Your SPRS score is a sworn statement

Key takeaways

• Your SPRS score starts at 110, can fall to -203, and a senior official affirms it every year.
• Three settlements show what happens when the score and reality do not match.
• AIC CMMC Complete™ checks controls continuously, so the score stays true.

Every defense contractor that handles Controlled Unclassified Information (CUI) posts a NIST SP 800-171 self-assessment score in the Supplier Performance Risk System (SPRS). Many treat it like a form to fill out. It is closer to a sworn statement, and the government treats it that way.

How the score works

• The score starts at 110, one point for each of the 110 requirements in NIST SP 800-171.
• For each requirement you have not met, you subtract 1, 3, or 5 points, depending on how important it is.
• The lowest possible score is -203.
• A senior official affirms that the organization meets and keeps meeting the requirements, and the affirmation is renewed every year.

A partly met requirement is not met. Rounding up is how scores drift away from reality.

When the score and reality do not match

These are Department of Justice settlements under the False Claims Act. Each resolves allegations.

• LOGZONE (June 2026, $507,144). The company posted a perfect 110. A government assessment found -170.
• MORSECORP (March 2025, $4.6 million). The company admitted it posted a score of 104. In July 2022 its own consultant told it the real score was -142. It did not update the score until June 2023, after a subpoena.
• Georgia Tech Research Corporation (September 2025, $875,000). The government alleged a score of 98 was false because it was based on a "fictitious" environment that did not apply to any real system handling covered defense information.

The lesson from all three is the same. The score must describe a real system, as it actually is, today.

Six habits that keep the score true

1. Score the real system. Name the systems that handle CUI. Score those, not a model of what you plan to build.
2. Score each requirement accurately. If it is partly done, it is not met.
3. Keep proof for every point you claim. If you cannot show it, do not count it.
4. Re-score when things change. New systems, new vendors, and staff changes can move the score.
5. Fix the score, not just the problem. When you learn the score is wrong, update it. MORSECORP's trouble grew from the year it waited.
6. Affirm only what you can show. The senior official signing the affirmation should see the evidence first.

How the AIC CMMC Complete™ kit keeps the score true

Analog Informatics Corporation (AIC) builds the AIC CMMC Complete™ kits for Level 1, Level 2, and Level 3.

• Current State Compliance checks controls against the selected framework and level, and rescans so you see what changed.
• Control coverage shows which requirements have live evidence and which do not, so you know which points you can support.
• Control state history records drift over time, so you learn about a slipping requirement before your score is out of date.
• The Assessment Binder holds the evidence behind each requirement, for the senior official before signing, and for the assessor later.

An assessment organization, and in some cases the government, decides whether an organization meets CMMC. The kit gives you the tools and the records to do the work and to show it.

Learn more

• CMMC Level 2
• Continuous compliance
• Product screenshots
• Read next: Why CMMC was paused, and what actually fixes it

Sources

• Department of Justice, LOGZONE settlement, June 18, 2026
• Department of Justice, MORSECORP settlement, March 26, 2025
• Department of Justice, Georgia Tech Research Corporation settlement, September 30, 2025
• 32 CFR Part 170, CMMC Program (scoring and affirmations)
• NIST, SP 800-171 Rev. 2

This post is general information, not legal advice.