SPRS Scores and the Annual CMMC Affirmation, Explained

Last reviewed October 28, 2026. This update draws on the sourced status section of our CMMC & GCC Compliance page. We’ll update it when the CMMC review is published.

What SPRS is

The Supplier Performance Risk System (SPRS) is where NIST SP 800-171 assessment scores and CMMC self-assessment results and affirmations are posted.

How a Basic score is calculated

A Basic assessment starts at 110 and subtracts 1, 3, or 5 points for each requirement that isn’t met, so the score can go below zero. DFARS 252.204-7019 requires a current score, no more than 3 years old, for each system that’s relevant to the contract, to be considered for award on contracts that include NIST SP 800-171.

The annual affirmation

The DFARS rule that puts CMMC into contracts took effect November 10, 2025 and started Phase 1. When a solicitation or contract calls for a CMMC Level 1 or Level 2 self-assessment, you post your results in SPRS and affirm them every year. DFARS 252.204-7021, the CMMC clause, also requires you to keep the level named in the contract current for every system that processes, stores, or transmits FCI or CUI.

• Level 1 protects Federal Contract Information with 15 basic requirements from FAR 52.204-21 and an annual self-assessment.
• Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Rev. 2.

The July 13, 2026 suspension of Phase 2 didn’t change this. Read what the CMMC Phase 2 suspension means.

SSP and POA&M

• System Security Plan (SSP): describes the system boundary, how it operates, how each security requirement is met, and how it connects to other systems.
• Plan of Action and Milestones (POA&M): lists the requirements that aren’t met yet and when they will be. Level 1 doesn’t allow them. Level 2 allows them only for certain lower-weight requirements, and only if your score is at least 80% of the total; open items must be closed within 180 days to reach final status.

Where the evidence comes from

The tools we run produce much of the evidence those documents point to: ThreatLocker policies and its Unified Audit, Duo Federal sign-in and device reports, the Kiteworks audit log, NinjaOne patch and inventory reports, and Microsoft 365 audit records. We pull those records together when you or your compliance advisor need them.

Talk to us

We get your environment and your evidence ready for CMMC, and we keep it that way with Sierra Experts Managed Services, 24x7. See the full plan on our CMMC & GCC Compliance page, schedule a scoping call, or book a meeting.

Sources: 32 CFR Part 170, 89 FR 83092 · DFARS rule, 90 FR 43560 · Department of War release, July 13, 2026 · DoD CIO: About CMMC

This post is general guidance, not legal or compliance advice. Sierra Experts is not a C3PAO and does not certify CMMC compliance. Confirm your requirements with your compliance or legal advisors.