NIST SP 800-171 scoring in SPRS: how the 110-point method works

If your company handles Controlled Unclassified Information for DoD, your cybersecurity posture is summarized in one number: your NIST SP 800-171 DoD Assessment score, recorded in the Supplier Performance Risk System (SPRS). DFARS 252.204-7012 requires you to implement the 110 security requirements of NIST SP 800-171 on systems that handle covered defense information. DFARS 252.204-7019 and 252.204-7020 require an assessment of that implementation, scored with the DoD Assessment Methodology and posted to SPRS. CMMC Level 2 uses the same scoring approach (32 CFR 170.24).

How the score is calculated#

The method is simple subtraction:

1. Start at 110, one point for each NIST SP 800-171 requirement.
2. For every requirement that is not fully implemented, subtract its weight: 5, 3 or 1 point, depending on how much the gap would hurt the protection of CUI.
3. A requirement on a plan of action still counts as not implemented until it is actually done.

Because the weights add up to more than 110, the score can go negative. The lowest possible score is -203, when nothing is implemented. Two requirements allow partial credit under the methodology: multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11), where a partial implementation subtracts fewer points than none at all.

One requirement works differently: you cannot score an assessment at all without a system security plan (requirement 3.12.4). The SSP describes your system boundary, environment and how each requirement is implemented, and assessors work from it.

Basic, Medium and High assessments#

DFARS 252.204-7020 defines three assessment types, which differ in who performs them and how much confidence DoD can place in the result:

Most companies post Basic assessments. Medium and High assessments are initiated by DoD, and DFARS 252.204-7020 requires you to give the Government access to your facilities, systems and personnel when it does one.

What gets posted to SPRS#

For a Basic assessment, SPRS records summary information, not your detailed results:

• The standard assessed (NIST SP 800-171) and who performed the assessment
• The CAGE codes covered by each system security plan
• The date the assessment was completed
• The summary score (for example, 95 out of 110)
• The date by which you expect to implement every requirement, based on your plans of action

An assessment is considered current for three years from its completion date unless a solicitation specifies a shorter period (DFARS 252.204-7019). See keeping your assessment current for the renewal calendar.

Improving your score#

• Fix 5-point gaps first. They protect the most and move the score the most. Typical examples are access control, multifactor authentication and incident response capabilities.
• Look for quick 1-point wins in documentation and configuration, but do not let them crowd out high-weight work.
• Keep the SSP and plans of action honest and current. They are the evidence behind the number.
• Re-assess and re-post when you improve. A new Basic assessment can be posted whenever your implementation changes; a better, current score helps at every award.
• Scope deliberately. A well-defined enclave for CUI can be easier to secure and assess than an entire enterprise network, provided CUI really stays inside it.

Common pitfalls#

• Counting planned work as done. Implemented means implemented today, not scheduled.
• Ignoring partial credit rules. Multifactor authentication and encryption have specific partial-credit conditions; read the methodology instead of estimating.
• Forgetting system changes. A new cloud service, merger or network redesign can change the scope your score describes.
• Treating the score as the goal. The score summarizes your protection of CUI. Primes and assessors will look at the underlying evidence.

Who sees your score#

SPRS is a Government system: your score is visible to your company and to authorized Government users, not to other contractors browsing the system. Many subcontractors treat the exact number as sensitive competitive information and share it with a prime only under a non-disclosure agreement. That tension, primes needing assurance and subcontractors wanting privacy, is why TeamingIndex publishes blind SPRS brackets instead of exact scores.

How TeamingIndex helps#

• Record your summary score, assessment date and assessment type privately on your compliance dashboard. Never upload your SSP or POA&M: TeamingIndex stores verification metadata only.
• Your profile shows the thresholds you meet (for example, "SPRS ≥ 85"), the assessment date, the assessment type and whether the assessment is still current. The exact score is shown only if you make it public, to your own organization, to platform admins, or to a partner after a mutual NDA is recorded.
• Primes can filter for partners by minimum bracket in the directory, with verified credentials only if they choose.