# DFARS 7019 Checklist: NIST SP 800-171 Assessment and SPRS Score Submission > Source: https://netray.co/tools/dfars-252-204-7019-7020-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Step-by-step checklist for DFARS 252.204-7019 and 7020: run the NIST SP 800-171 Basic Assessment, post your score in SPRS, and pass the requirement down your supply chain. ## Category compliance-legal ## Industry Defense ## Region United States ## Audience - Defense subcontractor - Compliance manager - Contracts manager - IT security lead ## Tool **Kind:** checklist **Scoring Note:** Tick each item as you finish it. Items marked critical are the ones that most often block an award or cause a contracting officer to reject an offer. Keep evidence for every tick in your compliance folder. **Groups:** #### 1. Scope: do 7019 and 7020 apply to you **Items:** **Text:** Confirmed whether the solicitation or contract includes 252.204-7019 (notice) and 252.204-7020 (requirements) **Critical:** true Identified every contract that involves Controlled Unclassified Information (CUI) or covered defense information **Text:** Listed the covered contractor information systems that process, store or transmit that information **Critical:** true **Text:** Documented system boundaries: users, devices, enclaves, cloud services and connected external providers **Critical:** true Confirmed with the contracting officer whether commercially available off-the-shelf (COTS) exceptions could apply, and recorded the answer **Text:** Recorded the CAGE codes for each business unit or location the assessment covers **Critical:** true #### 2. System Security Plan and plan of action **Items:** **Text:** System Security Plan (SSP) exists, is current, and describes how each of the 110 NIST SP 800-171 requirements is met **Critical:** true **Text:** SSP name, version and date are recorded so they can be quoted in the SPRS entry **Critical:** true **Text:** Plan of Action and Milestones (POA&M) exists for every requirement not yet fully implemented **Critical:** true POA&M items have an owner, a target date and the resources needed A projected completion date for all outstanding requirements has been set SSP and POA&M have been reviewed and approved by a senior official who can attest to them #### 3. Basic Assessment (self-assessment) **Items:** **Text:** Assessment follows the NIST SP 800-171 DoD Assessment Methodology, not an informal gap review **Critical:** true **Text:** Each of the 110 requirements has been scored as implemented or not implemented, with evidence on file **Critical:** true **Text:** Starting score of 110 reduced by the methodology's weighted value (1, 3 or 5 points) for every requirement not implemented **Critical:** true Partial implementation was not counted as implemented unless the methodology allows it for that requirement Multi-factor authentication, FIPS-validated cryptography and incident response items were checked carefully, as they carry high point values A second person independently reviewed the scoring and evidence Assessment date, scope and assessor name are recorded #### 4. Posting the summary score in SPRS **Items:** **Text:** Registered in the Procurement Integrated Enterprise Environment (PIEE) and obtained SPRS access with the right role **Critical:** true **Text:** Entered the summary score (which can be negative), the assessment date and the scope covered **Critical:** true **Text:** Entered the SSP name or identifier and the CAGE codes covered by the plan **Critical:** true **Text:** Entered the date by which all requirements will be implemented (POA&M completion date) **Critical:** true Saved a screenshot or confirmation of the posted record for the proposal file Confirmed that the assessment is no more than three years old for any offer you submit Set a calendar reminder to update the score when POA&M items close or the system changes #### 5. Subcontractor flowdown (7020) **Items:** **Text:** 252.204-7020 is included in every subcontract and purchase order where CUI is involved, not just the first tier **Critical:** true **Text:** Checked that each subcontractor has a current assessment in SPRS before awarding them work that involves covered information **Critical:** true Kept a register of subcontractor CAGE codes, scores and assessment dates Defined a process to re-check subcontractor status at renewal and at option exercise Stated in purchase orders that subs must flow the clause down to their own lower tiers #### 6. Medium and High assessments, and CMMC **Items:** **Text:** Designated a point of contact to coordinate if DoD notifies you of a Medium or High assessment **Critical:** true Documents, interviews and demonstrations needed by assessors are organised and can be shown within days Allowed DoD access to facilities, systems and personnel as the clause requires when an assessment is scheduled Checked whether your contracts now carry CMMC requirements under DFARS 252.204-7021 and the CMMC program rule, and planned the level of certification needed Aligned the SPRS score, SSP and any CMMC readiness work so they tell the same story ## Content **Intro:** DFARS 252.204-7019 tells a bidder that a current NIST SP 800-171 assessment must be in SPRS before award, and 252.204-7020 sets out how that assessment is done and passed down to subcontractors. This checklist walks you through scoping, the SSP and POA&M, the Basic Assessment, the SPRS entry and flowdown, in the order a contracting officer will look at them. **Sections:** #### How to use this checklist **Body:** Start with scope, because every later step depends on knowing which systems handle covered information. Work through the groups in order and tick items as you collect evidence, not when you intend to. Export the list to PDF or Excel and add owner and date columns for your own tracking. Items marked critical are the ones that most often cause an offer to be rejected, such as a missing SSP, an expired assessment or a missing completion date for the plan of action. Review the list again whenever the system boundary changes, for example after a cloud migration, because the score only means something for the scope it was measured against. **Bullets:** - Do scoping first, then SSP, then scoring, then SPRS entry - Keep evidence for every tick, since a Medium or High assessment will ask for it - Export and assign owners so open items do not stall #### What 7019 and 7020 actually require **Body:** Under 252.204-7019, the offeror must have a current assessment, not older than three years, posted in SPRS for each covered system relevant to the offer. Under 252.204-7020, the contractor must provide DoD with access to facilities and personnel if a Medium or High assessment is performed, and must flow the clause to subcontractors. A Basic Assessment is your own review using the DoD Assessment Methodology. A Medium assessment is a DoD review of your documentation and a High assessment includes an on-site verification. The summary posted in SPRS includes the score, the SSP identifier, the CAGE codes covered, the assessment date and the date by which all requirements will be met. #### Scoring and the SPRS number **Body:** The Basic Assessment starts at 110, one point for each NIST SP 800-171 requirement, and subtracts a weighted value of 1, 3 or 5 for each requirement not implemented. This means a score can fall below zero. Requirements that protect the whole environment, such as multi-factor authentication for network access and encryption of CUI in transit and at rest, carry the heaviest weights. Be honest: an inflated score is a False Claims Act risk, and a documented low score with a credible POA&M is safer than a perfect score you cannot defend. If you want to see how fast a score could recover as you close items, use the SPRS score recovery timeline calculator and the NIST 800-171 SPRS score calculator on this site. #### Common mistakes **Body:** The most frequent problems are scoring partial controls as met, posting a score for the wrong CAGE code, letting the three-year assessment lapse, and forgetting that the clause must flow down. Another is treating the SSP as a one-time document: it must match the real environment, including cloud services, managed service providers and personal devices. Finally, many shops forget that CMMC now sits on top of this work, so the SSP and evidence you build here should be organised in a way that a CMMC assessor can also use. **Bullets:** - Scoring partially implemented controls as fully met - Posting the score against the wrong CAGE codes or scope - Not updating SPRS after POA&M items close - No process to verify subcontractor SPRS status before award **Cta:** If your CUI lives in an ERP and shop-floor systems, Netray can add a private AI layer that runs inside your own environment, so engineers can ask questions of that data without it leaving your boundary. We can talk through how that fits your SSP. **Faq:** #### What is the difference between DFARS 252.204-7019 and 7020? **Answer:** Clause 7019 is the notice: it tells offerors that a current NIST SP 800-171 assessment must be posted in SPRS to be considered for award. Clause 7020 sets the assessment requirements, DoD access for Medium and High assessments, and the obligation to flow the clause down to subcontractors. #### How old can my SPRS assessment be? **Answer:** The assessment must be current, which the clauses define as not more than three years old. Many companies update sooner, whenever the score changes materially or the system boundary changes, so the number posted reflects the real state. #### Can my SPRS score be negative? **Answer:** Yes. The score starts at 110 and subtracts 1, 3 or 5 points per unimplemented requirement, so a company with many gaps can post a negative number. A low score is not an automatic bar to award, but it must be paired with a credible plan of action and completion date. #### Does this replace CMMC? **Answer:** No. The SPRS Basic Assessment is a self-assessment, while CMMC adds a defined certification program with third-party or government assessments for many contracts. The SSP, evidence and POA&M you build for 7019 and 7020 are the foundation for CMMC readiness, but check your contract for which clauses apply. ## Search terms dfars 7019 checklist, dfars 252.204-7019 checklist, dfars 252.204-7020 requirements, sprs score submission checklist, nist 800-171 basic assessment checklist, sprs submission steps, dfars 7019 7020 compliance, nist 800-171 self assessment checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json