Glossary / Security, Registration
Supplier Performance Risk SystemSPRS
SPRS is the Department of War's authoritative source for supplier and product performance information. For cybersecurity, it holds each contractor's NIST SP 800-171 assessment score, the date and the scope, entered by the contractor for a basic self-assessment or by the government for medium and high assessments, and now the CMMC assessment results. DFARS 252.204-7019 and 7020 require a current score in SPRS before a contract that involves covered defense information can be awarded; the CMMC clause adds the certification level required.
Why it matters to your pipeline
No current SPRS score, no DoW award where the clause applies. The score is also visible to the prime that wants to flow down CUI work, so it matters to subcontractors as much as to primes. Entering the score is a few minutes once the assessment is done; getting the assessment done honestly is the work. GovSmith's vCMs check a client's SPRS posture before it pursues defense work that carries the clause.
When this term shows up in an opening GovSmith finds for you, your vCM explains what it means for that pursuit and does whatever it calls for. You decide; we do the work.
Example
A machine shop pursuing a Navy parts order with technical data finds the solicitation carries DFARS 252.204-7020. It completes its 800-171 self-assessment, posts a score of 88 with a plan of action for the remaining items, and the contracting officer verifies it before award.
Find out what applies to you
Some terms will matter to your business right away and some won’t for years. A vCM can tell you which are which.