Who Actually Submits a Score to SPRS
If your contract includes DFARS 252.204-7019 and 252.204-7020, you are required to have a current NIST SP 800-171 Basic Assessment score on file in the Supplier Performance Risk System (SPRS) before you can be awarded or retain certain DoD contracts. This applies to Level 2 subcontractors handling CUI, not Level 1 FCI-only subs, who instead affirm their 17 practices without a numeric score.
How the Score Itself Is Calculated
The DoD Assessment Methodology starts every organization at a perfect 110, one point for each of the 110 NIST SP 800-171 controls. For every control not fully implemented, a weighted value is subtracted: 5 points for the 42 highest-impact controls, 3 points for 14 controls with a more contained effect, and 1 point for the remaining 54. There is no partial credit for a partially implemented control, and the score can go negative, down to a floor of -203.
Two controls have a conditional weight: multi-factor authentication (3.5.3) and FIPS-validated cryptography (3.13.11) can cost either 5 or 3 points depending on how far short of the requirement you actually fall.
The Submission Steps
- Complete your self-assessment against all 110 controls, with evidence behind each one, not just a gut-check pass.
- Calculate your score using the weighted subtraction method above.
- Log in to PIEE (Procurement Integrated Enterprise Environment) and access the SPRS module, which is where DoD assessment scores are entered, not a general contractor portal.
- Enter the assessment details: your system security plan name, CAGE code, assessment date, assessment scope, and the resulting score.
- Keep your supporting documentation. The score you submit needs to be backed by a System Security Plan (SSP) and, for any unmet control, a Plan of Action and Milestones (POA&M) showing how and when you will close the gap.
Where a Tool Actually Helps
The submission itself is a five-minute data entry task once you know your number. The work that actually takes time is getting to a defensible number in the first place: tracking 110 controls, their evidence, and the resulting weighted math without losing track of what changed since your last review.
Threshold tracks all 110 controls with SPRS-ready scoring built in, so the number you submit is the same one your workspace has been tracking all along, not a last-minute recalculation. It also generates the POA&M entries directly from whatever gaps are still open.