The “Basic Assessment” Is Gone — So Why Do I Still Need an SPRS Score?

If you’ve read the renumbered clause, you noticed something strange. DFARS 252.240-7997 — the clause that replaced 252.204-7020 on February 1, 2026 — defines only two kinds of NIST SP 800-171 assessment: Medium and High, and the government performs both. The “Basic Assessment” — the self-assessment tier that told contractors to score themselves and post the number to SPRS — was deleted. It’s not renamed, not moved to an appendix. It’s gone.

So a reasonable person concludes: no more Basic Assessment, no more self-assessed SPRS score. And then the same reasonable person notices that contracting officers still expect a current score in SPRS, primes still ask for it in flowdowns, and the Department of War (DoW) still says self-assessment is the standard. Both things are true, and the confusion is real enough that it’s worth walking through slowly.

What actually got deleted

Two clauses died in the February 1, 2026 FAR Overhaul (the “Revolutionary FAR Overhaul,” done by class deviation rather than normal rulemaking):

DFARS 252.204-7019 — the provision that required you to have a current Basic Assessment score in SPRS before award. Deleted entirely.
DFARS 252.204-7020 — renumbered to 252.240-7997, and stripped of every reference to the Basic (self-assessed) tier. What survives in the renumbered clause is the government-performed machinery: Medium and High assessments, conducted by DIBCAC, with results posted to SPRS by the government and a 14-day window for you to rebut them.

At the same time, the basic-safeguarding clause FAR 52.204-21 became FAR 52.240-93. Same 15 controls, new number.

So the word “Basic Assessment” no longer appears anywhere in your contract clauses. That part of the confusion is legitimate.

Why your SPRS score didn’t die with it

The self-assessment obligation didn’t disappear. It moved — into the CMMC clause, DFARS 252.204-7021, which the overhaul left untouched.

Under 252.204-7021, your CMMC level is a condition of award, and at the levels that apply to most small contractors, CMMC is a self-assessment:

Handle only FCI? CMMC Level 1: self-assess against the 15 controls of FAR 52.240-93, post the result to SPRS, affirm annually.
Handle CUI? CMMC Level 2: self-assess against all 110 requirements of NIST SP 800-171 Rev 2, post your score to SPRS, affirm annually.

In other words: the old system had two overlapping paper trails — a “Basic Assessment” score under 7019/7020 and a CMMC self-assessment under 7021 — that were substantively the same exercise. The overhaul deleted the redundant one. What’s left is one pipe, and it runs through CMMC. The scoring math didn’t change either: it’s still the DoD Assessment Methodology (the scale that runs from 110 down to −203), still measured against NIST SP 800-171 Revision 2 — DoW has not moved SPRS scoring to Rev 3.

Deletion of the clause, not the duty. Housekeeping, not a reprieve.

“But isn’t CMMC suspended?”

Phase 2 is — and this is the other half of the confusion, because the two changes landed six months apart and read like they cancel each other out. They don’t.

On July 13, 2026, DoW suspended the CMMC Phase 2 rollout — the phase where third-party (C3PAO) certification was set to become a default award condition for CUI contracts on November 10, 2026. What the suspension paused is the third-party machinery. What it explicitly left in force is Phase 1: self-assessment. Your SPRS score and your annual affirmation are Phase 1 obligations. The suspension didn’t weaken them — it made them the standard for the foreseeable future, because self-assessment is now the only active assessment lane for most of the defense industrial base.

Put the two changes together and the picture is almost funny: the February overhaul deleted the clause called “Basic Assessment,” and the July suspension made basic self-assessment the entire ballgame. The label died; the activity got promoted.

What Medium and High mean for you now

Under 252.240-7997, Medium and High assessments are things the government does to you, not things you do. DIBCAC selects contractors — typically on larger or more sensitive programs — reviews your System Security Plan, and in the High case validates on-site. You don’t schedule one, and you can’t substitute one for your self-assessment. If you’re a typical small contractor, the practical meaning of Medium and High is: keep your SSP accurate, because if you’re ever selected, that document is what gets examined — and your self-reported SPRS score is what it gets compared against. A self-reported 110 that DIBCAC re-scores as a 40 is exactly the gap the False Claims Act was built for.

What you should actually do

Keep self-assessing against all 110 requirements of NIST SP 800-171 Rev 2 if you handle CUI (the 15 of FAR 52.240-93 if you only handle FCI).
Keep your SPRS score current — and honest. The score’s regulatory home changed; the expectation that it exists and is accurate did not.
Keep your annual affirmation on calendar. Affirmations survived both the overhaul and the suspension.
Update your paperwork’s clause numbers — internal docs and subcontract flowdowns that cite 52.204-21 or 252.204-7020 should now read 52.240-93 and 252.240-7997. The obligations flow the same; the citations changed.
Keep your SSP current, because it’s both your CMMC self-assessment evidence and the document a DIBCAC Medium/High review would start from.

Score yourself in the next ten minutes

Your self-assessed score is still the number that matters — so know what it is before a contracting officer or prime asks.

Calculate your SPRS score →

The free SPRS calculator walks all 110 requirements in plain English and gives you the −203-to-110 number, the SSP generator drafts the System Security Plan behind it, and the POA&M generator turns your gaps into the plan of action assessors expect to see.