# Defense Contractors Correct SPRS Scores

A discussion among defense contractors and other community participants recommends correcting an overstated Supplier Performance Risk System (SPRS) score before a formal C3PAO assessment, particularly when a mock assessment identifies discrepancies. Participants also advise confirming that the assessment boundary is accurate, documenting any correction, and prioritizing findings by point value. Comments differ on score thresholds: they discuss both 110 points and a possible conditional path at 88 or higher when remaining items are eligible for a POA&M and closed within 180 days; these figures are presented as commenters’ interpretations, not confirmed agency guidance.

- Contractors preparing for a C3PAO assessment can use mock-assessment findings to correct score inaccuracies and document the basis for changes before formal review.
- Confirming the assessment boundary may affect the score: one commenter notes that systems not handling CUI may be removable from the boundary if that is accurately documented in the SSP.
- Procurement teams and contractors should distinguish community advice from authoritative requirements, especially when evaluating the disputed score thresholds and POA&M pathway.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 10, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

### Key Quotes
> If those systems don't actually need to store, process or transmit CUI, moving them out of the assessment boundary and documenting that in the SSP is often faster.
> — Community commenter (username not provided)

### Sources
- [How do I fix an overstated SPRS score?](https://www.reddit.com/r/CMMC/comments/1xsgfhh/how_do_i_fix_an_overstated_sprs_score) - reddit-cmmc