What is an SPRS score?
The Supplier Performance Risk System (SPRS) is the DoD's repository for contractor self-assessment scores against NIST SP 800-171. The score starts at 110 and deducts weighted points — 1, 3, or 5 — for each unimplemented control. A perfect score is 110. A fully unimplemented environment scores -203. Contracting officers see the score when evaluating contractors for CUI-handling work, which makes the SPRS submission directly tied to bid eligibility. Under 32 CFR Part 170, the score must be current and the Affirming Official must attest to its accuracy.
How SPRS scoring works (the math)
Each of the 110 NIST SP 800-171 controls carries a weight reflecting its impact on the protection of CUI: most controls deduct 1 point if unimplemented, security-critical controls deduct 3, and the highest-impact controls deduct 5. The deductions stack. A contractor who has implemented 90 of 110 controls but missed three 5-point items and two 3-point items lands at 110 − (20 × 1 base − partial-credit adjustments) − 15 − 6 = a much lower number than the simple "20 missing" suggests.
Partial implementation does not produce partial credit under the standard SPRS methodology — a control is either implemented or it is not. That makes accurate scoring depend on accurate per-objective evidence at the 320-objective level, not at the 110-control level.
Why manual SPRS scoring fails
- Spreadsheet drift. The scoring sheet at the bottom of the control tracker silently breaks the moment someone reorders rows or edits a formula cell.
- Stale evidence. Controls scored as implemented in Q1 quietly drift out of compliance by Q3, but no one re-checks until the next quarterly review.
- No audit trail. The Affirming Official has no way to show DIBCAC why a specific deduction was taken or removed.
- POA&M disconnection. Items close in the POA&M spreadsheet without updating the scoring sheet.
What Athena's SPRS scoring does
- Live calculation. The score recalculates the moment a control state changes — no quarterly recompute.
- Visible math. Every deduction shows the weight, the missing objective, and the evidence (or absence of evidence) behind it.
- Affirming Official trail. Each score change is timestamped, hashed, and attributed to the evidence and reviewer that drove it.
- What-if simulation. See the score impact of closing a specific POA&M item before you commit the work.
- Defensible submission. The score you submit to SPRS is the score the platform calculates from the same evidence your C3PAO will review.
SPRS scoring in the full assessment workflow
The SPRS score is a function of the live state of the 110 controls. Athena drives the score from the same evidence ledger that powers SSP automation and POA&M management. The score, the SSP, and the POA&M ship together in the eMASS submission with cryptographic provenance on every artifact — see the pillar page for the end-to-end loop.