XL EagleSPRS score (NIST SP 800-171 assessment score in SPRS)
SPRS score stands for NIST SP 800-171 assessment score in SPRS. The SPRS score is the number you get when you assess your systems against the 110 security requirements in NIST SP 800-171 using the DoD assessment method. A perfect score is 110, and points are subtracted for each requirement not met, so the score can go as low as -203.
Defense contracts that involve controlled unclassified information require a current assessment posted in SPRS, and CMMC requirements began phasing into DoD contracts in November 2025. A low score is not automatically disqualifying everywhere, but it must be honest, and you need a plan to fix gaps.
Why it matters to a small contractor
Never post a score you cannot back up. False cybersecurity claims have led to False Claims Act cases. If you only do work that never touches controlled information, ask the prime whether a score is actually required.
Example
A small machine shop runs the self-assessment, finds it lacks multifactor login and encrypted backups, scores itself honestly below 110, and posts a plan of action with target dates.
SPRS score: common questions
Why can the score be negative?
Some requirements are weighted at 3 or 5 points, so missing many of them can subtract more than 110 points total.
Is the SPRS score the same as CMMC?
No. The score comes from the NIST 800-171 assessment. CMMC is a certification program that uses those requirements and adds third-party or self-assessment levels, with status also recorded in SPRS.
Want the contract without the paperwork? Send XL Eagle your price on an open government job. We write and submit the bid under our registrations, free to you. Find open jobs →