Scoring & Assessment

Your Score. In Real Time.

DFARS 252.204-7019 requires a current NIST SP 800-171 self-assessment score in SPRS before contract award. The SPRS Score module calculates that score live from your assessment in the Requirements Browser, on the official −203 to 110 scale, and the Score Analysis report breaks it down domain by domain so you can see exactly what is costing points and fix the highest-weight gaps first.

Request a Demo ← All modules
−203 to 110 Official DoD scoring scale
5 / 3 / 1 Point weight per requirement
Real time Recalculated as you assess
Capability

A Score That Tracks Your Actual Assessment

The SPRS score is calculated under the NIST SP 800-171 DoD Assessment Methodology: you start at 110 (every requirement implemented) and subtract the assigned weight for each requirement that is not met — 5 points for the highest-impact controls, 3 points for moderate, and 1 point for the rest. The score can fall as low as −203. The 1TEN SPRS Score module derives your score directly from the implementation status you record in the Requirements Browser, so the number reflects the state of your program right now rather than a spreadsheet someone updated last quarter.

Because the score is computed from live data, it moves as you work. Mark a requirement implemented and the score updates. Open a finding and you see the point cost immediately. There is no separate scoring exercise to run and no risk of your submitted SPRS figure drifting out of step with your real posture.

Dashboard Requirements Evidence POA&M Reports
1TEN SPRS Score Analysis report showing the score on the −203 to 110 scale broken down domain by domain
Capability

Domain-by-Domain Score Analysis

A single number tells you where you stand but not what to do about it. The Score Analysis report decomposes your score across all 14 domains, showing the points lost in each, the specific requirements driving the loss, and the point weight attached to each open item. A 5-point gap in Access Control and a 1-point gap in Maintenance are not equal, and the report makes that difference obvious so remediation effort goes where it moves the score most.

The analysis also distinguishes items that are eligible for a POA&M from those that are not. Certain requirements cannot be deferred and must be implemented before assessment; the report flags them so they are not mistaken for things you can address later. Open items flow straight into the POA&M Tracker with their point values attached.

Inside the Module

What You See Inside

Live score
Current SPRS score on the −203 to 110 scale, recalculated from your live assessment data.
Point-weight breakdown
Every open requirement shown with its 5, 3, or 1-point deduction so impact is unambiguous.
Per-domain analysis
Points lost in each of the 14 domains, with the requirements driving the loss.
Non-POA&M flags
Requirements that must be implemented before assessment are marked so they are not deferred by mistake.
Remediation priority
Open items ranked by point impact, so the next fix is the one that moves the score most.
Submission-ready export
Score and assessment date packaged for entry into SPRS to satisfy DFARS 252.204-7019.
The problem this solves

Most contractors calculate their SPRS score once, in a spreadsheet, submit it, and never touch it again — even as their environment and their compliance posture change underneath it. When a prime or the DoD looks at that number, it needs to match what an assessor would find. A live score tied to your actual assessment removes the gap between the figure on file and the state of your program, and turns a once-a-year guess into a working instrument you use to prioritize remediation every week.

Reference

How the Score Is Calculated

Start at 110
A fully implemented program — all 110 requirements met — scores the maximum of 110.
Subtract 5 points
For each unimplemented requirement carrying the highest weight under the DoD methodology.
Subtract 3 or 1 point
For moderate- and lower-weight requirements that are not yet implemented.
Partial credit rules
Specific requirements (such as MFA and FIPS-validated encryption) follow the methodology's partial-credit conditions.
Floor at −203
The score cannot fall below −203, the value when no requirements are met.
Assessment date
Every score is stamped with the date of assessment, as SPRS submission requires.
Practices & Regulations

What This Module Supports

ReferenceDescription
CA.L2-3.12.1 Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
CA.L2-3.12.3 Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements — a current self-assessment score must be posted in SPRS to be eligible for award.
DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements — scoring follows the DoD Assessment Methodology this module implements.
Connected Modules

Related Modules

Assessment
Requirements Browser
Your implementation status across all 110 requirements is the source data the SPRS score is calculated from.
Remediation
POA&M Tracker
Open items from the score analysis flow into the POA&M with their point values attached.
Assessment
Assessment Summary
A program-level view of readiness that pairs with the score to show overall posture.
Documentation
System Security Plan
The SSP and the SPRS score are the two artifacts the DoD methodology expects to see together.

All 110. Tracked.

1TEN is an air-gapped, on-premises GRC platform engineered for defense contractors handling CUI.

Request a Demo