Is a negative SPRS score valid?

Yes. Deductions across all 110 requirements can total 313 points, so the methodology bottoms out at -203, and a negative score is a valid result, not an error. Contractors early in implementation often start negative. Remediating 5-point requirements first recovers score fastest.

How do I submit my SPRS score to the DoD?

Log in to the PIEE portal at wawf.eb.mil and request the SPRS Cyber Vendor role if you do not already have it. Enter your score, assessment date, System Security Plan scope, and POA&M completion date. Contracting officers can see the posted score within about 24 hours.

Which practices allow partial credit on the SPRS score?

Only two. Multi-factor authentication (3.5.3) deducts 3 points instead of 5 when MFA covers remote and privileged users but not the general user population. FIPS-validated cryptography (3.13.11) deducts 3 instead of 5 when encryption is used but not FIPS validated. Every other requirement is scored all or nothing.

Does a missing System Security Plan reduce my SPRS score?

Not directly: the SSP requirement (3.12.4) carries no point value in the methodology. The consequence is more severe. Without a current System Security Plan an assessment cannot be conducted at all, so the SSP is a prerequisite for having a defensible score, not a line item within it.

Do the 1, 3, and 5 point values mean some practices matter less?

The weights rank potential impact, not importance. Five-point requirements, such as MFA and an incident response capability, could enable significant exploitation or exfiltration of CUI if missing. One-point requirements have a limited or indirect effect on their own. All 110 must eventually be implemented; the weights shape remediation priority.

SPRS Score Calculation Guide: DoD Methodology

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}SPRS Score Calculation Guide: DoD MethodologyCalculate your SPRS score step by step. Learn how the DoD Assessment Methodology works, what practice point values mean, and how to submit your score.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.