No SPRS Score, No Award

The gate most contractors do not see

Every federal solicitation involving controlled unclassified information carries a quiet clause: DFARS 252.204-7019. It requires offerors to have a current NIST 800-171 assessment posted in the Supplier Performance Risk System, the Pentagon's cybersecurity scoreboard, before they can be considered for award. Contracting officers verify it before signing.

This is not an evaluation factor. It is not points on a scorecard. It is a gate. A missing or expired SPRS assessment does not lose you the bid. It keeps you out of the room entirely.

And most of the industrial base is standing outside it. A 2025 Merrill Research/CyberSheath study found only 42 percent of defense contractors had a current score posted in SPRS.

How the score works

SPRS scoring starts at 110. Each unimplemented NIST 800-171 control subtracts points by weight: five points for each of the 42 foundational controls, three points for 14, one point for 51, with a floor of negative 203. POA&M items do not change the score. Planned is not implemented.

The median score across the industrial base is 60. That is fifty points of exposure sitting in a government database, visible to every contracting officer who checks.

There is also a conditional threshold that matters for CMMC Level 2: a score of 88 or above, with only one-point controls remaining on POA&M, and the six never-deferrable controls fully implemented. Miss any leg of that gate and conditional status is off the table.

The score must survive contact with reality

Posting a score is step one. Surviving scrutiny of it is the rest.

In June 2026, LOGZONE paid $507,144 to settle False Claims Act allegations after reporting a perfect 110 on two Navy contracts while the Defense Contract Management Agency measured negative 170. The gap between the claimed score and the real one was not a paperwork error. It was, in the Justice Department's framing of this enforcement wave, a misrepresentation.

Cyber FCA settlements exceeded $52 million in FY2025, up 233 percent year over year. The Department's posture, in its own words: these cases are "not about data breaches, premised on misrepresentations." Your SSP, your score, and your POA&M form a single evidentiary chain. If the three do not agree with each other, the chain breaks at the weakest link, and the government now pays whistleblowers to find it. They collected $4.5 million last year.

No public case was found of a contractor losing a specific bid solely over a missing SPRS score. That absence should comfort no one. The clause operates before award decisions are documented, which is exactly why it generates no case law and plenty of quiet losses.

Why contractors sit below the gate

Three patterns repeat:

The aspirational SSP. The plan describes the environment the company intends to have. The score claims it already exists. DCMA exists to notice the difference.

The unweighted POA&M. Every gap is listed; none is sequenced. The five-point controls sit beside the one-pointers, and leadership cannot tell which ten items would move the score forty points.

The stale score. Something changed: a new SaaS tool, a departed admin, an expired affirmation. Nobody re-ran the assessment. The posted score is now a historical document with legal consequences.

Closing the gap in priority order

A defensible SPRS position has four parts, in this order:

A real assessment. All 110 controls, evidenced, scored honestly. If the number is low, the number is low. A low honest score is a project plan. A high dishonest one is a liability.
A reconciled SSP. Every control narrative must match the implementation the score claims. Reconcile before you post, not after DCMA calls.
A weighted POA&M. Sequence by point weight and audit risk: five-point and three-point controls first, the never-deferrable requirements closed, one-pointers scheduled. This is also the path to the 88-point conditional gate.
An evidence packet. Artifacts an auditor can follow without your help: configurations, logs, policies, training records. Evidence is what turns a self-assessment from a claim into a position.

The cost of waiting

Industry estimates put Level 2 preparation at $75,000 to $250,000 or more for small and mid-size firms, with 68 percent taking over a year and assessor lead times stretching 12 to 18 months. Meanwhile the 72-hour incident reporting clock under DFARS 7012 keeps running whether your paperwork is ready or not.

Every quarter without a current, defensible score is a quarter of solicitations you cannot win and contracts you hold at increasing risk.

AI Tech Pros runs a one-day SPRS Readiness Sprint: Map, Assess, Prioritize, Sustain. You leave with your real score, a reconciled SSP gap analysis, a weighted POA&M, and an evidence packet template. Start with the free SPRS calculator at aitechpros.ai/tools.

Statistics in this paper trace to DOJ enforcement summaries (via Fluet.law and Mayer Brown 2025 Year in Review), Merrill Research/CyberSheath 2025, and DoD public program data. Cost and timeline figures are industry estimates, not guarantees.

AI Tech Pros runs a one-day SPRS Readiness Sprint: Map, Assess, Prioritize, Sustain. Book a readiness call or score yourself free.