What Is SPRS (Supplier Performance Risk System)?

SPRS is the DoD's system of record for supplier cybersecurity posture. Under DFARS 252.204-7019 and 252.204-7020, contractors subject to NIST SP 800-171 must conduct a Basic self-assessment using the DoD Assessment Methodology and post the resulting score in SPRS. The scoring starts at 110, the number of requirements in NIST SP 800-171 Rev 2, and subtracts weighted point values for each requirement not fully implemented, so scores can be well below zero for organizations early in implementation. CMMC status and the annual affirmations made by a company's Affirming Official are also recorded there.

SPRS applies to any contractor or subcontractor performing under contracts with the relevant DFARS clauses, which in practice means most of the defense industrial base that handles covered defense information. A missing or stale score can hold up an award, and primes increasingly ask subcontractors for their scores during teaming and flow-down diligence.

The practical implication: an SPRS score is a representation to the government, not an internal metric. Inflated scores have become a False Claims Act risk area, so the score should be defensible with evidence for every requirement claimed as implemented. As of mid-2026, posting scores and making annual affirmations remain mandatory even while third-party CMMC assessments are suspended. See our defense and government practice for assessment support.