How to Calculate Your SPRS Score: DOD Weight Table & Step-by-Step Guide

What Is the SPRS Score?

The Supplier Performance Risk System (SPRS) score is a numerical metric the Department of Defense uses to evaluate a contractor's cybersecurity posture against NIST SP 800-171. Every DIB contractor handling CUI must submit their SPRS score to SPRS.mil per DFARS 252.204-7019.

Your score ranges from -203 to 110, where 110 means every control is fully implemented and -203 means none are.

How the Score Is Calculated

The calculation is straightforward:

1. Start at 110 (the maximum score)
2. For each control that is not implemented and does not have a Plan of Action & Milestones (POA&M): subtract the DOD weight (1, 3, or 5)
3. Controls with a valid POA&M are not deducted but you must have a documented remediation plan with milestones

The DOD Weight Categories

Weight	Meaning	Count	Max Impact
5	Critical: highest impact on CUI protection	44 controls	220 points
3	Significant: important supporting controls	14 controls	42 points
1	Supporting: foundational but lower risk	51 controls	51 points

Note: Your score starts at 110. Not implementing any controls results in the minimum score of -203. In practice, most contractors fall somewhere between these extremes depending on their implementation status.

Score Interpretation

Score Range	Status	What It Means
90-110	Excellent	Minor gaps, likely audit-ready
50-89	Good	Solid foundation, targeted remediation needed
0-49	Fair	Significant gaps in multiple families
-50 to -1	Poor	Major cybersecurity program deficiencies
Below -50	Critical	Fundamental controls missing, high risk

Common SPRS Calculation Mistakes

1. Using Equal Weights

Many spreadsheet-based tools treat all controls equally. This produces wildly inaccurate scores. A weight-5 access control gap costs 5x more than a weight-1 supporting control.

2. Counting Partial as Full

Partially implemented controls should either have a POA&M (no deduction) or be counted as not implemented (full deduction). There's no "half credit" in SPRS scoring.

3. POA&M Without Milestones

A POA&M entry must include specific milestones and target dates. A vague "we plan to fix this" doesn't qualify and assessors will flag it.

4. Not Updating After Changes

Your SPRS score is a living metric. When you implement a control, your score should update. Many contractors submit once and forget to update as they remediate.

Prioritizing by Weight

The fastest way to improve your SPRS score is to focus on weight-5 controls first. Implementing a single weight-5 control recovers 5 points, the same as implementing five weight-1 controls.

High-Impact Control Families

• Access Control (AC): 22 controls, many weight-5. Biggest single impact
• System & Communications Protection (SC): 16 controls, heavy weight-5 concentration
• Identification & Authentication (IA): 11 controls, critical for CUI protection
• Audit & Accountability (AU): 9 controls, frequently flagged by assessors

Automated SPRS Calculation

Manually calculating your SPRS score from a spreadsheet is error-prone and time-consuming. CMMC Command calculates your score in real-time using the official DOD weight table as you assess each control.

Features include:

• Real-time SPRS score that updates as you change control statuses
• SPRS Impact Simulator: see exactly how implementing a specific control changes your score
• SPRS trend history: track your score improvement over time
• DOD-accurate weights: the exact same weight table used by SPRS.mil

Calculate your SPRS score for free. Takes less than 30 minutes.