On this page
Why SPRS matters
For contracting purposes, status and affirmation discipline matter just as much as the technical work. The live DFARS clause and 32 CFR Part 170 make SPRS central to self-assessment reporting, affirmations, and checking whether a contractor has current status at the time of award.
That means a company can do serious technical remediation and still create risk for itself if it mishandles the timing, records, or affirmation process.
What gets reported
For Level 2 self-assessments, the rule says SPRS reporting includes at least the CMMC level, the status date, the assessment scope, the associated CAGE codes for the information systems addressed by the scope, the overall score, and POA&M usage if applicable.
That is why a clean scope and clean documentation matter. Bad scoping leads to bad reporting. Bad reporting leads to award and maintenance problems.
Passing scores, POA&Ms, and 180-day closeout
The CMMC 101 briefing says the Level 2 minimum passing score is 80 percent, or 88 out of 110. The rule also allows a limited POA&M path for Level 2 and Level 3, but not Level 1. If a company receives a conditional Level 2 status, it has 180 days to remediate the remaining NOT MET items and complete the required closeout.
The closeout window is not open-ended. If the POA&M is not successfully closed within the 180-day timeframe, the conditional status expires.
Current status and annual affirmations
The live DFARS clause defines what counts as current. Final Level 1 status is current for up to one year when affirmations are maintained. Final Level 2 Self and Final Level 2 C3PAO statuses are current for up to three years when affirmations are maintained. Conditional Level 2 and Level 3 statuses are current only within the 180-day closeout window and only while the other conditions remain met.
The About CMMC page and the rule also make an easy-to-miss point: if the annual affirmation is not submitted, the assessment lapses. Companies need an operating rhythm for affirmation, not just a project plan for remediation.
What buyers actually need help with
- Calculating and validating the right starting position before reporting.
- Understanding when a POA&M is permitted and when it is not.
- Coordinating the evidence needed for closeout instead of assuming the remaining items are trivial.
- Tracking annual affirmation dates and current-status dates as operational deadlines.
- Explaining to leadership and primes what the reported status actually means.
Frequently asked questions
What is SPRS?
SPRS is the Supplier Performance Risk System that DoD uses as the authoritative source for certain cybersecurity assessment information, including CMMC self-assessment reporting and affirmations.
What is an SPRS score in CMMC?
For Level 2 self-assessments, SPRS captures the overall Level 2 score along with the scope, status date, CAGE codes, and POA&M usage where applicable.
What is the minimum passing score for Level 2?
The CMMC 101 briefing says the minimum passing score is 80 percent, which is 88 out of 110.
Can Level 1 use a POA&M?
No. Level 1 cannot use a POA&M.
Can Level 2 use a POA&M?
Yes, but only under the conditions in 32 CFR 170.21 and only with closeout completed within 180 days.
What happens if we do not close the POA&M in time?
If the POA&M is not successfully closed out within 180 days, the conditional Level 2 status expires.
How often do we affirm?
At the time of each assessment and annually thereafter.
What happens if we miss annual affirmation?
The assessment lapses and the company no longer has current status for contracting purposes.
Related articles
Official sources reviewed
Contract language, current regulations, and official CMMC program guidance control.
Want help turning this into a real readiness plan?
Velocity CMMC can scope the environment, map CUI flows, organize the documentation package, support remediation, and help your team prepare for the right assessment path without pretending to be the certifier.