Your SPRS score is the number the DoD uses to gauge how close you are to meeting NIST SP 800-171. It's calculated on a weighted scale that starts at 110 and subtracts points for each control you haven't met. Posting it is a live requirement under DFARS 252.204-7019 - unaffected by the 2026 CMMC suspension.
Book a 15-minute review →How the math works: you begin at 110 (all controls met). Each unmet control subtracts its weight - 1, 3, or 5 points depending on its security impact. Because the 5-point controls are heavy, an environment missing several high-impact controls can land well below zero. A negative score isn't a bug; it's the model working as designed, and it's extremely common for organizations early in their journey.
The score goes into the Supplier Performance Risk System (SPRS), and under DFARS 252.204-7019 a current score conditions your eligibility for award. That's why the SPRS requirement survived the Phase 2 suspension: it's part of the self-assessment regime, not the third-party certification that paused.
Improving your score is about prioritization: the fastest gains come from closing the 5-point controls first, then the 3s. But an honest score matters more than a high one - posting an inflated number you can't support is a false-certification risk. The goal is an accurate score plus a credible POA&M showing how you'll raise it.
MDRwatchdog computes your SPRS score continuously from live control status, so it's always current and always defensible - and shows you exactly which gaps cost the most points. Readiness and evidence, not certification.
Because NIST 800-171 scoring starts at 110 and subtracts weighted points (1, 3, or 5) for each unmet control. Missing several high-impact controls easily produces a negative score - this is normal and correct, not an error.
Yes. SPRS posting under DFARS 252.204-7019 was unaffected by the CMMC Phase 2 suspension. A current self-assessment score remains a condition of award.
Close the highest-weighted (5-point) controls first, then the 3-point ones. But keep the score honest and back it with a POA&M - an inflated score you can't support is a false-certification risk.
MDRwatchdog provides security monitoring and compliance evidence to support readiness. It is not a certification and not legal advice. Certification and formal audits are performed by the appropriate authorized bodies (a C3PAO for CMMC, a licensed CPA firm for SOC 2, an accredited body for ISO 27001).