Case Study: The MAPS Method for SPRS Readiness

The problem

Most defense contractors know their SPRS score is low. Few know which ten fixes would move it forty points, which gaps an auditor would flag first, or what "ready" actually costs in time and sequencing. The industry data explains why: the median SPRS score sits at 60 against a 110 benchmark, an estimated 1 percent of the industrial base is fully prepared for assessment, and 68 percent of organizations report taking more than a year to get ready.

The standard response is a flat POA&M: every gap listed, none sequenced. Leadership cannot tell the difference between a five-point control and a one-pointer, so everything feels equally urgent and nothing gets prioritized.

The method: MAPS

AI Tech Pros built MAPS (Map, Assess, Prioritize, Sustain) to replace the flat POA&M with a sequenced plan:

- Map. Inventory the environment against all 110 NIST 800-171 controls. No control gets a status without an owner and a location. - Assess. Score honestly. SPRS starts at 110 and subtracts 5 points for each unimplemented foundational control (42 of them), 3 points for 14, and 1 point for 51, with a floor of negative 203. POA&M items do not change the score. Planned is not implemented. - Prioritize. Sequence the gaps in phases. Phase 0 holds the never-deferrable controls (3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5, 3.12.4): these close first regardless of weight. Then five-point and three-point controls in Phase 1 and 2, one-pointers in Phase 3. The sequencing also targets the 88-point conditional gate under 32 CFR 170.21 (88 or above, only one-pointers remaining on POA&M, never-deferrable six closed). - Sustain. Leave a plan the team runs Monday morning: owners, evidence requirements, and re-assessment triggers for when the environment changes.

The method, demonstrated: our own baseline

We ran MAPS on AI Tech Pros itself during our SSP build. The honest assessment: 8 controls implemented, 99 planned with POA&M milestones, 3 not applicable with justification, for a projected SPRS score of negative 157.

That number is not a failure. It is a starting line with a map attached. Prioritization showed:

- Five unimplemented never-deferrable controls flagged close-first in Phase 0. - Every five-point and three-point control must close to reach the 88 conditional threshold. The math is unforgiving and therefore clarifying: there is no shortcut, only sequence. - Sixty-three assumptions were flagged for verification before attestation, five of them score-moving (device inventory, MFA coverage, FIPS-validated cryptography status, the full SaaS inventory, and backup and screening posture).

The output was not a longer POA&M. It was a shorter one, in order: Phase 0 items that close audit risk first, then the weighted path to 88, then the long tail of one-pointers.

What this means for a contractor

The deliverable of a MAPS engagement is four things:

1. A real, evidenced SPRS score.
2. An SSP reconciled to that score, so the paper and the truth agree before DCMA ever looks.
3. A phased POA&M sequenced by weight and audit risk, not by convenience.
4. An evidence packet an auditor can follow without your help.

No invented outcomes. No "we raised a client 100 points in a week." Just a method that turns a score into a sequence, demonstrated on our own baseline before we ever sell it.

---

The one-day version of this engagement is the SPRS Readiness Sprint: Map, Assess, Prioritize, Sustain, installed in a day, run by your team the next. Start with the free SPRS calculator at aitechpros.ai/tools.

---

AI Tech Pros runs a one-day SPRS Readiness Sprint: Map, Assess, Prioritize, Sustain. Book a readiness call or score yourself free.