A machine shop owner in Wallingford called last month because a purchasing manager at his prime had emailed asking for his "current SPRS score and affirmation date." He had never heard the term. He is not alone. Most small defense suppliers in Connecticut first hear "SPRS" from a customer, not from the government.
This is what the number is and what to do about it.
SPRS in one paragraph
SPRS is the Supplier Performance Risk System, a Department of War database. Among other things, it holds a score that says how well your company meets NIST SP 800-171, the set of 110 security controls that anyone handling Controlled Unclassified Information (CUI) has been required to follow since 2017. Contracting officers and primes look up your score when deciding whether to award you work. Since November 2025, under CMMC Phase 1, a current score is required for many new contracts.
How the score is calculated
The scoring method is published by DoD and it is simple arithmetic.
You start at 110, one point for each control.
For every control you do not fully meet, you subtract points. Most controls are worth 1 point. Some are worth 3. A handful of the most important ones are worth 5. Multi-factor authentication, for example, is a 5-point control. So is encrypting CUI on mobile devices and laptops. So is having a System Security Plan at all (technically, without an SSP you cannot submit a score).
Because the deductions add up past 110, scores can be negative. The floor is -203. A shop that has done nothing lands somewhere between -150 and -50. That is not an insult. It is just what the math says about a business that was never told what the rules were.
A perfect 110 means every control is fully implemented. It does not mean you are certified. It means you say you are done.
Who has to sign it
The score is submitted with an affirmation by a senior company official, usually the owner. The affirmation says the score is accurate and has to be renewed annually. That is where the risk lives.
Since 2021, the Department of Justice has been pursuing False Claims Act cases against contractors who posted scores they could not back up. Settlements have run into the millions. A shop that posts 110 when the real number is 40 is not taking a shortcut. It is signing a false statement to the federal government.
So the one rule about SPRS scores is: post the truth, then fix the truth. A low honest score with a plan of action is normal. A high dishonest score is a liability.
What a prime does with it
When a purchasing manager asks for your score, they are usually doing one of three things:
- Filling in their own supplier risk spreadsheet. They have a flow-down obligation and an auditor of their own. A missing score is a blank cell they have to explain.
- Deciding who stays on the approved list. Faced with two shops that can make the same part, the one with a score and an SSP is the safer choice. That decision often happens without anyone calling you.
- Preparing for CMMC. Even with Phase 2 paused, primes know third-party certification is coming back in some form. They want suppliers who are moving, not suppliers who are waiting.
Your score does not have to be 110 to keep the work. It has to be honest, it has to exist, and it has to be going up.
How to get one without guessing
Confirm you actually handle CUI. If your contracts include DFARS 252.204-7012, assume yes. If you receive drawings or specs marked CUI, or flowed down from a program, yes. If you are truly unsure, ask your prime in writing.
Do a real assessment. Go through the 110 controls against your actual environment: which computers, which accounts, which network, where the drawings live. The DoD assessment methodology document tells you the point value of each control. You can do this yourself with a spreadsheet and a weekend, or have someone do it with you in an afternoon.
Write the System Security Plan. It describes what your system is, where CUI lives, and how each control is handled. It does not have to be long. It has to be true.
Write the Plan of Action and Milestones. Every control you do not meet goes here, with what you plan to do and roughly when. This document is what turns a bad score into an acceptable one in a prime's eyes.
Submit to SPRS through PIEE. You need a Procurement Integrated Enterprise Environment account. Your CAGE code ties it together. The submission itself takes minutes once the assessment is done.
Then fix things, in point order. MFA, admin rights, encryption on laptops, and central logging are where the 5-point and 3-point controls cluster. Fix those first and the score moves fast.
A realistic timeline for a small shop
A 12-person shop starting from nothing can usually go from "never heard of SPRS" to an honest submitted score with an SSP and a POA&M in a few weeks. Moving that score into the positive range typically takes a few months of technical work, mostly around accounts, MFA, logging, and retiring old equipment. Getting to 110 with evidence for every control is a longer project, but it is a project with an end.
Where we fit
CT Tech Express does the readiness work for small Connecticut defense suppliers: the preliminary review, the full gap assessment and honest score, the SSP and POA&M, the technical fixes, and the evidence package. We do not certify anyone. When a third-party assessment is needed, we bring in a Connecticut partner that holds CMMC Level 2 certification and can connect you with an independent assessor.
If you just got the email from your prime, the CMMC readiness page explains the full process, and the preliminary on-site review is free.