How to Improve Your SPRS Score as a Small Manufacturer

How the Score Is Calculated

The DoD Assessment Methodology assigns each of the 110 requirements a weight of 1, 3 or 5 points based on how much it reduces risk. You start at 110 and subtract the weight of every requirement not fully implemented. A requirement counts as implemented only when all its parts are met, which is why partial implementations still cost points.

The methodology also requires a System Security Plan to exist, otherwise no score can be assessed. The result is posted with the date of assessment, the scope, and a date by which you expect to reach 110. A basic self-assessment is what most small manufacturers post, and primes and contracting officers can see it before awarding work.

Fix the Heavy Controls First

Because each 5-point requirement moves the score five times as much as a 1-point one, order your work by weight and by effort. Multi-factor authentication for network and privileged access is a classic heavy item and now straightforward on most identity platforms. Encryption of CUI in transit and at rest with FIPS-validated cryptography is another, and it often means checking whether your VPN, disk encryption and backup tools use validated modules.

Logging and audit review, an incident response plan, and limiting system access to authorized users and devices follow. Many shops recover dozens of points in a few weeks just by enabling identity controls they already own.

• Enable MFA on remote access, admin accounts and enclave logins
• Confirm FIPS-validated encryption for CUI at rest and in transit
• Centralize and retain audit logs, and schedule a review
• Write and test an incident response plan, including the 72-hour report
• Remove shared accounts on engineering and quality workstations

Where Small Shops Lose Points Without Realizing

Common point losses are unglamorous. CNC controllers and CMMs running old operating systems with shared logins, USB drives moving programs between machines, flat networks where the front office and shop floor share a segment, and vendor remote access that is never reviewed. Another is no physical-access log for the room where controlled drawings are viewed.

A third is the System Security Plan itself: a template copied from the internet that describes tools you do not own. Assessors and primes notice the mismatch. Score honestly, because an inflated score is a false statement, and fix the plan so every control statement names a real system, owner and artifact.

Keeping the Score Honest and Current

Treat SPRS as a living record. Update the score when you materially fix or break a control, and re-affirm annually in line with your contract requirements. Keep a POA&M with owner, date and budget for each remaining item, because contracting officers can ask how you plan to close the gap.

Under CMMC, the posted self-score is replaced for many contracts by a formal assessment, but the same controls decide the outcome, so SPRS work is not wasted. A score of 110 is not required by every program today, yet a credible, documented path to it separates serious suppliers from paperwork-only ones.

When Chasing Points Is the Wrong Goal

A score is a means, not the product. If you chase points by buying tools without scoping, you can raise the score and still leave CUI scattered across five systems. A better first move is to shrink where controlled data lives, then implement controls on that smaller boundary.

The cost to reach high scores drops substantially. And if CUI work is a small share of revenue, consider whether partnering with a prime or a managed enclave provider beats building everything in-house. Use a point-by-point worksheet to prioritize, and revisit it quarterly.