Terms / Assessment
SPRS
The Supplier Performance Risk System. It holds your NIST SP 800-171 score, your CMMC status, and the annual affirmation you sign.
Also called Supplier Performance Risk System.
Practitioner Guidance
What it means in practice
SPRS is where the Government looks to see whether you are eligible.
The Supplier Performance Risk System holds your summary score, your CMMC status, and your affirmations. A contracting officer checks it. A prime contractor checks it before awarding you a subcontract. If nothing is there, you are not considered for award under DFARS 252.204-7019, regardless of how secure you actually are.
Three separate things live there, and people confuse them.
The NIST SP 800-171 summary score comes from the DoD Assessment Methodology and is required by DFARS 252.204-7020. The CMMC status comes from a self-assessment or a certification assessment. The affirmation is the annual statement of continuing compliance signed by your affirming official. You can hold one and not the others.
The affirmation is a signature with consequences.
Section 170.22 requires an affirming official, a senior representative responsible for compliance, to affirm after every assessment and annually thereafter. The statement attests that you have implemented and will maintain the requirements for the systems in your scope. Signing it while knowing a requirement has lapsed is a false statement, not an administrative step.
Access takes longer to arrange than people expect.
Reaching SPRS requires an account through the Government's procurement environment, with roles assigned by your company's administrator. Sort this out before a deadline depends on it. Companies routinely discover during a bid that nobody currently employed can post a score.
What falls short
- A score calculated and never posted. The posting is what the clause requires.
- An affirmation signed by whoever had the account. The rule names a senior official responsible for compliance.
- A score that no longer matches the system. A rebuild or a move to a new tenant changes what you assessed.
Edge cases
- Your score is negative. That is ordinary arithmetic under the methodology, and the honest number belongs there.
- You run several systems. Each has its own entry, tied to the codes your system security plan covers.
- Your status is Conditional. It is current for 180 days, and a successful closeout does not reset the status date.
Over-engineering
- A compliance platform bought to manage a handful of submissions. The submissions are few, and the calendar is the hard part.
- Recalculating the score monthly. Reassess when the environment changes or the requirement dates demand it.