Question 1

What is an SPRS score?

Accepted Answer

The Supplier Performance Risk System score is DoD's measure of how fully a contractor has implemented the 110 security requirements of NIST SP 800-171. It ranges from -203 to a perfect 110, and defense contracts increasingly require one on file.

Question 2

How is the SPRS score calculated?

Accepted Answer

You start at 110 and subtract points for every requirement not implemented - 1, 3, or 5 points each, per the DoD methodology codified at 32 CFR 170.24. Two requirements (MFA and FIPS encryption) allow partial credit. Without a System Security Plan, no score can be submitted at all.

Question 3

Is this calculator free, and do I need an account?

Accepted Answer

Yes, and no account. About 15 minutes of plain-English questions; your estimated range and top gaps are emailed to you. It's an estimate from self-reported answers, not an assessment.

Question 4

What's a good SPRS score?

Accepted Answer

110 is the target, and primes increasingly screen on it. Most small shops that haven't worked the requirements score far lower - often negative. The value of knowing your number is knowing which fixes buy the most points.