cybersecurity report card. The score tells the government how well you’ve implemented the 110 security controls.
How the Scoring Works
Your SPRS score can range from -203 to 110. Each of the 110 controls is weighted:
5 points: Critical controls like MFA, encryption, and access control.
3 points: Important controls like audit logging and incident response.
1 point: Supporting controls like documentation and training.
You start at 110 and subtract for every unimplemented control. No partial credit.
Why Your Score Needs to Be Accurate
When you submit your SPRS score, you’re making a legal attestation. The DOJ enforces this through the Civil Cyber-Fraud Initiative using the False Claims Act.
MORSE Corp settled for $4.6 million in March 2025. Self-reported score of 104. Actual score was closer to -142.
LOGZONE settled for $507,144 in June 2026. Submitted a perfect 110. Actual score was around -170.
DOJ cybersecurity enforcement settlements jumped 233% between 2024 and 2025, totaling $51.8 million in 2025 alone.
How to Check If Your Score Is Real
Did someone actually assess all 110 controls? Do you have a System Security Plan (SSP)? Do you have a Plan of Action and Milestones (POA&M)? Has anything changed since you submitted? Who did the assessment?
What a Realistic Score Looks Like
A typical small business doing its first honest assessment often lands between -20 and 50. That’s OK. What matters is the trajectory. A contractor with a score of 25 and a solid POA&M is in a much better position than one with a fake 110 and no documentation.
Where to Start
First step: know your real number. Asteroid IT works with defense contractors across Arizona to get accurate SPRS scores on file.
Want a second look at your score? We’ll review it for free. Call us at 480-937-7021 or visit asteroidit.com.