Topic · sprs

SPRS

Supplier Performance Risk System — DoD's contractor self-attestation portal for NIST SP 800-171 scores.

trade-press
Contractor SPRS Confidence Falls from 89% to 65% in One Year
More defense contractors are reporting SPRS scores than ever, but confidence in their accuracy has collapsed, undercutting the self-attestation model while CMMC phase two remains paused.
Per Inside Cybersecurity, CyberSheath's annual survey of 302 defense contractors found 88% now report a positive SPRS score, but only 65% are confident in their accuracy, down from 89% last year and 94% in 2024. Average annual cybersecurity spend hit $155,204, yet median self-assessed CMMC readiness sits at 70%. Just 1% of respondents say they're completely ready. CyberSheath, a managed security provider that sells CMMC compliance services, commissioned the survey conducted by Merrill Research.
AUG 25
trade-press
CMMC forces defense contractors to produce assessment evidence
The hard part was never writing the policy; it was proving the controls existed when award pressure arrived.
Federal News Network’s interview with CyberSheath CEO Emil Sayegh says Cybersecurity Maturity Model Certification pressure is now showing up through contracting officers, primes and Supplier Performance Risk System scores. Defense contractors and subcontractors handling controlled unclassified information are being pushed to move from plans to evidence. The useful warning is narrow: an assessor, or even a self-assessment, will not credit an Excel roadmap as implementation.
JUN 5

Contractor SPRS Confidence Falls from 89% to 65% in One Year