Defense Cyber & SPRS Score Exposure Baseline
Answer 5 high-impact questions targeting DoD -5 point deduction controls. Estimate your baseline score and identify immediate remediation priorities.
1. Do you enforce phishing-resistant Multi-Factor Authentication (MFA) on all network and cloud access?
Why this matters: Failing to enforce MFA incurs a severe -5 point deduction in DoD SPRS calculations.
2. Is CUI strictly kept off unencrypted personal devices and commercial cloud tenants?
Why this matters: Commercial Microsoft 365 or Google Workspace cannot legally store CUI without DFARS 7012 c-g compliance.
3. Is FIPS 140-2/3 validated cryptography used for all cryptographic protection of CUI in transit and at rest?
Why this matters: Standard commercial SSL/TLS or BitLocker default modes often fail FIPS 140-2 requirements.
4. Do you have the forensic capability and DIBNet credentials to submit a cyber incident report within 72 hours?
Why this matters: DFARS 252.204-7012 mandates a 72-hour reporting window directly to DoD DIBNet with full forensic media preservation.
5. Do you possess an active System Security Plan (SSP) that accurately reflects your current operational boundary?
Why this matters: Without an active SSP, your organization cannot legitimately submit a score to the DoD SPRS database.
Ready for your preliminary SPRS score?
0 of 5 assessment factors evaluated.