SPRS: what it holds, who sees it and what to ask suppliers
What SPRS holds, who can see it, and what to ask suppliers for before award: CMMC scores, affirmations, and DoD delivery and quality data.
A contracting officer can pull up a supplier's on-time delivery history and cybersecurity score in SPRS before making an award. A prime chasing that supplier for the same information cannot see either one: delivery and quality data in SPRS is visible only to DoD and the supplier itself, and DoD walls off a supplier's own CMMC score from every other company. That split decides what a buyer has to ask a supplier for directly, and what a supplier should check on its own record before it costs the company an award.
What is SPRS?
The Supplier Performance Risk System (SPRS) is the DoD database a contracting officer checks before awarding a defense contract. It holds the cybersecurity scores and CMMC affirmations a supplier posts itself, and the delivery, quality and risk scores DoD builds from its own contract and receiving records. Each supplier sees only its own.
SPRS feeds two different DFARS jobs. A contracting officer checks a supplier's CMMC status in SPRS before award and before exercising an option, and separately weighs its supplier risk score in the award decision. The CMMC record comes from the supplier. The delivery, quality and risk records come from DoD systems.
What does SPRS hold, and who can see it?
SPRS holds CMMC scores and statuses that a supplier posts itself, and delivery, quality and risk data that DoD collects from contract and receiving records. Contracting officers see both when deciding an award. A supplier sees only its own CAGE codes; a prime sees neither its supplier's CMMC record nor its supplier's delivery and quality record.
What SPRS holds and who sees it
Table of five record types held in the Supplier Performance Risk System: CMMC self-assessment score and status, CMMC annual affirmation, NIST SP 800-171 Medium or High Assessment score, on-time delivery classification, and quality classification and Supplier Risk Score. For each row, the table lists who posts the record, who can see it, and the DFARS or regulatory source. The CMMC rows are posted by the supplier's SPRS Cyber Vendor User and affirming official; the NIST SP 800-171 Medium or High score is posted by a DoD assessor, typically DCMA, after an on-site or virtual review; delivery, quality and risk records are posted automatically by SPRS from other government systems, with no supplier input. In every row, a supplier can see only its own CAGE codes, a prime cannot see its supplier's record in SPRS at all, and DoD contracting and acquisition personnel can see the record once it clears any preview period.
| Record type | Who posts it | Who can see it | Source |
|---|---|---|---|
| CMMC self-assessment score and status (Level 1 or 2 Self) | A supplier user with the SPRS Cyber Vendor User role; affirmation by the affirming official | The supplier (own CAGE codes) and DoD contracting and acquisition personnel; not visible to a prime | DFARS 252.204-7021(e)(2) |
| CMMC annual affirmation of continuing compliance | The supplier's affirming official | The supplier (own CAGE codes) and DoD contracting and acquisition personnel; not visible to a prime | DFARS 252.204-7021(d)(3), (e)(3); 32 CFR 170.22 |
| NIST SP 800-171 Medium or High Assessment summary score | DoD assessor (typically DCMA), after an on-site or virtual review | The supplier (own summary score only) and DoD Components | DFARS 252.240-7997(d)-(f), Class Deviation 2026-O0025 Rev 3; 32 CFR 170.24 |
| On-time delivery classification, by Supply Code | SPRS automatically, from Electronic Data Access, FPDS, Wide Area Workflow and PDREP contract and shipment data | The supplier (own CAGE codes) and contracting officers; not visible to a prime | SPRS Evaluation Criteria Manual, Section 3.2; DFARS 204.7603, Class Deviation 2026-O0043, Part 204 |
| Quality classification and Supplier Risk Score | SPRS automatically, from PQDRs, SDRs, GIDEP alerts, CPARS, DCMA/PDREP Corrective Action Requests and SAM integrity records | The supplier (own CAGE codes) and contracting officers; not visible to a prime | SPRS Evaluation Criteria Manual, Sections 3.1, 4.1; DFARS 252.204-7024; DFARS 209.105-1(2) |
A supplier posts its own CMMC score; DoD collects everything else automatically, and a prime sees neither without asking the supplier directly.
A supplier enters its CMMC self-assessment result in SPRS, and its affirming official affirms continuing compliance there after each assessment and every year. DFARS 252.204-7021(d)(3), (e)(2)-(3); 32 CFR 170.22. See the CMMC lesson for the levels, statuses and affirmation rule.
Delivery and quality data works differently. SPRS receives contract, shipment and receiving records from systems including the Electronic Data Access system, the Federal Procurement Data System, Wide Area Workflow and the Navy's Product Data Reporting and Evaluation Program, and turns them into a delivery score and a quality classification by Federal Supply Classification, Product Service Code or NAICS code. SPRS Evaluation Criteria Manual, Sections 1.3.1, 3.1, 3.2. A separate Supplier Risk Score sums ten factors, including Corrective Action Requests from DCMA and the Navy's PDREP system, Contractor Performance Assessment Reporting System ratings, GIDEP alerts, and integrity records from the System for Award Management. SPRS Evaluation Criteria Manual, Section 4.1. No supplier posts these records. A contracting officer must consider a supplier's risk assessment, if SPRS has one, when deciding an award DFARS 204.7603; 252.204-7024; Class Deviation 2026-O0043, Part 204. and when determining responsibility DFARS 209.105-1(2); Class Deviation 2026-O0042, Part 209. A supplier with no assessment on file is not scored favorably or unfavorably for the gap.
How does the NIST SP 800-171 DoD Assessment score work?
The score starts at 110, one point per requirement in NIST SP 800-171 Revision 2, and a contractor subtracts a weighted value for every requirement it hasn't implemented, so the score can run negative. The weights run 1, 3 or 5 points by how much a gap exposes CUI, down to a floor of −203. 32 CFR 170.24(c)(2); NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, Annex A.
A Basic Assessment is the contractor's own self-assessment, with a Low confidence level because the contractor generated the score. A Medium or High Assessment adds a government document review or on-site verification, and when DCMA runs one, it takes precedence over any other assessment of the same system. Class Deviation 2026-O0025, Revision 3, 252.240-7997(c); 32 CFR 170.16(a)(1)(iv). See NIST SP 800-171 for how to run and document each assessment type.
Since February 1, 2026, Class Deviation 2026-O0025 (now Revision 3, signed September 3, 2026) has dropped the clause pair that used to require a current Basic Assessment score before award. DFARS 252.204-7019 has no successor in Part 240. Its partner, 252.204-7020, was replaced by 252.240-7997, which keeps the Medium and High Assessment definitions and drops the Basic self-assessment provisions the two old clauses carried. Class Deviation 2026-O0025, Revision 3, DFARS 240.370-3(a)(2)-(4), 252.240-7997(a). A contract that follows the deviation's Part 240 text no longer carries a standalone clause requiring a current self-assessment score on file before award. Instead, that obligation runs through the CMMC clause, 252.204-7021, wherever the program office designates a CMMC level. The deviation's text still schedules that clause for every FCI or CUI contract from November 10, 2028, but the July 13, 2026 suspension holds later CMMC milestones in abeyance; see the CMMC lesson. Check which clauses your contract carries, with counsel, before an award.
How does a supplier post a score in SPRS, and how long does it last?
A supplier posts a score through a Procurement Integrated Enterprise Environment (PIEE) account with the SPRS Cyber Vendor User role, approved by the company's Contractor Account Administrator. A Final Level 2 status stays current for up to three years with an annual affirmation, a Final Level 1 status for one year, and a Conditional Level 2 status for 180 days. DFARS 252.204-7021(a).
That role sees every CAGE code in the company's hierarchy, so a company with several sites first fixes its CAGE hierarchy in SAM.gov, since SPRS pulls the hierarchy from SAM and updates it within about 24 hours. SPRS Software User's Guide for Awardees/Contractors, Sections 3.2, 5.1.1. NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, Annex B.
Posting a CMMC Level 2 (Self) score in SPRS
Six-step flow for a supplier posting a CMMC Level 2 (Self) score into SPRS. Step 1: confirm the company's CAGE hierarchy in SAM.gov, since SPRS pulls it from SAM and updates within about 24 hours. Step 2: request the SPRS Cyber Vendor User role in PIEE, approved by the company's Contractor Account Administrator. Step 3: score the system security plan against the 110 NIST SP 800-171 requirements using the method in 32 CFR 170.24. Step 4: enter the summary score, assessment date, the system security plans and CAGE codes in scope, and the plan of action completion date into SPRS. Step 5: SPRS issues a CMMC Unique Identifier for each system scored; a prime submits its CMMC UIDs to the contracting officer, and a subcontractor sends them to its prime when the subcontract asks. Step 6: the affirming official affirms continuing compliance in SPRS, and reaffirms every year.
- 1
Confirm the CAGE hierarchy is correct in SAM.gov; SPRS updates from SAM in about 24 hours
- Who does it
- Company's Electronic Business point of contact
- 2
Request the SPRS Cyber Vendor User role in PIEE
- Who does it
- Employee, approved by the Contractor Account Administrator
- 3
Score the system security plan against the 110 NIST SP 800-171 requirements using the method in 32 CFR 170.24
- Who does it
- Person responsible for the system security plan
- 4
Enter the summary score, assessment date, scope (system security plans and CAGE codes) and plan of action completion date into SPRS
- Who does it
- SPRS Cyber Vendor User
- 5
SPRS issues a CMMC UID for each system scored; a prime submits its CMMC UIDs to the contracting officer, and a subcontractor sends them to its prime when the subcontract asks
- Who does it
- Automatic, forwarded by the SPRS Cyber Vendor User
- 6
Affirm continuing compliance in SPRS, and reaffirm every year
- Who does it
- Affirming official
A supplier needs its CAGE hierarchy current in SAM and the right PIEE role before it can post a score; a prime submits its CMMC UIDs to the contracting officer, and a subcontractor sends them to its prime when the subcontract asks.
Separately, SPRS itself ages out every delivery, quality and risk record over a three-year span: each record's weight in the score fades daily and disappears at 1,095 days, so a late shipment stops counting after three years. SPRS Evaluation Criteria Manual, Section 2.1.
What should you ask suppliers for before award?
A prime can't look up a supplier's CMMC score in SPRS, so ask for it directly. Request the level and assessment type, whether the status is Final or Conditional, the status date, the scope of system security plans and CAGE codes, the latest affirmation date, and the CMMC UID for each system holding your data.
| Ask for | Why it matters |
|---|---|
| Level and assessment type (Self or C3PAO) | Sets what evidence and score format to expect |
| Status: Final or Conditional | A Conditional status expires in 180 days if the plan of action isn't closed |
| Status date | A Final status is current for up to three years |
| Scope: system security plans and CAGE codes covered | Confirms your data falls inside the assessed boundary |
| Latest affirmation date | Affirmation is due every year |
| CMMC UID for each system | Ties the record to the specific system holding your data |
| SPRS score, for a Level 2 self-assessment | Shows the 110-point result behind the status |
Under 252.204-7021(d)(4), a prime with subcontracts must also make sure each subcontractor completes its own affirmation before subcontract award, so send new subcontractors the same request before you sign. DFARS 252.204-7021(d)(4).
Collecting that score and affirmation date from every supplier on a bid list, before award, is follow-up work like any other request. Your team can open each request as a task and hand it to Scout Agent, who follows up with the supplier by email and phone, within the permissions your team sets.
How can a supplier review or challenge its own delivery or quality records?
A supplier with the Contractor/Vendor (Support Role) in PIEE can see its own delivery, quality and risk records in SPRS under its own CAGE codes, and can challenge any record it believes is wrong. A negative record first sits for 14 days where only the supplier sees it and it doesn't count. SPRS Software User's Guide for Awardees/Contractors, Section 7.1.
To challenge a record, a supplier attaches objective quality evidence, such as PDFs of government receiving reports, contract terms and modifications, correspondence with the contracting officer, or a signed bill of lading showing the receiving date and signature, and submits the challenge to the record's point of contact from inside SPRS. A record can be challenged twice. A record challenged during its 14-day preview stays out of scoring until it is decided. A record that was already scored stays in the score, and contracting officers can see it, while the challenge is reviewed. The adjudicator marks the outcome Upheld or Denied; SPRS still scores a Denied record but keeps waiting on revised data before it scores an Upheld one. SPRS Software User's Guide for Awardees/Contractors, Section 7.1.
Questions teams ask
Can a prime see a supplier's SPRS delivery and quality score?
No. SPRS shows a company only the data tied to its own CAGE codes. A prime asks its supplier directly for a copy, the same way it asks for a CMMC score.
Does a low SPRS score disqualify a supplier automatically?
No clause sets an automatic cutoff. A contracting officer must consider the risk assessment, if one exists, as part of the award decision, at the contracting officer's discretion. DFARS 204.7603. A supplier with nothing in SPRS yet isn't penalized for the gap.
Is a NIST SP 800-171 Basic self-assessment still required outside of CMMC?
For new DoD contracts since February 1, 2026, no. 252.204-7019 has no Part 240 successor, and 252.240-7997 covers only government-run Medium and High Assessments. A score is still required where 252.204-7021 calls for CMMC Level 2, and under older contracts or subcontracts that still carry 252.204-7019 or 7020. Check which clauses yours carries.
Where does a supplier's Supplier Risk Score come from?
SPRS sums ten weighted factors that DoD collects from its own systems, including CPARS ratings, DCMA and PDREP Corrective Action Requests, GIDEP alerts and SAM integrity records. None of it comes from the supplier. SPRS Evaluation Criteria Manual, Section 4.1.
If your team is collecting SPRS scores and affirmation dates from many suppliers before an award, talk to our team.
This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.
Sources (17)
- SPRS Evaluation Criteria Manual, Version 5 (SEP 2026)
- SPRS Software User's Guide for Awardees/Contractors, Version 4.1.5 (MAY 2026)
- NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020
- Class Deviation 2026-O0025, Revision 3 (DFARS Part 240), signed September 3, 2026
- Class Deviation 2026-O0042 (DFARS Part 209)
- Class Deviation 2026-O0043 (DFARS Part 204), effective February 17, 2026
- DFARS 252.204-7024 Notice on the Use of the Supplier Performance Risk System
- DFARS 204.7603 Procedures
- DFARS 213.106-2 Evaluation of quotations or offers
- DFARS 215.305 Proposal evaluation
- DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements (NOV 2025)
- DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements (codified text, superseded for Part 240 deviation contracts)
- DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements (codified text, superseded for Part 240 deviation contracts)
- 32 CFR 170.22, CMMC affirmations
- 32 CFR 170.16, CMMC Level 2 (Self) assessment scope and precedence
- 32 CFR 170.24, NIST SP 800-171 DoD Assessment scoring methodology
- SPRS access page (PIEE roles)