Register:Glossary3 recordsSHA3-256 chainedhead sha3:0f3d869a4c3473f08e854b0d4411c9a6a33c26230241109139ba3befd3c032c3Intact
REC 0001DEFINITIONsha3-256530a9ded7a796fc9710c39dacc28344572163307b3817ac072fc595afda29a04prev:544ce54b8a0f

SPRS stands for Supplier Performance Risk System.

The Supplier Performance Risk System (SPRS) is the government database contracting officers check to confirm a contractor's cybersecurity posture. A NIST 800-171 self-assessment score has been required in SPRS since DFARS 252.204-7019/7020 took effect in November 2020.

Under CMMC, SPRS also holds certification status and affirmations. The planned November 10, 2026 Phase II transition was suspended on July 13, 2026; Phase I self-assessment requirements remain in place during the reform review.

A SPRS score is a signed federal representation. The 2026 LOGZONE False Claims Act settlement — a self-reported 110 against a DIBCAC-assessed −170 — established that an inflated SPRS score can be treated as fraud, even without a breach.

REC 0002RELATED RECORDSsha3-2560f3d869a4c3473f08e854b0d4411c9a6a33c26230241109139ba3befd3c032c3prev:530a9ded7a79

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Related terms and reading

  1. NIST SP 800-171NIST SP 800-171 is the federal standard of 110 security controls for protecting CUI in non-federal systems: the technical basis of CMMC Level 2.
  2. POA&M: Plan of Action and MilestonesA POA&M is a tracked plan for remediating security controls that are not yet fully implemented, with owners and target dates.
  3. DFARS 252.204-7012DFARS 7012 is the long-standing clause requiring contractors to safeguard covered defense information per NIST 800-171 and report cyber incidents within 72 hours.
  4. The $507K LOGZONE Settlement: SPRS Score Liability

Know the term. Then see the record behind it.

Request AccessBook a call
Sealed
Last amended
Register colophonRecomputable by a second party
SeqLabelSHA3-256Prev
REC 0000HEAD544ce54b8a0fe2e50b3d548e
REC 0001DEFINITION530a9ded7a79544ce54b8a0f
REC 0002RELATED RECORDS0f3d869a4c34530a9ded7a79

The record headers on this page are SHA3-256 digests of this page's own copy, chained in sequence from a fixed genesis value. Edit one word of any record's copy above and every digest after it changes. Head of chain: sha3:0f3d869a4c34. The product does the same thing to your evidence.