The SPRS score math that actually matters
Most contractors post an SPRS score without being able to reconstruct it. That is a problem, because the number is an assertion under the False Claims Act, and a DoD assessor can ask you to walk the arithmetic line by line.
Start at 110 and subtract
The score is not a percentage. You begin at 110 — one point per NIST SP 800-171 requirement — and subtract the assigned weight of every requirement you have not fully implemented. Weights are 1, 3, or 5 depending on how much risk the gap introduces.
That means a floor well below zero is possible. A contractor with most access-control and audit requirements unmet can legitimately post a negative score, and negative scores are common on first honest assessments.
Partial credit is narrower than people assume
A handful of requirements permit partial credit, where you subtract half the weight rounded up rather than the full value. Multifactor authentication and FIPS-validated cryptography are the well-known cases.
Everything else is binary. If the requirement is not fully met across every in-scope asset, you take the full deduction. Scoring a control as partial because it is 'mostly done' is the single most common way a self-assessment becomes inaccurate.
The requirements you cannot POA&M
Some requirements must be fully implemented before a conditional certification is possible — they cannot sit on a Plan of Action and Milestones. Treat these as gating work, not backlog.
- Multifactor authentication for privileged and network access
- FIPS-validated cryptography protecting CUI at rest and in transit
- Incident reporting capability with a working 72-hour path to DIBNet
- System security plan that actually describes the assessed boundary
What to keep as evidence
For each scored requirement, keep the artifact that proves the answer, the date it was captured, and the asset scope it covers. A score you can defend is a score with a dated artifact behind every deduction you did not take.