Topic · 8 articles
SPRS
Every MacZine article on SPRS, newest first - written, reviewed and versioned in the open.
3.9.2 Fails on the Transfer, Not the Termination
NIST 800-171 control 3.9.2 is worth 5 SPRS points. Firings are handled. The engineer who moved to a commercial program and kept enclave access is not.
One Control, Followed From Log File to a Score a Prime Can Check
How Trust Codex turns one Sunday evidence run into an objective verdict, a recomputed SPRS methodology score, a hash-chained ledger entry and a signed proof.
DoD Retired the Snapshot for Its Own Systems. CMMC Kept It.
The DoD CIO's risk management construct ended snapshot-in-time authorization for DoD systems. Contractor CMMC posture should follow, verifiably.
Subcontractor Cybersecurity: Your Sub's SPRS Score Is a Claim
Primes cannot see a sub's score in SPRS. Subcontractor cybersecurity requirements get verified with evidence - here is what to ask for.
Read the Solicitation's Compliance Clauses Before You Bid
Compliance cost gets decided at bid or no-bid, not after award. A front-to-back read of the clauses, DD-254, and Section L/M that actually price it.
3.5.3: The MFA Control Most Programs Think They Already Passed
NIST 800-171 3.5.3 requires MFA for three scopes, not one. Most programs cover network logins and miss privileged local access - the one assessors test first.
What You Can Put on a POA&M, and What You Cannot
Under 32 CFR 170.21 a CMMC POA&M can carry only 1-point requirements, minus six named exclusions, and must close within 180 days. The rules.
How Your SPRS Score Is Actually Calculated
The DoD Assessment Methodology scores 110 controls on a 5/3/1 weighting and bottoms out at -203. Here is the arithmetic, and how a CO reads it.