How to Estimate Your SPRS Score in 15 Minutes

A prime contractor or contracting officer asks for your Supplier Performance Risk System (SPRS) score, and you do not know where you stand. You can get a working estimate before you open a single government portal. Our free SPRS Score Estimator walks through all 110 security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2 and applies the Department of Defense (DoD) scoring method as you answer. A first pass can take about 15 minutes when the person answering knows how your systems are set up.

This post covers how to use the estimator, step by step, and what to do with the number it produces. For the scoring math in depth and how a score is posted, see our earlier walkthrough, Your SPRS Score, Explained.

What the estimator calculates

Solicitations that carry Defense Federal Acquisition Regulation Supplement (DFARS) provision 252.204-7019 call for a current NIST SP 800-171 DoD assessment, with the summary score posted in SPRS. The estimator follows the DoD Assessment Methodology, Version 1.2.1, which states the rule plainly: "If all security requirements are implemented, a contractor is awarded a score of 110, consistent with the total number of NIST SP 800-171 security requirements. For each security requirement not met, the associated value is subtracted from 110." Each requirement is worth 5, 3, or 1 point, so the score can fall as low as negative 203.

Before you start

Gather three things: a list of the systems that store, process, or transmit Controlled Unclassified Information (CUI), your system security plan if you have one, and the person who manages your computers, accounts, and network. Your answers stay in your browser. Nothing is sent anywhere unless you choose the optional follow-up at the bottom of the page.

Step by step

Step 1. Work family by family. The 110 requirements are grouped into 14 families, starting with Access Control and its 22 requirements and ending with System and Information Integrity. Each requirement has two choices: Met or Not met.

Step 2. Answer Met only when the control is fully in place. Met means the requirement is implemented across every system in scope, and a control that is mostly in place is Not met. The Mark all in this family Met button saves time, but use it only when every requirement in the family is fully implemented.

Step 3. Choose carefully on the two partial credit items. Multifactor authentication (requirement 3.5.3) offers three answers: for all users, only for remote and privileged users, or not implemented. The middle answer costs 3 points instead of 5. Encryption (requirement 3.13.11) works the same way. Federal Information Processing Standards (FIPS) validated encryption is Met, encryption that is not FIPS validated costs 3 points, and no encryption costs 5.

Step 4. Do not skip the system security plan. Requirement 3.12.4 carries no point value, but the estimator flags it when you answer Not met, because an assessment cannot be completed without a system security plan.

Step 5. Answer all 110. The score starts at 110 and drops only when you mark a requirement Not met, so an unanswered requirement looks the same as a met one. The results panel shows how many of the 110 you have answered. Treat any score with fewer than 110 answers as incomplete.

Reading your result

The results panel gives three views. Your Estimated Score is 110 minus your deductions. Deductions by family shows where the points went, which shows whether the problem sits in one area or is spread across the board. Gaps, highest value first, lists every Not met requirement sorted by point value, so the 5 point items sit at the top.

That sorted list is your first draft of a remediation order. Closing one 5 point requirement moves the score as much as closing five 1 point requirements. A negative number is a starting position, not a verdict, and companies that have never done formal security work often start there.

Before you close the page, keep a Portable Document Format (PDF) copy with the Print or Save as PDF button. The page does not keep your answers, and the printed copy becomes your baseline.

What the estimate is, and what it is not

The estimator is a planning aid, only as accurate as your answers, and it does not post anything to SPRS. A score posted in SPRS is a representation to the government, so the number you submit should come from a documented self-assessment against your system security plan, with evidence behind every Met answer.

Next steps

Work the gap list from the top. For each requirement you cannot close soon, write a Plan of Action and Milestones (POA&M) entry with the planned fix and a target date. Write or update your system security plan so the assessment has a defined scope. Then run the SPRS Score Estimator again as you close items, and keep each printed result as a record of progress. When the documented self-assessment is complete, the posting steps in our earlier walkthrough apply.

If your company handles only Federal Contract Information (FCI) and no CUI, the 15 requirement Cybersecurity Maturity Model Certification (CMMC) Level 1 Checklist may be the better place to start.

Related reading: Your SPRS Score, Explained and The CMMC Controls You Cannot Put on a Plan of Action and Milestones. If you handle Controlled Unclassified Information, see our CMMC assessment page.

Sources

• NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 - Department of Defense
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations - National Institute of Standards and Technology
• DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements - Acquisition.gov