SPRS score
SPRS, the Supplier Performance Risk System, is the DoD database where contractors post their NIST SP 800-171 self-assessment score, which primes and contracting officers can check.
Contractors subject to DFARS 252.204-7012 score themselves against the 110 requirements of NIST SP 800-171 using DoD's assessment methodology and post the result in SPRS. A perfect score is 110, and each requirement not met subtracts points, so scores can go well below zero. Primes increasingly ask their subcontractors for a current SPRS score before awarding work.
The score has to reflect reality. As of October 2026, with CMMC Phase 2 suspended, SPRS self-assessments are still required where a contract calls for them, and a score that overstates your implementation creates False Claims Act exposure. An honest score with a plan to close gaps is a better position than an optimistic one.
No software posts a score for you. Shop Server Defense is designed to help with the shop-system part of the assessment by keeping CUI on hardware you own and shipping with a control mapping that lays out which requirements the box addresses and which stay with you.
Related
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: Is My Shop Data CUI or ITAR-Controlled? (2-Minute Check) →