CMMC Assessment Checklist
Download our CMMC assessment checklist!
.jpg?ext=.jpg)
Why Your SPRS Score Matters: Avoiding Inaccurate Self-Assessments
Quick Answer: An SPRS score is a contractor's self-reported measure of NIST SP 800-171 compliance, calculated from 110 controls worth up to 5 points each, with a maximum of 110 and a floor of -203. Overstating this score exposes contractors to False Claims Act liability, including treble damages and penalties. A defensible self-assessment requires a current System Security Plan, honest scoring, and documented evidence.
Government contractors handling Controlled Unclassified Information (CUI) have grown familiar with the term "SPRS score." Fewer understand how much legal exposure hides behind that single number. The Supplier Performance Risk System (SPRS) score tells the Department of Defense how well a contractor has implemented the 110 security controls outlined in NIST SP 800-171. It sounds like a technical formality. It isn't.
Recent False Claims Act settlements show that an inflated or outdated SPRS score can trigger investigations, subpoenas, and multimillion-dollar penalties. As the CMMC acquisition rule rolls out across new DoD contracts, contractors can no longer treat self-assessment as a box-checking exercise. This post breaks down how SPRS scores are calculated, why overstated scores create real legal exposure, and what a defensible CMMC self-assessment actually requires.
How Is an SPRS Score Calculated?
The DoD NIST SP 800-171 Assessment Methodology scores contractors against all 110 NIST SP 800-171 controls. Each control carries a weight of 1, 3, or 5 points based on its security significance. A contractor's assessment starts at a perfect 110 and loses points for every unmet control.
That structure creates a wide range. The maximum possible score is 110, and the lowest possible score is -203, spanning 313 points total. Partial implementation generally earns no partial credit; a control is either met or it isn't. The one notable exception is SC.L2-3.13.11, covering encryption: if a contractor employs encryption that isn't FIPS-validated, the penalty is reduced from 5 points to 3, reflecting partial credit for a good-faith effort.
What Steps Go Into a Self-Assessment?
A defensible SPRS self-assessment generally follows this sequence:
- Develop a System Security Plan (SSP). This document is foundational — it's typically the first artifact a Certified Third-Party Assessment Organization (C3PAO) requests during an audit.
- Self-assess using the DoD methodology. Score each of the 110 controls honestly against actual implementation, not intended or planned implementation.
- Submit the score to SPRS. This must happen before contract award.
- Keep the assessment current. Per DFARS 252.204-7019, the assessment must be less than three years old and maintained for the life of the contract.
- Create a Plan of Action and Milestones (POA&M). Any unmet controls need documented remediation dates and progress tracking.
Two related DFARS clauses reinforce the stakes. DFARS 252.204-7020 gives the DoD the right to conduct higher-level assessments and requires contractors to provide access to facilities, systems, and personnel for verification. It also obligates prime contractors to confirm that subcontractors maintain a current SPRS score no older than three years. DFARS 252.204-7012, meanwhile, requires NIST SP 800-171 implementation on covered systems and mandates FedRAMP Moderate-equivalent cloud providers for any environment handling CUI.
How Does CMMC Level 2 Raise the Bar?
CMMC Level 2 requires a minimum score of 88 out of 110 to achieve Conditional status, and no unmet requirement can be worth more than 1 point — with the same 3.13.11 exception noted above. A short list of "can't miss" 1-point requirements (3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, and 3.10.5) must be fully met regardless of overall score. POA&M items must be closed within 180 days, or Conditional status expires.
Level 2 self-assessments require annual affirmation by a designated "affirming official" — typically a senior company leader who personally attests to the accuracy of the submission. A full self-assessment is required every three years, while organizations undergoing C3PAO assessment are reassessed triennially with annual affirmation in between. Results flow through CMMC eMASS into SPRS, and supporting artifacts must be retained for six years under 32 CFR Part 170, which was published in the Federal Register on October 15, 2024, and took effect December 16, 2024.
By contrast, CMMC Level 1 is a simpler pass/fail annual self-assessment, also requiring affirmation but without the scoring complexity of Level 2.
The CMMC acquisition rule itself is rolling out in phases. Phase 1 began November 10, 2025, making Level 1 and Level 2 self-assessments conditions of award in applicable contracts. Phase 2, which introduces Level 2 C3PAO third-party assessment requirements into new contracts, is currently under review for a potential revised deadline.
Why Does an Overstated SPRS Score Create Legal Exposure?
Quick answer: An overstated SPRS score can trigger False Claims Act liability because submitting an inaccurate compliance claim to the government is treated as a false claim. Penalties include treble damages and per-claim fines, and the Department of Justice actively investigates these cases even without evidence of a data breach.
The False Claims Act (FCA) imposes liability on contractors who knowingly present false claims to the government — and a contractor's SPRS submission counts as a claim. Violations can result in treble damages plus per-claim penalties ranging roughly from $14,000 to $28,000. Many of these cases originate from whistleblower suits, which continue to climb: the DOJ recorded 979 qui tam suits filed in fiscal year 2024, compared to 713 in fiscal year 2023. In FY2024 alone, DOJ recovered $2.9 billion in FCA matters, with $2.4 billion coming from qui tam suits.
A recurring theme across these cases is timing. Investigators consistently flag contractors who knew their actual compliance posture had declined but delayed updating their SPRS score. Aero Turbine's settlement, notably, included cooperation credit for timely self-disclosure, cooperation with investigators, and documented remedial measures — a sharp contrast to cases where contractors "sat on" known deficiencies.
How Can Contractors Produce a Defensible CMMC Self-Assessment?
Choose rigor over optimism if your business depends on long-term DoD contracting relationships, since inflated scores tend to surface eventually — through a C3PAO audit, a prime contractor's subcontractor verification, or a whistleblower. A defensible self-assessment rests on a few consistent practices:
- Score controls against actual implementation, not planned or aspirational implementation. If a control isn't fully in place, it doesn't earn points, with the narrow FIPS-validation exception noted above.
- Maintain a current, accurate System Security Plan. This is the first document reviewers request, and gaps between the SSP and the submitted score are an immediate red flag.
- Document good-faith, reasonable decision-making. When interpretations of a control are ambiguous, record the reasoning behind the chosen approach.
- Update the SPRS score promptly when the compliance posture changes — not after a subpoena arrives.
- Build internal controls and proactive compliance processes that catch discrepancies before an external assessor does.
- Self-disclose issues early. DOJ policy, reflected in FAR 52.203-13's mandatory disclosure provisions, consistently rewards contractors who identify and report their own gaps over those who wait to be caught.
This guidance is informational and should not be treated as legal advice. Given the scale of potential FCA exposure, contractors facing scoring ambiguity or known compliance gaps should consult qualified legal counsel before submitting or revising an SPRS score.
Getting Ahead of SPRS Risk
When CMMC brings C3PAO-led Level 2 assessments into new contracts, the margin for error in self-reported scores will continue to shrink. Contractors who treat their SPRS score as a living, accurate reflection of their security posture — rather than a one-time submission — put themselves in a far stronger position than those who discover their real score only after a consultant, auditor, or subpoena forces the issue.
Frequently Asked Questions
What is an SPRS score?
An SPRS score is a numerical self-assessment of a contractor's compliance with the 110 security controls in NIST SP 800-171, submitted to the Supplier Performance Risk System. Scores range from a maximum of 110 down to a minimum of -203.
How much does an inaccurate SPRS score cost a contractor?
Under the False Claims Act, penalties include treble damages plus per-claim fines of roughly $14,000 to $28,000. Real settlements have ranged from $1.75 million (Aero Turbine) to $9 million (Aerojet Rocketdyne), with MORSECORP paying $4.6 million.
How often must a CMMC Level 2 self-assessment be updated?
A full self-assessment is required at least every three years, with annual affirmation by a designated affirming official in between. Organizations under C3PAO assessment follow a triennial reassessment cycle with the same annual affirmation requirement.
What are the risks of overstating an SPRS score?
Overstatement creates False Claims Act exposure, including DOJ investigation, subpoenas, treble damages, and per-claim penalties. Whistleblower (qui tam) suits are a common trigger, and DOJ pursues these cases even without an actual data breach.
Who should contractors talk to about SPRS scoring questions?
This article isn't legal advice. Contractors with scoring ambiguity, known compliance gaps, or exposure concerns should consult qualified legal counsel familiar with DFARS and CMMC requirements.
