Is your SPRS score current? CMMC self-assessment and the annual affirmation

If your firm does design or engineering work on defense projects and handles CUI, a prime will check your SPRS score before adding you to its team. That score has an expiration date, and the CMMC self-assessment adds a yearly signature on top of it. Here is how to tell whether yours is still current before year-end.

What makes an SPRS score "current"?

A NIST SP 800-171 score is current for DoD purposes when it is not more than three years old, unless a solicitation sets a shorter window. That limit is written into DFARS 252.204-7019, which says an offeror required to implement NIST SP 800-171 "shall have a current assessment" for each covered system to be considered for award.

The same three-year test appears in DFARS 252.204-7020, which bars a prime from awarding a subcontract that requires NIST SP 800-171 unless the subcontractor has completed at least a Basic Assessment within the last three years. For an architecture or engineering firm working as a sub on a defense project, that means a stale score can cost you a seat on a team even when the prime already holds its own.

What SPRS stores is narrow: the summary score (for example, 95 out of 110), the date the assessment was completed, the CAGE codes covered by each system security plan, and the date by which the firm expects to reach 110. The date is what a contracting officer or a prime looks at first. A score from late 2023 is close to expiring right now.

How often is a CMMC self-assessment required?

Every year for Level 1 and every three years for Level 2, with a signed affirmation in SPRS every year at both levels. That CMMC cycle under 32 CFR part 170 runs alongside the DFARS three-year ceiling above, and CMMC Phase 1 has applied to new DoD solicitations since November 10, 2025.

• Level 1 (Self): under 32 CFR 170.15, the self-assessment is repeated annually, with results and an affirmation entered in SPRS.
• Level 2 (Self): under 32 CFR 170.16, the firm conducts a self-assessment every three years, submits the results in SPRS, and affirms compliance at the time of each assessment and annually thereafter.
• Conditional Level 2 (Self): if the assessment left items on a plan of action and milestones, the firm must close them, perform a POA&M closeout self-assessment, and post the result within 180 days of the CMMC Status Date. If it does not, the conditional status expires.

So a firm handling controlled unclassified information (CUI) can have a three-year-old assessment that is still current under DFARS, while its CMMC affirmation lapsed months ago. The annual affirmation is the step most often missed.

What does the annual affirmation actually attest to?

It attests that the firm "has implemented and will maintain implementation of" all applicable CMMC security requirements for the systems in scope. 32 CFR 170.22 requires the affirmation to come from a senior level representative of the company who is responsible for its CMMC compliance, with that person's name, title and contact information entered in SPRS.

The affirmation is due when a conditional status is reached, when a final status is reached, annually after the final CMMC Status Date, and after any POA&M closeout. It speaks to the present tense. A managing principal who signs it in December 2026 is representing that the controls work in December 2026, regardless of when the underlying assessment was scored.

That matters because the Department of Justice's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices. A signed annual affirmation is a dated, attributable statement of exactly that kind.

Does the CMMC Phase 2 suspension change any of this?

No. The Department of War suspended CMMC Phase 2 on July 13, 2026, which paused third-party (C3PAO) certification as a condition of award. Phase 1 self-assessments, SPRS scores, annual affirmations, and the safeguarding and 72-hour incident reporting duties in DFARS 252.204-7012 remain in place.

If anything, the pause puts more weight on the self-assessment. With no outside assessor scheduled, the score in SPRS and the signature on the affirmation are what DoD and primes rely on. Our earlier pieces cover which NIST 800-171 gaps to close first during the pause and whether to book a C3PAO assessment now.

When should you re-assess before the three years are up?

Re-score whenever the score in SPRS no longer describes your environment. NIST SP 800-171 Rev 2, the version DoD still assesses against, makes this part of the control set: requirement 3.12.1 calls for periodically assessing security controls to determine whether they are effective, and requirement 3.12.4 calls for developing, documenting and periodically updating the system security plan.

For an AEC firm, the changes that usually move a score are ordinary business events:

• A new office, a remote studio, or a jobsite trailer that now touches CUI drawings or specifications.
• A move of project files to a new cloud platform, file sync tool or rendering service.
• A change of IT provider, or a new vendor with access to the CUI environment.
• Staff turnover in the people who administer accounts, backups or encryption.
• A POA&M item the firm planned to close that is still open.

Each of these can make the date in SPRS accurate while the number next to it is not.

What should an AEC firm do before year-end?

Treat the refresh as a calendar item with an owner, the same way the firm handles license renewals and insurance.

• Log in to SPRS and record the assessment date, score, CAGE codes and planned completion date for every system security plan on file.
• Count forward three years from the assessment date, and note any solicitation that asks for a shorter window.
• Confirm when the last CMMC affirmation was entered and who signed it. If that person has left or changed roles, name a new affirming official.
• Walk the system security plan against how the firm actually works today: offices, cloud services, vendors and administrators.
• Re-score against the 110 Rev 2 requirements if anything material changed, and update SPRS with the new score and date.
• Close any open POA&M items, or document why the date moved, before anyone signs the next affirmation.
• Keep the evidence (screenshots, policies, configuration exports) with the date of the review, so the next affirmation has something behind it.

How does s90 help?

s90 works with architecture, engineering and construction firms that handle CUI to keep the system security plan, the evidence behind each requirement, and the SPRS calendar in one place. We help prepare the self-assessment, track POA&M items to closeout, and give the affirming official a dated evidence package before each signature. If you want a second set of eyes on whether your score is still current, we are happy to walk through it with you.