Your SPRS Score,
Explained.

What is SPRS?

SPRS stands for Supplier Performance Risk System. It's an online database run by the U.S. Department of Defense, and it holds the cybersecurity compliance scores of every company doing business in the defense supply chain.

Every DoD subcontractor — from a 200-person engineering firm to a three-person electrical sub on a NAVFAC base — must submit a CMMC self-assessment score into SPRS. That score has to reflect reality. It's not a guess, an estimate, or an aspiration. And once submitted, a senior official in your company has formally affirmed it.

This is the part most subs don't realize until they lose a bid. Primes aren't being cautious — they're complying with federal contract regulations that require them to verify your score. A prime that awards a sub work without a valid SPRS score on file is taking on substantial legal exposure of their own. Increasingly, they're not willing to do that.

The CMMC Level 1 Score, in Plain English

Most Pacific defense subs — electricians, plumbers, HVAC, welders, fencing, roofing, general trades — fall under CMMC Level 1. That's the level for companies that handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). If your work touches DoD contracts but doesn't involve sensitive technical specs, controlled drawings, or weapons-related data, you're almost certainly Level 1.

Unlike higher CMMC levels, Level 1 doesn't allow partial credit. It's not "do most of it and you'll be fine." Either every practice is met, or you are not compliant.

The 15 practices cover the basics: who can log in to your systems, what each person is allowed to do, who controls your network connection, how you handle visitors, what runs on your devices, how you destroy old equipment. If your shop already runs on commodity tools — Microsoft 365 or Google Workspace, a consumer router, no shared accounts — you may be closer than you think. Or you may have gaps you don't realize exist.

What Happens When You Don't Have a Score

The cost of not being in SPRS isn't theoretical. It shows up in three specific ways:

The Legal Warning Most Subs Don't Hear About

This is the single most important thing to understand about SPRS, and the single most under-discussed: a wrong score is worse than no score. No score gets you out of bidding. A wrong score, audited later, can get you debarred from federal work entirely and create personal legal exposure for whoever submitted it.

The right path is the one that ends with a score that matches reality — not the one that gets you to "submitted" the fastest.

So What Do You Actually Do?

The path to a valid SPRS score has four parts, in order:

One. Honestly assess where you stand against the 15 Level 1 practices. Most subs who do this for the first time discover three or four gaps they didn't know existed — usually in account management, device disposal, or the handling of shared logins.

Two. Fix the gaps. This is where most subs get stuck. The practices themselves are often straightforward, but figuring out how to translate them to your specific shop — the tools you actually use, the way your team actually works — takes someone who has done it before.

Three. Document what you've done. SPRS submission is not just a number — it's an attestation backed by a System Security Plan that shows how each practice is implemented at your company. If you ever face a verification audit, this documentation is your defense.

Four. Submit through the proper federal systems. This requires active SAM.gov registration, the right login credentials, and someone with senior authority to make the affirmation.

Each part has details that aren't worth covering in a free primer — partly because the details change, partly because doing this correctly is what separates a defensible compliance posture from a hopeful one.