DFARS 7019 Checklist: NIST SP 800-171 Assessment and SPRS Score Submission
DFARS 252.204-7019 tells a bidder that a current NIST SP 800-171 assessment must be in SPRS before award, and 252.204-7020 sets out how that assessment is done and passed down to subcontractors. This checklist walks you through scoping, the SSP and POA&M, the Basic Assessment, the SPRS entry and flowdown, in the order a contracting officer will look at them.
0 of 36 items complete
17 critical items still open - these are the highest-risk gaps.
1. Scope: do 7019 and 7020 apply to you
2. System Security Plan and plan of action
3. Basic Assessment (self-assessment)
4. Posting the summary score in SPRS
5. Subcontractor flowdown (7020)
6. Medium and High assessments, and CMMC
Tick each item as you finish it. Items marked critical are the ones that most often block an award or cause a contracting officer to reject an offer. Keep evidence for every tick in your compliance folder.
Private AI inside your CUI boundary
A short review of how an on-prem AI layer over your ERP could sit inside your SSP boundary. Optional, and the checklist works without it.
Optional. The tool and every export work without this. No spam.
How to use this checklist
Start with scope, because every later step depends on knowing which systems handle covered information. Work through the groups in order and tick items as you collect evidence, not when you intend to. Export the list to PDF or Excel and add owner and date columns for your own tracking. Items marked critical are the ones that most often cause an offer to be rejected, such as a missing SSP, an expired assessment or a missing completion date for the plan of action. Review the list again whenever the system boundary changes, for example after a cloud migration, because the score only means something for the scope it was measured against.
- Do scoping first, then SSP, then scoring, then SPRS entry
- Keep evidence for every tick, since a Medium or High assessment will ask for it
- Export and assign owners so open items do not stall
What 7019 and 7020 actually require
Under 252.204-7019, the offeror must have a current assessment, not older than three years, posted in SPRS for each covered system relevant to the offer. Under 252.204-7020, the contractor must provide DoD with access to facilities and personnel if a Medium or High assessment is performed, and must flow the clause to subcontractors. A Basic Assessment is your own review using the DoD Assessment Methodology. A Medium assessment is a DoD review of your documentation and a High assessment includes an on-site verification. The summary posted in SPRS includes the score, the SSP identifier, the CAGE codes covered, the assessment date and the date by which all requirements will be met.
Scoring and the SPRS number
The Basic Assessment starts at 110, one point for each NIST SP 800-171 requirement, and subtracts a weighted value of 1, 3 or 5 for each requirement not implemented. This means a score can fall below zero. Requirements that protect the whole environment, such as multi-factor authentication for network access and encryption of CUI in transit and at rest, carry the heaviest weights. Be honest: an inflated score is a False Claims Act risk, and a documented low score with a credible POA&M is safer than a perfect score you cannot defend. If you want to see how fast a score could recover as you close items, use the SPRS score recovery timeline calculator and the NIST 800-171 SPRS score calculator on this site.
Common mistakes
The most frequent problems are scoring partial controls as met, posting a score for the wrong CAGE code, letting the three-year assessment lapse, and forgetting that the clause must flow down. Another is treating the SSP as a one-time document: it must match the real environment, including cloud services, managed service providers and personal devices. Finally, many shops forget that CMMC now sits on top of this work, so the SSP and evidence you build here should be organised in a way that a CMMC assessor can also use.
- Scoring partially implemented controls as fully met
- Posting the score against the wrong CAGE codes or scope
- Not updating SPRS after POA&M items close
- No process to verify subcontractor SPRS status before award
Frequently Asked Questions
What is the difference between DFARS 252.204-7019 and 7020?
Clause 7019 is the notice: it tells offerors that a current NIST SP 800-171 assessment must be posted in SPRS to be considered for award. Clause 7020 sets the assessment requirements, DoD access for Medium and High assessments, and the obligation to flow the clause down to subcontractors.
How old can my SPRS assessment be?
The assessment must be current, which the clauses define as not more than three years old. Many companies update sooner, whenever the score changes materially or the system boundary changes, so the number posted reflects the real state.
Can my SPRS score be negative?
Yes. The score starts at 110 and subtracts 1, 3 or 5 points per unimplemented requirement, so a company with many gaps can post a negative number. A low score is not an automatic bar to award, but it must be paired with a credible plan of action and completion date.
Does this replace CMMC?
No. The SPRS Basic Assessment is a self-assessment, while CMMC adds a defined certification program with third-party or government assessments for many contracts. The SSP, evidence and POA&M you build for 7019 and 7020 are the foundation for CMMC readiness, but check your contract for which clauses apply.
If your CUI lives in an ERP and shop-floor systems, Netray can add a private AI layer that runs inside your own environment, so engineers can ask questions of that data without it leaving your boundary. We can talk through how that fits your SSP.
Related Tools
NIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Compliance & ContractsSPRS Score Recovery Timeline Calculator
Enter your open 5, 3 and 1 point gaps and your monthly closure rate. See your score by month, months to reach 88 and the score at the 180 day POA&M window.
Compliance & ContractsNIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
Aerospace & DefenseNIST 800-171 POA&M Worksheet
An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
Aerospace & DefenseDFARS Flowdown Subcontractor Risk Tracker
An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.
More Compliance & Contracts tools
See all- Export Compliance Program ROI Calculator
- Plan of Action and Milestones (POA&M) Template
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
Keep exploring
Free tools
- NIST 800-171 SPRS Score CalculatorCalculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
- DFARS and FAR Cyber and Supply Chain Clause ReferenceA lookup of the DFARS and FAR clauses that appear on defense purchase orders, what each covers and what a supplier has to do about it.
- DFARS 252.204-7012 Compliance Self-AssessmentA 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
Guides
- DFARS 252.204-7012 for Machine ShopsDFARS 252.204-7012 explained for machine shops: NIST 800-171 safeguarding, 72-hour cyber incident reporting, flow-downs to your vendors, and where to start.
- How to Improve Your SPRS Score as a Small ManufacturerHow to calculate and improve your SPRS score as a small manufacturer: the NIST 800-171 scoring method, high-value controls to fix first, and common mistakes.
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
AI on your ERP
- Mapping DFARS 7012 and NIST 800-171 Controls to AI on Your ERPMap DFARS 252.204-7012 and NIST SP 800-171 control families to an AI system layered on your ERP, with evidence a Compliance Manager can defend.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.
Manufacturing hubs
- Aerospace and Defense Subcontractors on Long Island, New YorkLong Island aerospace and defense subcontractors: machining, fabrication and electronics shops, anchors, AS9100, ITAR and CMMC needs, and ERP and quoting problems.
- Aerospace and defense manufacturing in Dayton and CincinnatiAerospace, defense and jet engine manufacturing in Dayton and Cincinnati: AFRL, GE Aerospace supply chain, AS9100, ITAR, CMMC and private AI on ERP data.