Reference · Cybersecurity & CMMC
SPRS
Supplier Performance Risk System
The Supplier Performance Risk System (SPRS) is the Department of Defense system of record where contractors post their NIST SP 800-171 self-assessment scores and where DoD stores supplier performance and risk data. Under DFARS 252.204-7020, a current score in SPRS is a condition of many DoD awards.
What it is
SPRS holds two things: the NIST SP 800-171 assessment score a contractor computes with the DoD Assessment Methodology and self-reports, and the objective supplier performance and risk metrics DoD compiles. Contracting officers check SPRS before award.
Why it exists
DFARS 252.204-7019 and 252.204-7020 require a current NIST SP 800-171 assessment (within three years) on record before a covered contract can be awarded — SPRS is where that record lives.
Who it applies to
DoD contractors and subcontractors subject to DFARS 252.204-7012. Both primes and subs must have their own current score posted.
Frequently asked
What is a good SPRS score?
The NIST SP 800-171 assessment score in SPRS starts at a maximum of 110 (all controls met) and subtracts a weighted value for each unmet control, so scores can even be negative. A perfect score is 110; contractors work their POA&M to raise the number over time.
Related terms
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.