SPRS

The DoD's Supplier Performance Risk System — where your NIST 800-171 score lives.

SPRS (Supplier Performance Risk System) is the DoD's authoritative repository for supplier risk information. Contractors under DFARS 252.204-7012 must post a NIST 800-171 self-assessment score (out of 110).

A low or missing SPRS score is a real contracting risk — primes screen SPRS before flowing down work.

Understand what the recorded score represents

A score is meaningful only with its assessment method, scope, date, and supporting records. Before relying on an entry, confirm which organization and environment it covers. A score for a limited enclave does not automatically describe every system, office, or subsidiary in the business.

Prepare before entering information

Reconcile the assessment worksheet with the implementation evidence and any open remediation items. Keep the reasoning for deductions and a named reviewer so the organization can explain how the result was calculated. Authorized users should follow the current official submission instructions rather than treating a readiness tool as a direct submission mechanism.

Use the record responsibly

SPRS is a supplier information system, not a public compliance badge. Access, submissions, and contractual expectations depend on the applicable process. Do not label a company certified merely because it has a recorded score; distinguish self-assessment information from independently assessed status and check the governing contract for its requirements.

Related terms

CMMC

The DoD's Cybersecurity Maturity Model Certification, mandatory across the defense supply chain.

NIST 800-171

The 110-control baseline for protecting Controlled Unclassified Information (CUI).

POA&M

Plan of Action & Milestones — the roadmap for closing security control gaps.

See how Scarlet Risk covers SPRS.

One platform for compliance, cyber, vendor, and world-watch risk.

Schedule Live Demo