What is SPRS?

The Supplier Performance Risk System (SPRS) is the Department of Defense (DoD) application that holds what the Government knows about a supplier's performance and cybersecurity posture before it makes an award. The SPRS home page quotes DoD Instruction (DoDI) 5000.79, which names SPRS the "authoritative source to retrieve supplier and product PI" assessments for the DoD acquisition community. The system is built and run by Naval Sea Logistics Center (NSLC) Portsmouth at Portsmouth Naval Shipyard in New Hampshire, and users reach it through the Procurement Integrated Enterprise Environment (PIEE). For most defense contractors the system matters for one reason: the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 assessment score and the Cybersecurity Maturity Model Certification (CMMC) status a contracting officer looks up before award both live here.

What SPRS holds

The SPRS user guide for awardees and contractors, Version 4.1.5 of May 2026, describes the system as a web-enabled enterprise application that gathers, processes, and displays data about the performance of suppliers. The home page lists what is inside: price, item, and supplier procurement risk assessments; on-time delivery scores and quality classifications; NIST SP 800-171 assessment results; CMMC information; a market research tool; company exclusion status; the National Security System Restricted List; and supply chain illumination. The Defense Pricing, Contracting, and Acquisition Policy fact sheet on SPRS gives the history: SPRS began with delivery and quality scores ranked by Federal Supply Class, added a procurement risk analysis tool for price, item, and supplier risk after a 2013 tasking, and was updated in 2020 to store summary results from NIST SP 800-171 DoD Assessments.

Two groups of records are therefore mixed in one system. The performance records are generated by the Government from contract data and scored by SPRS algorithms. The cyber records are entered by the contractor or, for Government and third-party assessments, by the assessor. A search for "SPRS score" may mean either, and the two numbers are unrelated.

Every record is keyed to a Commercial and Government Entity (CAGE) code. SPRS imports the company's CAGE hierarchy from the System for Award Management (SAM), and the NIST SP 800-171 Quick Entry Guide says a hierarchy error is fixed by the company's Electronic Business Point of Contact in SAM, with updates typically reaching SPRS within 48 hours. The top of the hierarchy is the Highest Level Owner (HLO), and a cyber user's access runs across every CAGE under that HLO.

Who sees SPRS data

The SPRS FAQ says the system is primarily for DoD acquisition employees and for vendors and suppliers to access their own company information. The user guide puts the data handling rule in one sentence: SPRS data is unclassified for contractors and vendors, who can view, maintain, download, and distribute their own data, while the U.S. Government handles all SPRS data as controlled unclassified information (CUI). The FAQ adds that access on the company side is controlled by the company's account administrator.

Government users see across companies; vendors see only themselves. DFARS clause 252.204-7020 states the rule for cyber scores: results posted in SPRS are available to DoD personnel and protected under DoDI 5000.79, and authorized representatives of the contractor may view their own results. Documentation beyond the summary score from a High assessment is kept by DoD as CUI for internal use.

On the CMMC side the guide draws one more line. Only CMMC assessments that have been affirmed and assigned a CMMC unique identifier (UID) are visible to authorized government users. A record in Incomplete or Pending Affirmation status exists only on the vendor's screen.

Supplier risk, item risk, and price risk

DFARS subpart 204.76 requires contracting officers to use SPRS risk assessments when evaluating quotations and offers for supplies and services, including commercial acquisitions under Federal Acquisition Regulation (FAR) Part 12. It defines the three assessments. Item risk is the probability that a product, based on its intended use, will cause performance problems leading to safety issues, mission degradation, or monetary loss. Price risk measures whether a proposed price is consistent with prices the Government has historically paid for the same item or service. Supplier risk is the probability that an award may subject the procurement to unsuccessful performance or supply chain risk. Section 204.7603 tells the contracting officer to consider price risk and supplier risk, and item risk for end products with a material identifier, in the award decision, and says an offeror with no SPRS assessment is not considered favorably or unfavorably. The notice to offerors is provision 252.204-7024, dated March 2023, which says SPRS assessments are generated daily and offerors may view only their own.

The SPRS Evaluation Criteria Manual, Version 5 of September 2026, explains the arithmetic. The Supplier Risk Score is the sum of 10 factors: suspected counterfeit reports from the Government-Industry Data Exchange Program (GIDEP), quality score rankings, overall delivery score, Contractor Performance Assessment Reporting System (CPARS) ratings, corrective action requests, corrective action plans, surveys, program assessment reports, other GIDEP notices, and integrity records from SAM. Each record is age-weighted so that its effect fades over three years and disappears at 1,095 days, and the engine runs every day. The numeric score is then ranked against every other supplier and assigned a color, with blue for the top 5 percent, purple for the next 10 percent, green for the middle 70 percent, yellow for the next 10 percent, and red for the bottom 5 percent.

Quality and delivery are scored by supply code. Quality records such as product quality deficiency reports, supply discrepancy reports, GIDEP alerts, and material inspection records carry positive or negative weights, and negative records sit in a 14-day preview period before they affect a score so the vendor can challenge them. The delivery score weights on-time line items at 60 percent and average days late at 40 percent. The user guide describes the challenge process: a vendor selects a record in the Summary or Detail report, attaches evidence, and submits; a record can be challenged twice, and the challenge code shows U for upheld or D for denied after adjudication.

NIST SP 800-171 assessment scores in SPRS

The cyber side begins with DFARS provision 252.204-7019 and clause 252.204-7020, both dated November 2023. To be considered for award, an offeror that must implement NIST SP 800-171 under DFARS 252.204-7012 must have a current assessment, meaning one not more than 3 years old unless the solicitation says less, for each covered contractor information system relevant to the offer, with the summary score posted in SPRS. Codified DFARS 204.7303(b) tells the contracting officer to verify in SPRS, before award, an option exercise, or an extension, that a current summary score is posted for each relevant system. Those are the codified texts. Class deviation 2026-O0043 marks subpart 204.73 Reserved from February 17, 2026, and class deviation 2026-O0025, Revision 3 replaces 7019 and 7020 with clause 252.240-7997 in a new DFARS Part 240; that clause addresses only Medium and High assessments by Government personnel. The user guide labels the NIST tab as supporting 252.240-7997, previously 252.204-7019/7020.

The assessment itself follows the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1 of June 24, 2020. There are three levels. A Basic assessment is the contractor's own review of its system security plan against NIST SP 800-171A, and clause 7020 says it carries a confidence level of Low because it is a self-generated score. A Medium assessment is conducted by DoD personnel through document review and discussion with the contractor. A High assessment adds on-site or virtual verification and demonstration and carries a confidence level of High. The methodology anticipates assessing a contractor once every three years unless program risk or a security-relevant change calls for more. DoD gives the contractor Medium and High results before posting and allows 14 business days to rebut findings. Under the Part 240 deviation, Medium and High assessments use the scoring methodology in 32 CFR 170.24.

How the score is built

The methodology awards 110 points when every requirement is implemented, "consistent with the total number of NIST SP 800-171 security requirements," and subtracts points for each requirement not met. Requirements whose absence could lead to significant exploitation of the network or exfiltration of CUI cost 5 points; the methodology lists 23 basic and 19 derived requirements in that group. Requirements with a specific and confined effect cost 3 points, 7 basic and 7 derived. Every other requirement costs 1 point. Two requirements get partial credit: multifactor authentication (3.5.3) costs 3 points if it covers only remote and privileged users and 5 if it covers no one, and FIPS-validated cryptography (3.13.11) costs 3 points if encryption is used but not FIPS-validated and 5 if none is used. The methodology states that the deductions may result in a negative score. A plan of action does not earn the points back, and a missing system security plan means the assessment cannot be completed at all.

The SPRS NIST SP 800-171 page is explicit that SPRS only stores the results and that the Basic assessment cannot be performed in SPRS. Each saved record receives a DoD UID of 10 alphanumeric characters whose first two letters show the confidence level: SB for Basic, SM for Medium, SH for High. The user guide lists the fields a record carries: included CAGE codes, company name, assessment date, score, assessment scope, plan of action completion date, and system security plan name, version, and date. The scope is one of three choices: Enterprise, meaning the entire company network under the listed CAGEs; Enclave, a standalone business unit under an Enterprise CAGE; or Contract, a contract-specific system security plan review. The plan of action completion date is required for any score below 110.

How to post a Basic self-assessment score

The Quick Entry Guide, Version 4.0 of May 2024, walks through the entry. The prerequisite is a PIEE profile with the SPRS Cyber Vendor User role; the FAQ says that without it the Add New NIST Assessment button does not appear. The steps are:

1. Finish the assessment and the system security plan first. The guide says both should be completed before entering summary results.
2. Log in at piee.eb.mil and select the SPRS tile, then the Cyber Reports module.
3. Select the company hierarchy from the dropdown and run Cyber Reports. The first CAGE shown is the one on the user's PIEE profile, and the CAGE in parentheses is the HLO.
4. Open the NIST SP 800-171 Assessments tab and select Add New Assessment.
5. Enter the assessment details: date, score, scope, plan of action completion date, included CAGEs, and system security plan name, version, and date, then Save. The included CAGEs can be picked from the hierarchy tree or pasted as a comma-separated list, and every one must be in the current hierarchy.

A UID is assigned on save. The Basic record is the only confidence level a vendor can add, edit, or delete; Medium and High records are entered by the Government. To edit, the user clicks the pencil icon on the Basic sub-tab, changes the data, and selects Update. Deleting a record deletes it for every included CAGE. Clause 7020 still describes the older path of sending the summary to a Navy mailbox by encrypted email, and the fact sheet notes that SPRS now lets offerors enter scores directly.

Clause 7020(d) sets the field list the entry screen reproduces: the standard assessed, the organization that conducted the assessment, the CAGE codes mapped to each system security plan with a brief description of the architecture if there is more than one plan, the date of the assessment, the summary score such as 95 out of 110, and the date a score of 110 is expected based on the plans of action. The September 29, 2020 interim rule that created the requirement estimated 13,068 Basic assessment respondents and explained that until then neither the FAR nor the DFARS clause gave DoD a way to verify implementation before award.

Score validity and what 110 means

Three years is the governing number in the codified DFARS and in SPRS; clause 252.240-7997 under the Part 240 deviation drops both the Basic assessment and the 3-year rule. In the codified DFARS, provision 7019 defines a current assessment as not more than 3 years old, clause 7020 forbids a prime from awarding a subcontract that involves NIST SP 800-171 unless the subcontractor has completed at least a Basic assessment within the last 3 years, and the user guide says assessment results turn red in SPRS when the assessment date is more than three years old. Nothing in the clauses sets a minimum score for award; the contracting officer verifies that a current score exists. The methodology describes 110 as the result when all requirements are implemented. A Basic 110 is still a Low confidence, self-generated figure, and DoD may follow it with a Medium or High assessment.

The record stays with the hierarchy. The user guide says users see only assessments under their current HLO; assessments entered under a previous HLO are no longer visible to the vendor but remain available to the Government.

CMMC status and the affirmation in SPRS

CMMC uses the same Cyber Reports module. The SPRS CMMC page describes SPRS as the location for vendors to certify CMMC Level 1 and Level 2 compliance, and the user guide shows four sub-tabs: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), and CMMC Level 3 (DIBCAC). The vendor creates and affirms Level 1 and Level 2 self-assessments; Level 2 (C3PAO) and Level 3 (DIBCAC) results arrive from the CMMC instantiation of eMASS and must be affirmed by the vendor. CMMC UIDs are 10 characters, with prefixes S1 and S2 for self-assessments and L2 and L3 for assessments entered through eMASS.

The regulation is 32 CFR Part 170. Section 170.15 requires a Level 1 self-assessment every year with the level, status date, assessment scope, CAGE codes, and compliance result entered in SPRS; no plan of action and milestones (POA&M) is permitted. Section 170.16 requires a Level 2 self-assessment every three years with the same fields plus an overall score, for example 105 out of 110. A Level 2 self-assessment that meets the POA&M rules in section 170.21 earns Conditional Level 2 (Self), and the contractor has 180 days from the status date to close the POA&M and post the closeout result, or the status expires. Section 170.24 scores Level 2 with the same 5, 3, and 1 point weights and partial credit as the DoD Assessment Methodology, and scores Level 1 only as MET or NOT MET.

Section 170.22 sets the affirmation. An Affirming Official, defined in section 170.4 as the senior level representative from within each organization seeking assessment who is responsible for its CMMC compliance, affirms in SPRS that the organization has implemented and will maintain implementation of all applicable CMMC security requirements for its status and scope. The affirmation is due on achieving a Conditional status, on achieving a Final status, annually after the Final status date, and after a POA&M closeout. The FAQ gives the clicks: the official logs in to PIEE, opens the SPRS tile and Cyber Reports, selects Edit for Level 1 or Affirm for Level 2, reviews, and affirms. The user guide's status table shows the consequences: a Level 1 self-assessment becomes No CMMC Status (Expired Assessment) after one year and turns red, a Conditional Level 2 self-assessment is current for 180 days, and a Final Level 2 self-assessment that misses its annual affirmation is marked Expired Affirmation and is no longer current.

DFARS clause 252.204-7021, dated November 2025, closes the loop on the contract side. The contractor must hold a current CMMC status at the contract's level, submit its CMMC UIDs to the contracting officer, enter self-assessment results in SPRS for each UID, affirm annually in SPRS, and confirm that subcontractors affirm as well. The clause defines current as 1 year for Final Level 1, 3 years for Final Level 2 and Level 3, 180 days for a Conditional status, and 1 year for an affirmation.

On July 13, 2026, the Department of War suspended CMMC Phase II. The implementing memo allows only CMMC Level 1 (Self) and Level 2 (Self) requirements during the review and enforces NIST SP 800-171 Revision 2 through those self-assessments and select Government-led assessments.

Getting access through PIEE

The SPRS access page lays out the path for a vendor. The company must be registered in SAM with an Electronic Business Point of Contact and a CAGE code. Each CAGE needs at least one Contractor Account Administrator (CAM), usually that point of contact or a designee, who approves company users and roles in PIEE. A new user registers in PIEE with the Vendor user type, since the FAQ warns that a profile created under another type will not show the SPRS vendor roles, and then requests one of the two SPRS roles the user guide describes. The Contractor/Vendor (Support Role) gives CAGE-specific viewing of risk and performance data, Cyber Reports, and the CAGE hierarchy, and the ability to process challenges. The SPRS Cyber Vendor User role adds the ability to add and edit NIST SP 800-171 and CMMC assessments across every CAGE in the HLO hierarchy. The access page says the support role is also reviewed by the SPRS program office, and the SPRS tile stays inactive until approval. Help comes from the SPRS help desk at sprs-helpdesk@us.navy.mil, the PIEE help desk at 866-618-5988, and, for the assessment itself, the Defense Contract Management Agency mailbox the FAQ lists.

What to check

• Is there a Basic NIST SP 800-171 record in SPRS for every system security plan that supports the contract, with an assessment date less than 3 years old and every relevant CAGE included?
• Does the score below 110 carry a plan of action completion date, and does the system security plan on file match the plan name, version, and date in the record?
• Is the record under the company's current HLO hierarchy in SAM, or was it entered under a structure that has since changed?
• For CMMC, has the Affirming Official affirmed in SPRS within the last year, and does the record show a CMMC UID and a Final rather than Conditional status with its 180-day clock?
• Before awarding a subcontract that involves NIST SP 800-171, has the prime confirmed the subcontractor's current score in SPRS where codified DFARS 252.204-7020(g) is in the contract?
• Are there negative quality or delivery records in the 14-day preview period that should be challenged before they reach the Supplier Risk Score?

Azcuna's LEDGER turns a trade study into a Decision Package in which every number cites its source and AI agents draft but never decide. It was proposed to the Army under SBIR Phase I topic ARM26BX06-NV012, and the proposal was submitted on October 21, 2026.

Questions people ask

What is SPRS?

SPRS is the Supplier Performance Risk System, a web application run by Naval Sea Logistics Center Portsmouth and reached through the Procurement Integrated Enterprise Environment. The SPRS site quotes DoD Instruction 5000.79, which names it the authoritative source for supplier and product performance information for the DoD acquisition community. It holds supplier, item, and price risk assessments, delivery and quality scores, NIST SP 800-171 assessment results, and CMMC assessment statuses and affirmations.

What is an SPRS score?

An SPRS score usually means the NIST SP 800-171 DoD Assessment summary score posted under codified DFARS 252.204-7019 and 252.204-7020, which class deviation 2026-O0025 replaced with clause 252.240-7997. The DoD Assessment Methodology starts at 110, one point for each requirement in NIST SP 800-171 Revision 2, and subtracts 5, 3, or 1 points for each requirement not implemented, so the score can go negative. SPRS also computes a separate Supplier Risk Score from delivery, quality, and other performance data, which is a different number.

How do I submit a NIST SP 800-171 score to SPRS?

The SPRS NIST SP 800-171 Quick Entry Guide gives the steps: log in to PIEE with a profile that holds the SPRS Cyber Vendor User role, open the SPRS tile, select Cyber Reports, choose the company hierarchy, open the NIST SP 800-171 Assessments tab, and select Add New Assessment. The entry asks for the assessment date, score, scope, plan of action completion date, included CAGE codes, and system security plan name, version, and date. The guide says to finish the assessment and the system security plan first.

How long is a NIST SP 800-171 score valid in SPRS?

Three years in the codified DFARS. Provision 252.204-7019 says a current assessment is one that is not more than 3 years old, unless the solicitation specifies a shorter time, and clause 252.204-7020 applies the same 3-year rule to subcontractors. Clause 252.240-7997, which class deviation 2026-O0025 Revision 3 of September 3, 2026 uses in place of both, has no 3-year rule. The May 2026 SPRS Software User's Guide for Awardees/Contractors still turns results red when the assessment date is more than three years old.

Who can see my SPRS score?

Codified DFARS 252.204-7020, and clause 252.240-7997(f) under class deviation 2026-O0025 Revision 3 of September 3, 2026, say NIST SP 800-171 assessment results posted in SPRS are available to DoD personnel and are protected under DoD Instruction 5000.79, and that authorized representatives of the contractor can view their own results. The SPRS user guide says the Government handles all SPRS data as controlled unclassified information while vendors may view, download, and distribute their own data. A vendor cannot see another company's scores.

What is the difference between an SPRS score and CMMC?

The NIST SP 800-171 score in SPRS is usually a Basic self-assessment under codified DFARS 252.204-7019 and 252.204-7020, with a Low confidence level. Clause 252.240-7997, which replaced them under class deviation 2026-O0025 Revision 3 of September 3, 2026, covers only Medium and High assessments, though the May 2026 SPRS user guide still accepts Basic records. CMMC under 32 CFR Part 170 and DFARS 252.204-7021 produces a status such as Final Level 2 (Self). Both sit on separate SPRS tabs, and 32 CFR 170.16 requires Level 2 self-assessment scores there.

What does a score of 110 in SPRS mean?

The DoD Assessment Methodology awards a score of 110 when all 110 security requirements of NIST SP 800-171 Revision 2 are implemented, so 110 is the maximum. The SPRS user guide says a plan of action completion date is required for any score below 110. A Basic score of 110 is still a self-generated score with a Low confidence level under codified DFARS 252.204-7020, and DoD may follow it with a Medium or High assessment, scored using 32 CFR 170.24 under clause 252.240-7997 and class deviation 2026-O0025 Revision 3.

What PIEE role do I need for SPRS?

The SPRS access page and user guide describe two vendor roles. The Contractor/Vendor (Support Role) lets a user view risk, performance, and cyber reports for the company's CAGE codes and process challenges. The SPRS Cyber Vendor User role is required to enter or edit NIST SP 800-171 and CMMC assessments; without it the Add New Assessment button does not appear. Both are requested in PIEE with the Vendor user type and approved by the company's Contractor Account Administrator.

What is the SPRS affirmation under 32 CFR 170.22?

Section 170.22 of 32 CFR Part 170 requires an Affirming Official, the senior representative responsible for the organization's CMMC compliance, to affirm in SPRS that the organization has implemented and will maintain all applicable CMMC security requirements. Affirmations are due when a Conditional or Final status is achieved, after a POA&M closeout, and annually afterward. The SPRS FAQ says the official logs in to PIEE, opens Cyber Reports, and selects Affirm on the record.

Can a negative SPRS score be posted?

Yes. The NIST SP 800-171 DoD Assessment Methodology says the score of 110 is reduced by each requirement not implemented, which may result in a negative score. Requirements weighted at 5 points include the basic requirements such as limiting system access and the derived requirements with the largest exposure, so a company that has implemented little can fall below zero. Codified DFARS 252.204-7019 requires only that a current score be posted, not a minimum score, and clause 252.240-7997 under class deviation 2026-O0025 Revision 3 sets no minimum either.

Sources

1. 1Supplier Performance Risk System (SPRS) · Naval Sea Logistics Center Portsmouth, U.S. Navy
2. 2SPRS Frequently Asked Questions · Naval Sea Logistics Center Portsmouth, U.S. Navy
3. 3SPRS Reference Material · Naval Sea Logistics Center Portsmouth, U.S. Navy
4. 4SPRS Access Instructions · Naval Sea Logistics Center Portsmouth, U.S. Navy
5. 5SPRS NIST SP 800-171 Assessments · Naval Sea Logistics Center Portsmouth, U.S. Navy
6. 6SPRS CMMC Cyber Reports · Naval Sea Logistics Center Portsmouth, U.S. Navy
7. 7SPRS Software User's Guide for Awardees/Contractors, Version 4.1.5, May 2026 · Naval Sea Logistics Center Portsmouth, U.S. Navy
8. 8NIST SP 800-171 Quick Entry Guide, Version 4.0, May 2024 · Naval Sea Logistics Center Portsmouth, U.S. Navy
9. 9SPRS Evaluation Criteria Manual, Version 5, September 2026 · Naval Sea Logistics Center Portsmouth, U.S. Navy
10. 10252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements · Acquisition.gov
11. 11252.204-7020 NIST SP 800-171 DoD Assessment Requirements · Acquisition.gov
12. 12252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements · Acquisition.gov
13. 13252.204-7024 Notice on the Use of the Supplier Performance Risk System · Acquisition.gov
14. 14Subpart 204.76 - Supplier Performance Risk System · Acquisition.gov
15. 15Subpart 204.73 - Safeguarding Covered Defense Information and Cyber Incident Reporting · Acquisition.gov
16. 16Class Deviation 2026-O0043, Revolutionary FAR Overhaul Part 4, DFARS Part 204 · Defense Pricing, Contracting, and Acquisition Policy (effective February 17, 2026)
17. 17Class Deviation 2026-O0025, Revision 3, Revolutionary FAR Overhaul Part 40, DFARS Part 240 · Defense Pricing, Contracting, and Acquisition Policy (signed September 3, 2026)
18. 18Attachment 1, Class Deviation 2026-O0025, Revision 3: DFARS Part 240 · Defense Pricing, Contracting, and Acquisition Policy
19. 19Implementing Department of War Chief Information Officer's Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements · Under Secretary of War for Acquisition and Sustainment (July 13, 2026)
20. 2032 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program (July 1, 2025 edition) · U.S. Government Publishing Office
21. 21NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020 · Office of the Under Secretary of Defense for Acquisition and Sustainment
22. 22The Use of the Supplier Performance Risk System (SPRS) in Implementing DFARS Case 2019-D041 · Defense Pricing, Contracting, and Acquisition Policy
23. 23Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041); Interim Rule, 85 FR 61505 (September 29, 2020) · Federal Register, U.S. Government Publishing Office

Where this shows up in our work

• LEDGER, auditable Army acquisition decisions turns a trade study into a package where every number cites its source and AI drafts but never decides.
• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.