Skip to content
Under attack? Call +1.864.800.0550CareersStoreBlind spot check
Talk to a Principal EngineerTalk to an engineer
Compliant · CMMC & NIST 800-171 Readiness

Can we sign our SPRS affirmation and defend it?

We score you against NIST 800-171 first so effort goes where the points are, then write the SSP and close the gaps an assessor would test.

Get your CMMC gap score
The basics, in plain English

Your SPRS score, explained

Three things worth knowing before you sign an affirmation. Open "More detail" on any card for the specifics and the official sources.

What an SPRS score is, and who needs one

If you handle CUI on a DoD contract, you score yourself against the 110 requirements in NIST 800-171 and post the result in SPRS, the DoD's Supplier Performance Risk System. Contracting officers and primes check it before they award work.

More detail: What an SPRS score is, and who needs one
  • Who needs one. Companies whose contracts include DFARS 252.204-7012 and require NIST 800-171, which usually means you store, process or send Controlled Unclassified Information (CUI).
  • How the score works. You start at 110 and subtract 1, 3 or 5 points for each requirement you haven't met. The lowest possible score is -203. Negative scores are allowed, and common the first time a company scores itself.
  • It has to be current. To be considered for award, you need an assessment no more than 3 years old, unless the solicitation asks for something more recent (DFARS 252.204-7019 (opens in a new tab)). Primes can't award covered subcontracts to a supplier without one (DFARS 252.204-7020 (opens in a new tab)).
  • A senior official affirms it. When a contract includes a CMMC self-assessment, a senior company official (the "Affirming Official") affirms compliance in SPRS after each assessment and every year after that.
  • Where CMMC stands. On July 13, 2026, the DoD suspended CMMC Phase II, the planned move to third-party assessments (DoD CIO CMMC page (opens in a new tab)). Self-assessments, NIST 800-171, DFARS 7012, your SPRS score and the affirmation all still apply.
  • Accuracy matters. A score that overstates reality can create False Claims Act exposure. The Department of Justice has settled cases over inaccurate SPRS scores (example: DOJ, March 2025 (opens in a new tab)). An honest score with a dated plan is a better position than a high score you can't back up.

Where it happens: SPRS and PIEE

SPRS doesn't calculate your score. You work it out with the DoD Assessment Methodology, then enter the summary score in SPRS, which you reach through the PIEE portal.

More detail: Where it happens: SPRS and PIEE
  1. Score it. Use the NIST 800-171 DoD Assessment Methodology (v1.2.1, PDF) (opens in a new tab), published on the DoD Defense Pricing and Contracting cyber page (opens in a new tab).
  2. Gather the details. Have your system security plan (SSP) name and date, your scope, your CAGE codes, and the date you expect to reach 110.
  3. Get access. Register in PIEE (opens in a new tab) and request the "SPRS Cyber Vendor User" role.
  4. Enter it. Post the summary score in SPRS (opens in a new tab). Only the total goes in, not the value for each requirement. SPRS explains the entry steps on its NIST 800-171 page (opens in a new tab).

Why companies ask for help

The arithmetic is simple. A score you can defend line by line, with an SSP that matches how you actually work, takes more care.

More detail: Why companies ask for help
  • The scoring is easy to misread. Requirements are weighted 5, 3 or 1 point. Only two, multifactor authentication and FIPS-validated encryption, can earn partial credit. Without a current SSP, the assessment can't be completed at all.
  • Plans of action have limits. Under the CMMC rule, a conditional status needs a score of at least 80 percent (88 of 110). Only 1-point items, plus encryption that isn't FIPS-validated, can sit on the plan, and they must be closed within 180 days.
  • Scope drives cost. Treating the whole company as in scope when CUI lives in a few places multiplies the work.
  • The SSP has to match reality. Assessors test what you do, not what the document says.
  • A senior official owns the risk. The person who affirms the score wants to know it holds up.
  • People move on. When the person who built the score leaves, the knowledge often goes with them.

Where we come in

We score you against the DoD methodology line by line, write or fix your SSP so it matches how you work, and close the gaps an assessor would test first. You end up with a score you can defend and a dated plan for the rest.

Talk to a Principal Engineer about your SPRS score

General information, not legal advice. CMMC rules and deadlines change, so check the official sources linked above before you act.

The Vizius Way

How it works: five steps, one Principal Engineer

One Principal Engineer leads it from the first call until your team has adopted the work and trusts it. Each step shows what it means for this engagement.

  1. Step 01

    Discovery Call

    30 minutes with the Principal Engineer who would lead this engagement. Free, and no sales handoff.

  2. Step 02

    Direct Assessment

    ScoreA scored gap assessment against all 110 requirements.

  3. Step 03

    Shared Roadmap

    ScopeMap how regulated data flows and decide enclave or whole company.

  4. Step 04

    PE-Led Delivery

    Document and fixSSP, POA&M and the controls that move your score the most.

  5. Step 05

    Outcome Assurance

    Mock assessmentAn assessor-style review before you affirm.

How we work, step by step

Proof

What changed for a client

A mock CMMC audit traced most failed objectives to one undocumented decision: where the regulated data lives.

Ready when you are

Thirty minutes with the Principal Engineer who would lead the work. Pick a time on the spot, or email us.

What you get

  • An SPRS score using the DoD Assessment Methodology, with the point value of every gap
  • Scoping: where FCI and CUI really live, and how much of the company must be in scope
  • System Security Plan, POA&M and policies written to match what you actually do
  • Remediation of the gaps an assessor would test, and a mock assessment when you are ready
Who you'll work with

A Principal Engineer, not a salesperson

Likely lead: Kyl Gaston or Cameron Cromer. You talk to the engineer who does the work on CMMC & NIST 800-171 Readiness.

Questions buyers ask

Is CMMC still happening?

CMMC Phase II third-party assessments were suspended on July 13, 2026 while a reform task force report is reviewed. NIST 800-171, DFARS 7012, SPRS scores and affirmations still apply, and a false affirmation carries False Claims Act exposure. We update this page when the rules change.

Do we need the whole company in scope?

Often not. Scoping where regulated data actually lives is usually the biggest cost lever. See CUI & ITAR Enclave Design and Build.

Level 1 or Level 2?

If you handle only Federal Contract Information, Level 1. If you handle CUI, Level 2. We confirm this from your contracts on the first call.

Does SPRS calculate our score?

No. You calculate it with the NIST 800-171 DoD Assessment Methodology, then enter the summary score in SPRS, which you reach through the PIEE portal.

Is a negative SPRS score a problem?

Scores run from 110 down to -203, and many companies start out negative. What matters is that the score is accurate and current and comes with a dated plan. An inflated score is the bigger risk.

More detail

CMMC Phase II third-party assessments are on hold while a task force report is reviewed, but NIST 800-171, your SPRS score and the affirmation a senior official signs still apply. We score you first so effort goes where the points are, then write the SSP and documentation and put the missing controls in place. Built for defense suppliers and their subcontractors.

Related offerings

Not sure this is the right fit?

Take the blind spot check. Four questions to start, then go deeper on one dimension.

Take the check
Glenn JohnsonDavid Hyde-VolpeMax DingesCameron Cromer

Speak directly to an engineer. We're based at 141 Traction Street, Greenville, SC.

Meet the team
REQUEST PRICING