Santa Clarita Valley manufacturers who supply the defense industry carry a number most of their customers never see but the federal government does: a cybersecurity self-assessment score posted in the Supplier Performance Risk System, or SPRS. For many small shops, that number was entered once, years ago, and never looked at again.
That is worth revisiting this fall.
What is the SPRS score?
Defense contracts that involve Controlled Unclassified Information, or CUI, require contractors to protect it using a federal standard called NIST SP 800-171. The standard has 110 security requirements. Contractors assess themselves against all 110 using the Department’s scoring method and post the result to SPRS.
A business that meets every requirement scores 110. Each missing control subtracts points, weighted by how important it is, and the scale goes as low as negative 203. Primes can see that score when they decide which suppliers to work with.
Why does it matter more right now?
On July 13, 2026, the Department of War paused Phase 2 of its CMMC certification program, which would have required third-party assessments starting this November. Some contractors read that as a reason to relax. But the Department also said that during its review it would keep enforcing NIST SP 800-171 through self-assessments and selected government-led assessments.
In other words, the self-reported score carries more weight while the third-party audits are on hold, not less. A score is a representation to the federal government, and the Justice Department has used the False Claims Act against contractors whose cybersecurity claims did not match reality.
How to check whether your score holds up
- Pull up the last score you posted and the date. If no one at the company knows where it came from, that is your first finding.
- Re-walk the 110 requirements with whoever runs your IT today, not whoever ran it when the score was first entered.
- Look hardest at the high-value controls: multi-factor authentication, encryption of CUI, audit logging and incident response. These carry the biggest point deductions.
- Update your System Security Plan so it describes the network you actually have.
- Post a corrected score and a dated plan to close the gaps.
Do small shops really need outside help?
Not always, but most find it faster. A 30-person machine shop rarely has someone whose full-time job is security logging. Many SCV manufacturers handle NIST 800-171 compliance through a managed IT provider that runs the monitoring and keeps the documentation current.
HD Tech, a Seal Beach-based managed IT and cybersecurity firm serving Los Angeles and Orange County businesses since 1995, works with defense contractors on exactly this kind of readiness, including 24/7 security monitoring and compliance documentation.
Whatever route a business takes, the goal is the same: a score you can defend if anyone asks how you got it.
DISCLAIMER: No part of the article was written by The Signal editorial staff.
