The Supplier Performance Risk System score is the number your prime asks for, and it is the most misunderstood figure in this whole process — mostly because it looks like a percentage and is not one.
How the arithmetic works
You start at 110, one point for each NIST SP 800-171 requirement, and subtract for each one you have not implemented. The subtraction is weighted by the DoD Assessment Methodology: some requirements cost 1 point, some 3, and the ones with the largest security impact cost 5. Because the heavy weights add up faster than the 110 you started with, the scale bottoms out at −203.
- 110 — every requirement implemented. Rare, and it is a claim you must be able to evidence.
- A positive score — the serious gaps are closed and what is left is mostly documentation and housekeeping.
- Around zero — the common honest starting point for a shop that has good IT hygiene but has never worked to this standard.
- Deeply negative — several of the 5-point requirements are unmet. Usually multifactor authentication, encryption of CUI at rest, audit logging, or incident response.
So what is "good"?
Good is a score you can defend line by line, submitted with a POA&M that shows the remaining gaps and dates. Primes are far more comfortable with a 47 and a credible plan than a 105 nobody can evidence — an inflated score is the one thing that turns a routine conversation into a serious one, because the affirmation is a statement to the government.
There is no partial credit. A requirement is implemented or it is not — the only exceptions are the two requirements the methodology scores at −3 when partially met, and the handful that can be legitimately not applicable.
One requirement is different from the rest
You cannot score at all without a System Security Plan. The methodology treats a missing SSP as a condition under which the assessment cannot be completed, rather than a five-point deduction. If you have no SSP, your first task is not scoring — it is writing.
Our calculator implements this scoring exactly as written, weights transcribed from the official methodology annex, with no estimation anywhere in the arithmetic. It takes about twenty minutes and it costs nothing.