What Is SPRS, and When Do Contractors Use It?

Supplier and assessment information

The Supplier Performance Risk System supports defense acquisition with supplier-related information, including relevant cybersecurity assessment records. Its role is not the same as conducting an assessment or certifying a business.

Identify the task

1. 01Read the contract or solicitation's assessment and reporting conditions.
2. 02Determine which record, scope, and business identifiers are involved.
3. 03Use the appropriate PIEE and SPRS account roles.
4. 04Enter or review information using current official guidance.
5. 05Keep evidence supporting the record and required updates.

Scope matters

A score relates to an assessment and defined environment. It should not be treated as a blanket statement about every system or location. Review the relevant SSP, included CAGE codes, dates, and supporting information where required.

Avoid status confusion

A Basic self-assessment record is not automatically a third-party CMMC certification. Different contractual assessment requirements must be evaluated separately.

Assign an accountable owner, protect access, and keep representations accurate. Do not invent scores or use a reporting system to imply an assessment your company has not completed.