How is DoD Planning to Use the Supplier Performance Risk System (SPRS)?

By Susan B. Cassidy, Ryan Burnette & Darby Rourick on October 27, 2020

Posted in Cybersecurity, Defense Industry, Supply Chain

As described in an earlier blog post, the Department of Defense (DoD) released an Interim Rule on September 29, 2020 that address DoD’s increased requirements for assessing whether contractors are compliant with the 110 security controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (NIST 800-171).[1] Under this new Interim Rule, DoD offerors must have a current assessment on file with DoD to document their compliance with NIST 800-171 before they can be eligible to be considered for award. The Interim Rule specifically requires contractors to ensure that a summary score from an assessment conducted under DoD’s NIST 800-171 Assessment Methodology is submitted into a DoD enterprise application called the Supplier Performance Risk System (SPRS).[2] We evaluate below how DoD may use the NIST 800-171 assessment scores in SPRS, as well as how updates to SPRS more generally are likely to impact contractors.

Recent DoD Actions

DoD has recently taken two little noticed actions that may provide some insight into how DoD plans to use the NIST 800-171 assessment scores that are entered into SPRS. First, three months before the Interim Rule was published, DoD added a number of entries to its Frequently Asked Questions relating to contractor cybersecurity requirements. The updated FAQs noted that scores under DoD’s Assessment Methodology were intended to be used to support “Basic,” “Medium,” and “High” NIST 800-171 assessments and to provide “an objective assessment of a contractor’s NIST 800-171 implementation status.” DoD also clarified that it does not plan to establish a passing score threshold that contractors need to achieve in order to secure DoD contracts. Rather, DoD indicated with respect to NIST 800-171 assessment scores that “this is essentially a risk decision,” and that “[a] decision to accept the risk should remain with the Requiring Activity.”[3]

Second, a Proposed Rule that DoD published on August 31, 2020 is consistent with these FAQs and provides additional insight into DoD’s plans for SPRS. The Proposed Rule expands SPRS from its current limited use in simplified acquisitions to a required evaluation factor for all solicitations for supplies and services, including those for commercial items. The Proposed Rule also amends the DFARS by requiring contracting officers to use the supplier risk assessments generated in SPRS as a factor in determining responsibility at DFARS 209.105–1 to “reduce[] supply chain risk.” Under the Proposed Rule, SPRS would generate three types of risk assessments using SPRS Evaluation Criteria:

Item Risk. SPRS collects data to generate the probability that a product or service, based on intended use, will introduce counterfeit or nonconforming material entering the DoD supply chain.
Price Risk. SPRS collects historical pricing data from Government sources and applies a common statistical method to calculate the average price paid for a product or services, generating a price range that contracting officers can use in the evaluation of fair and reasonable pricing to determine whether a price is high, low or “within range.”
Supplier Risk. SPRS calculates a supplier risk score, for contracting officers to compare competing suppliers. This score includes three years of relevant supplier performance information from existing Government data sources.

In addition to these risk assessment scores, the Proposed Rule states that COs “may consider any other available and relevant information when evaluating a quotation or an offer.” Taken together, it is possible that the Basic NIST 800-171 Assessment scores that contractors will enter into SPRS and the Medium and High NIST 800-171 Assessment scores entered by DoD could factor into the types of calculated risk analyses described in the Proposed Rule that are generated by SPRS. It is also possible that DoD could create new criteria or simply let the assessment scores stand alone in the SPRS. How much of a factor the assessment scores will be in the SPRS analyses remains unclear.

Relationship to Federal Acquisition Security Council (FASC)

On September 1, 2020, the Office of Management and Budget issued an interim final rule implementing the Federal Acquisition Supply Chain Security Act. Our client alert addressing this interim rule can be found here. This Rule authorizes the Executive Branch to issue exclusion and removal orders for products and sources that it determines represent a security risk. Overseeing this process is the new Federal Acquisition Security Council (FASC), which will be charged with the evaluation process. The review process can be triggered from a referral of the FASC or any member of the FASC; upon the written request of any U.S. Government body; or based on information submitted to the FASC by any individual or non-federal entity that the FASC determines to be credible. Presumably information in the SPRS could provide a basis for a review. Indeed, the Rule mandates that “Executive agencies must expeditiously submit supply chain risk information to the [FASC’s Information Sharing Agency]… when… [a]n executive agency has determined there is a reasonable basis to conclude a substantial supply chain risk associated with a source, covered procurement, or covered article exists.”[4] However, the precise interaction between the FASC and SPRS remains unclear.

Impact on Contractors

Although there are numerous clues as to how SPRS may impact future procurements, much remains to be clarified. Supply chain issues are clearly top of mind for the Government and oversight of these risks is tightening in response to the evolving threat. Further, the type of risk data that SPRS is compiling, as well as the generated risk assessments that it creates, indicate that the DoD is increasingly focused on collecting and using data to make decisions about its supply chain. Accordingly, contractors should continue to follow the development of the SPRS Interim Rule and the actions of the FASC to ensure that they are aware of all of the information that the Government may use to make a procurement decision.

[1] The Interim Rule modifies the Defense Federal Acquisition Regulation Supplement (DFARS) and becomes effective on November 30, 2020.

[2] Prior to this rule, SPRS was used only to provide quality and delivery data to calculate “on time” delivery scores and quality classifications for simplified acquisitions.

[3] Question and Answer No. 126.

[4] 41 CFR § 201.202(b).