False SPRS Scores and Assessment Scope: The Defense System Behind the Number

A false SPRS score from a defense contractor can conceal missing cybersecurity controls, an assessment of the wrong systems or findings left uncorrected after an outside review. If you assessed those systems, challenged the score or worked on the promised fixes, you may know exactly where the submission parted company with the work. The useful comparison connects what the government was told to the systems handling its information and the contracts paying for that work.

SPRS is the Supplier Performance Risk System, where the Defense Department records cybersecurity assessment results. The number has a history: the systems assessed, the date, the evidence and the person or organization doing the assessment. The cases below show why each part matters.

How SPRS Scores Can Misrepresent the Work

MORSE’s SPRS Score Was Not Updated After an Independent Assessment

MORSECORP submitted a score of 104 in January 2021, but an independent cybersecurity consultant told the defense contractor in July 2022 that its actual score was minus 142. MORSE admitted that it did not update the score in the Defense Department’s reporting system until June 2023, three months after a government subpoena. We find that remarkable: the government received a correction only after it had started asking questions. In a civil settlement announced in March 2025, MORSE agreed to pay $4.6 million to resolve allegations concerning claims for payment on Army and Air Force contracts.

Those admissions reached the systems behind the number. MORSE acknowledged that required security controls remained unimplemented and that, for part of the covered period, it lacked a consolidated written security plan for each covered system describing its boundaries, operating environment and connections.

The whistleblower’s complaint described an internal decision about assessments that went further. It alleged that the chief operating officer submitted and certified the assessment, then later proposed preparing for an audit and returning to noncompliant practices until the next one approached. The whistleblower objected that vulnerability and change management required records generated continuously. A polished audit day would leave the intervening months visible.

Georgia Tech’s Alleged Fictitious Assessment Environment

An SPRS score based on a fictitious assessment environment was central to the government’s allegations against Georgia Tech Research Corporation and Georgia Institute of Technology. The Justice Department alleged that a purported campus-wide score of 98 described a fictitious or virtual environment, alongside missing antivirus protection and a system security plan at the Astrolavos Lab. The contracts involved Air Force and DARPA work, and the government alleged that the score was a condition of award. Georgia Tech Research Corporation agreed to pay $875,000 in September 2025 to resolve the civil allegations.

The whistleblowers, former cybersecurity team members, described the physical mismatch in their complaint. Most systems listed for the lab allegedly sat on a network without the firewall credited in its signed compliance documents. Staff also alleged that hosts moved to a different network without corresponding updates to the inventory or system security plan.

The complaint quoted a research administrator explaining why the technical problem reached the bill:

The whistleblowers alleged that the chief information security officer later told staff their primary job was to keep Georgia Tech billing. That is the conflict we care about: people examining the systems raised problems, while the people controlling the message allegedly pressed to keep the money moving. The firewall and the billing decision belong in the same story.

Penn State’s Promised Fixes Were Part of the Representation

The Justice Department alleged that Penn State submitted scores showing missing controls, misrepresented when it would implement them and did not pursue its plans of action. The October 2024 settlement for $1,250,000 covered 15 contracts or subcontracts involving the Defense Department or NASA. The alleged failures ran from 2018 through 2023.

The whistleblower, a former chief information officer for Penn State’s Applied Research Laboratory, alleged a second problem in the amended complaint. Assessment records referred generically to colleges or institutes instead of specific systems or research computing owners, and uploaded assessments were allegedly templates. An internal team had identified active projects involving controlled unclassified information that had attested to compliance, yet could not locate the systems holding that information.

The Justice Department also alleged that an external cloud provider used for certain work failed to meet the required security standards. The combined picture puts the promised completion date beside the system inventory and the actual remediation work. Disclosing an unfinished control leaves a further representation to examine: when the contractor said it would finish the job.

LOGZONE’s Government Assessment and the Navy’s Payments

The Defense Contract Management Agency assessed LOGZONE’s implementation of required security controls at minus 170. The Justice Department’s June 2026 settlement announcement said the company agreed to pay $507,144 to resolve allegations of knowingly submitting false claims on two Navy contracts while failing cybersecurity requirements.

The government alleged that required controls went unimplemented from May 2021 through March 2025. The Navy’s contracts required those protections, and the agency’s assessment identified the shortfalls alleged in the payment case. That is a concrete example of how government assessments can feed a fraud investigation.

What Evidence Is Needed to Prove Fraud?

For an SPRS self-assessment with missing controls, a whistleblower’s useful evidence connects the submitted score to the systems, the internal findings and the government business. Insiders may hold the assessment and its scope alongside network inventories, control evidence and objections to what was submitted. Promised completion dates and later findings can show what management knew when it continued to certify or bill. We work with the person who saw those decisions to establish how the technical problem reached the government’s purchase.

An assessor may know why a control received credit. A system owner may know that the credited protection was absent, while the contracts team saw the assurance sent outside the business. What management learned and what the company later disclosed belong in that same chronology.

A 2022 study of compliance programs and contracting fraud penalties, published in the International Journal of Management and Humanities, found an association between formal compliance programs and higher penalties in its sample of 49 defense contractors. A compliance program on paper is little comfort when management overrides the people checking the work.

Why Assessment Scope Comes Before the Score

Assessment scope identifies the systems the number describes. Under the assessment framework introduced in 2020, assessments covered each relevant contractor information system for the offer, contract or order. A Basic Assessment was the contractor’s self-assessment, while Medium and High Assessments came from the government and reflected greater assessment depth.

The submission identified the assessment date, total score and planned completion date. It named the system security plan when more than one system was involved and described the architecture when more than one plan existed. An insider who knows which network was actually used can connect that description to the work. Georgia Tech’s alleged network changes and Penn State’s alleged inability to locate controlled information show why the original boundary and inventory matter alongside the score.

The same question reaches outside the contractor’s own network. MORSE admitted using an email host without requiring and ensuring that it met the applicable cloud-security and incident-related requirements. A provider’s service and its connections can be part of the security promise made for government work.

The July 13, 2026 CMMC implementation instructions suspended the planned Phase 2 transition while keeping the underlying safeguarding and cyber-incident-reporting duties in force. For an insider comparing a security assurance with the work performed, the contract and its amendments still matter.

What Is Considered a Good SPRS Score?

Under the original NIST SP 800-171 assessment method, a score of 110 represented implementation of all 110 security requirements. Unimplemented requirements carried deductions, and the MORSE settlement announcement described a possible score range down to minus 203. We examine the contract’s requirements, the assessment scope and the work behind the promised completion date together.

The 2024 CMMC rule explains that its Level 2 scoring adopted the Defense Department’s NIST assessment method, with requirements valued at 1, 3 or 5 points. Missing requirements subtract their assigned values, so the score can fall below zero. The weight reflects the security consequence of leaving a requirement unimplemented, which is why the controls credited in the assessment matter as much as the total.

When a Cybersecurity Representation Reaches Government Money

A false cybersecurity representation reaches government money through the award, the work promised or the claims submitted for payment. MORSE’s settlement addressed alleged false payment claims, Georgia Tech’s allegations connected the score to contract award, and Penn State’s allegations reached the dates promised for correcting missing controls. Each supplies a different connection between the technical record and the government’s purchase.

That connection is where we assess a defense contractor whistleblower case. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We work with the insider who can explain both the assurance and the decision behind it.

If You Saw the Number Being Built

If you know which systems were left out, which controls received credit or why a score stayed unchanged after an outside assessment, speak with our whistleblower experts about the submission. We work beside you to connect that knowledge to the contracts and payments, and bring in cybersecurity fraud whistleblower lawyers who understand defense contracting. We stay with you from the first call, working to build your strongest cybersecurity whistleblower case from what you saw inside the business.