Your SPRS Score Is a Statement to the Government: Lessons From the Honeywell Settlement

If your company holds a Department of Defense contract with DFARS 252.204-7012 in it, you've likely posted a NIST SP 800-171 self-assessment score in SPRS (the Supplier Performance Risk System). It's easy to treat that number as paperwork. It isn't. It's a statement you make to the government, and DoD relies on it.

What happened

On September 1, 2026, the U.S. Department of Justice announced that Honeywell Aerospace Inc. agreed to pay $2,042,518 to settle allegations under the False Claims Act.
DOJ alleged that from April 2020 through December 2023, a business unit of Honeywell International submitted false claims for payment by not meeting the cybersecurity requirements in NIST SP 800-171 on one of its networks, as the contract and regulation required.
The case began as a whistleblower lawsuit filed by a former Honeywell employee, who will receive $375,823 as her share. DOJ notes the claims are allegations only, with no finding of liability.

Why it matters for your SPRS score

In this case, DOJ alleged that billing DoD while not meeting NIST SP 800-171 made those claims for payment false. When CUI comes through your contract, your contract requires NIST SP 800-171, and your SPRS score tells DoD how much of it you meet. DOJ has said it will keep investigating cybersecurity violations by contractors.

What to do

• Score every control honestly. Walk all 110 NIST SP 800-171 controls. If a control isn't fully met, don't take credit for it.- Document your gaps. Your System Security Plan (SSP) should describe how each control is met. Anything not met belongs in a Plan of Action and Milestones (POA&M) with an owner and a date.- Keep evidence. For every control you claim, keep the policy, the screenshot, the log, or the record that shows it.- Update the score when things change. A new system, a new network, or a closed POA&M item can all change your number.## Start here We built a free SPRS score worksheet to help you walk the controls and see where your score really lands: https://cyberneza.com/sprs-score-worksheet Source: U.S. Department of Justice press release, Sept 1, 2026 Cyberneza is a veteran-owned, 100% US-based cybersecurity firm in Orlando, Florida.