# Prime Contractors Verify Supplier SPRS Assessments

A procurement community discussion clarifies that prime contractors generally cannot directly query a subcontractor’s Supplier Performance Risk System (SPRS) score and instead need to request evidence from the supplier, such as a screenshot, PDF, or attestation. The discussion distinguishes DFARS 252.204-7020 basic assessments from CMMC entries in SPRS: commenters state that basic assessments do not carry the initial and annual affirmation requirements applicable to the cited CMMC entries. For procurement teams, this makes documented supplier verification important to assessing cybersecurity and information-handling risk across the supply chain.

- Establish a recurring, documented process for requesting and checking suppliers’ assessment evidence, including the assessment date, score, CAGE code, and scope.
- Do not treat a DFARS 252.204-7020 basic assessment as subject to the initial or annual affirmation requirements discussed for CMMC entries; distinguish the assessment type when reviewing supplier records.
- DOE-focused practitioners may also need to verify the supplier’s stated CUI boundary, export-control capabilities, system details, and related data-handling risks before sharing sensitive information.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 12, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- U.S. Department of Energy (DOE)

### Key Quotes
> To be very precise, there is no annual attestation for SPRS. There are initial and annual attestations required for CMMC entries in SPRS: CMMC L1, L2 (Self), and L2 (C3PAO). In the context of OP's question, DFARS 7020 basic self assessments, there are no initial or annual affirmation requirements.
> — Community commenter

> It's not enough to know that they have an environment (or claim that.) We need some evidence and we need to know what they say is in the CUI boundary so we don't send CUI somewhere we shouldn't.
> — Community commenter (DOE practitioner)

### Sources
- [Can primes see a suppliers SPRS score, or do you have to ask directly](https://www.reddit.com/r/CMMC/comments/1x4ew41/can_primes_see_a_suppliers_sprs_score_or_do_you) - reddit-cmmc