SPRS Score Fraud: False NIST 800-171 Scores in Supplier Risk Reporting

What SPRS is and why the score matters

The Supplier Performance Risk System is a DoD system used to collect and display contractor risk information, including cybersecurity assessment scores tied to NIST SP 800-171. DFARS 252.204-7019 and 252.204-7020 require covered contractors to conduct or obtain a NIST SP 800-171 assessment and to ensure summary level scores are posted in SPRS as required for DoD solicitations and contracts.

Contracting officers and primes use SPRS data when evaluating supply chain cyber risk. A posted score is not a private compliance diary. It is a representation available to the government in connection with covered awards. When the score is knowingly inflated, every proposal, award, or invoice that depends on that representation can become part of a False Claims Act theory.

How false SPRS scores are created

False scores rarely begin with someone inventing a number in isolation. They usually follow a rushed assessment, a copied System Security Plan, or pressure to clear a solicitation gate.

• Marking unimplemented NIST SP 800-171 controls as implemented to raise the basic assessment score
• Posting a score based on a future remediation plan rather than current status
• Using an assessment boundary that excludes systems that actually handle covered defense information
• Reusing another business unit score without assessing the environment that will perform the work
• Leaving a stale high score in SPRS after controls degrade or after a more accurate assessment is completed
• Instructing staff to change answers so the company clears a prime or DoD threshold

Evidence that tends to prove knowledge

SPRS cases turn on knowledge. Helpful evidence includes dated assessment worksheets, scoring spreadsheets, SSP and POA&M versions, screenshots or exports of what was posted to SPRS, and emails directing a higher score than the assessment supported.

People who filled out the assessment, who were told to change control status from not implemented to implemented, or who compared the SPRS entry to a later internal audit are often the first to see the mismatch. Primes that required a score from a subcontractor and then learned the sub never assessed the performing environment may also have relevant knowledge.

Relationship to DFARS 7012, CMMC and CCFI

SPRS scoring is part of the same DFARS cybersecurity stack as 252.204-7012 safeguarding and NIST SP 800-171 implementation. CMMC assessments may later examine the same environment the SPRS score claimed to describe. The Civil Cyber-Fraud Initiative treats knowing cybersecurity misrepresentation as a False Claims Act priority.

A single fact pattern can therefore support related theories: false SPRS reporting, unmet 800-171 controls, false CMMC scoping, and broader Civil Cyber-Fraud Initiative claims. Related pages on this site cover each of those angles without repeating the same narrative.

Practical next steps

Do not alter SPRS entries yourself to fix a problem you did not create. Preserve what you have. Avoid removing evidence. Speak with counsel before sending government data to personal accounts. Our cybersecurity guide and IT security professional page explain filing mechanics and clearance aware disclosure.