Your SPRS Score Is a Legal Statement. DOJ Keeps Proving It.

A customer’s boss said it to me straight: “I still have to sign my name to that paper.” He’s right, and that sentence is the entire enforcement story now.

800-171 is your name. You’re signing it. Are you sure you’re compliant?

What the signature actually is

Under DFARS 252.204-7019 you post a current NIST 800-171 self-assessment score to SPRS. Under the CMMC rule (32 CFR Part 170), an Affirming Official, a senior official at your company, attests to continuing compliance every year. By name.

At a 12-person shop, that’s the owner. The days of “Jeff in ops signed it” ended when the rule put a title and a name on the line.

That number is a legal statement

If your SPRS score says 110 and your environment sits at 40, that’s a misrepresentation to the federal government, and DOJ treats it exactly that way:

• MORSECORP Inc. reported a 104 in January 2021. Its actual score was minus 142. It admitted those facts and paid $4.6 million. The whistleblower who filed collected $851,000 of it.
• LOGZONE Inc., a small Alabama logistics contractor, got a DIBCAC assessment of minus 170 on a scale that tops out at 110, and agreed to pay $507,144 in June 2026 over 2 Navy contracts.
• Raytheon and Nightwing paid $8.4 million over cybersecurity noncompliance spanning 29 defense contracts.

Notice the size range. This started with the primes and it’s landed on 10-person shops in Huntsville. Small stopped being safe.

Who turns you in

The False Claims Act pays whistleblowers a share of the recovery, and the MORSECORP filer took home $851,000. The person with the clearest view of the gap between your SPRS number and your actual tenant is probably on your payroll right now. That’s the mechanism. It doesn’t need a scheduled audit to work.

And DIBCAC still runs the scheduled kind. The suspension memo keeps “select Government-led assessments” in force during the pause, with DFARS 252.204-7020 as the government’s standing right to come look.

The 20-minute assignment

If you haven’t opened your SPRS number in a year, open it this week. Compare it to the environment you actually run today, not the one you documented in 2022. Then close the gap in whichever direction is true: fix the environment or fix the number.

Leaving the gap for someone else to find is the only wrong answer.