SPRS Score Assessment
- Home
- SPRS Score Assessment
"Is your SPRS score defensible under FCA scrutiny?"
Validate Your SPRS Score Before DOJ Validates It for You
The False Claims Act (FCA) creates liability for DoD contractors who submit inaccurate SPRS scores. VIS LLC compares your submitted NIST 800-171 self-assessment score against the actual technical evidence in your environment — identifying the gap between what you reported and what your controls can support.
Enforcement has reached small suppliers. In December 2025 an Illinois precision machining company paid $421,234 to resolve allegations that it failed to protect drawings of parts it machined for DoD primes, and in June 2026 LOGZONE paid $507,144 after a DCMA assessment scored its NIST SP 800-171 implementation at −170. An inaccurate SPRS score — even an unintentional one — creates liability. VIS LLC helps you build a defensible score, documented in evidence.
Key Features
SPRS score validation against actual controls
We compare your submitted score to the controls your environment can technically demonstrate — not what your SSP claims.
FCA exposure analysis
We identify the gap between your submitted score and your supportable score, quantifying your potential False Claims Act exposure.
Control-by-control scoring justification
Every NIST 800-171 control receives a documented justification for its point assignment, creating an evidence-backed scoring record.
Remediation roadmap with SPRS impact per fix
Each remediation action is mapped to its SPRS point improvement so you can prioritize for maximum score impact.
Comparison of submitted vs. supportable score
You receive a clear side-by-side comparison of what you reported and what your environment can defend.
Written documentation for legal defensibility
Our assessment report provides the written documentation your legal team needs to demonstrate good-faith compliance efforts.
Ready to get started?
Schedule a free consultation with our CMMC experts.
Frequently Asked Questions
Primary sources
- DFARS 252.204-7020: NIST SP 800-171 DoD Assessment Requirements
- NIST SP 800-171 DoD Assessment Methodology, v1.2.1 (PDF)
- NIST SP 800-171 Rev. 2: Protecting CUI in Nonfederal Systems
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
- Supplier Performance Risk System (SPRS)
- U.S. Department of Justice: Illinois precision machining company settlement (5 December 2025)
- U.S. Department of Justice: LOGZONE settlement (18 June 2026)
What is an SPRS score?
The SPRS (Supplier Performance Risk System) score is a numerical rating — ranging from -203 to +110 — that reflects a DoD contractor's NIST SP 800-171 self-assessment results. DoD contractors must submit their SPRS score to the Supplier Performance Risk System. A score of 110 means all 110 controls are fully implemented. A negative score indicates significant gaps.
How is the SPRS score calculated?
The SPRS score starts at 110 and deducts points for each NIST 800-171 control that is not fully implemented. The point values vary by control: some controls carry a deduction of 1 point, others carry deductions of 3 or 5 points. Controls that are partially implemented receive partial credit only in limited circumstances. The final score is submitted by the contractor and stored in SPRS.
What SPRS score do I need for DoD contracts?
No single minimum SPRS score applies to every DoD contract. Contracting officers and primes use the score as a risk indicator, and it has to match what your environment can actually demonstrate; a score you cannot support with evidence creates False Claims Act exposure. As of 1 November 2026, CMMC Phase 2 is suspended, so new solicitations are not requiring Level 2 C3PAO certification, and your self-assessed score remains the main signal the DoD sees.
How do I improve my SPRS score?
Improving your SPRS score requires implementing the NIST 800-171 controls for which you are currently scored as non-compliant. The fastest gains come from implementing high-point-value controls first — access control, identification and authentication, and system and communications protection. VIS LLC's SPRS assessment identifies the highest-impact gaps and builds a remediation roadmap to maximize score improvement within your timeline.