Your SPRS score must reflect actual technical implementation of NIST 800-171 controls. We validate your score against your real infrastructure, identify False Claims Act exposure, and give you a ranked roadmap to improve it.
The Supplier Performance Risk System (SPRS) score is a self-assessed measure of NIST SP 800-171 compliance. Under DFARS 252.204-7019, DoD contractors must complete a self-assessment and submit their score to SPRS before being awarded a contract. The maximum score is 110, representing full implementation of all 110 requirements. Each unimplemented control reduces the score.
The problem is the self-assessment process. Many contractors submit scores based on policies and intent rather than on actual technical implementation. A score of 88 on paper, with 22 controls listed as in-progress, often reflects a very different reality when assessed against infrastructure evidence.
A CMMC Level 2 C3PAO assessment will compare your submitted SPRS score against what is actually running in your environment. A significant discrepancy between submitted score and assessed score creates False Claims Act exposure in addition to assessment failure.
All 110 controls technically implemented and verifiable. CMMC Level 2 assessment-ready.
Fewer than 22 controls open. Targeted remediation typically achievable in weeks to a few months.
More than 22 controls open. Structured remediation program needed. POA&M required.
High-weight controls unimplemented. Assessment failure very likely without structured remediation. Possible FCA exposure if score was previously reported higher.
Each control evaluated against technical evidence from your actual infrastructure, not your policy documentation.
Review your current SPRS submission and the self-assessment methodology used to produce it. Identify which controls were rated and what evidence was used.
Evaluate each control against configuration exports, access logs, MFA state, encryption settings, patch records, and network architecture. Evidence-first evaluation against what is in your infrastructure.
Compare your submitted score to the technically-validated score. Identify the delta, which controls account for it, and whether the discrepancy carries FCA exposure given contract history and submission timing.
Prioritized list of open controls ordered by SPRS point value. IaC-based remediation path for each gap. Timeline to reach target score for CMMC Level 2 assessment readiness.
What contractors need to know before validating their SPRS submission.
Control-by-control evaluation before committing to remediation. Produces the evidence base for a validated SPRS score.
End-to-end readiness engagement: gap to validated SPRS score to C3PAO assessment preparation.
Implement the open controls that are dragging your SPRS score down — written into your infrastructure using IaC.
A 30-minute call is enough to understand what your current submission says, what your infrastructure actually shows, and what the gap means for your contracts and your schedule.
Schedule a Free SPRS Validation ConversationVirtual Infrastructure Services LLC · South Brunswick, NJ · +1 (732) 200-7352