The SPRS Score the Client Wants You to Ignore
You are a CMMC consultant engaged by a 150-employee software company, Vantage Logic, to prepare for Level 2. During a document review, you find that Vantage Logic's SPRS submission shows a score of 108, but evidence supports only 91. Twelve controls marked implemented have no artifacts, and three have contradictory evidence: an incident response plan dated after the last test, and an access control policy that names a system no longer in use. The CEO says the score was entered by a former employee and tells you not to raise it because 'the prime will drop us if the score falls.' The assessment is in three weeks. The CEO asks you to focus only on the controls the assessor will sample and to help 'tighten the story' for the interview. What do you do?
1. Identify the ethical and professional issues and the immediate actions you should take.
Read the worked answer
The core issue is that the SPRS score is a representation to DoD, not a marketing number. A score of 108 when evidence supports 91 is inaccurate. The request to help 'tighten the story' for interviews could become coaching false statements, which the consultant must not do. Professional conduct requires integrity, objectivity, and avoiding misleading acts; a former employee's data entry does not excuse a known error.
Immediate actions: tell the CEO in writing that the score must be corrected and why; preserve the contradictory evidence; do not alter, backdate, or create artifacts; do not coach staff to give answers that conflict with the evidence. Offer a short remediation plan: validate the 12 unsupported controls, correct the 3 contradictory items, update SPRS, and reset the assessment timeline if needed. Document the advice and the client's response. If the client refuses, the consultant should not participate in the assessment or in interview preparation that conceals the gap.
2. If the CEO insists on keeping the score and limiting your review, what should you do next?
Read the worked answer
If the CEO insists, restate the refusal in writing: 'I cannot help represent controls as implemented when the evidence does not support them.' Provide a risk memo describing potential consequences: assessment failure, loss of prime contract, False Claims Act exposure, and reputational harm. Recommend a corrected SPRS submission and a revised assessment date. Offer to help implement the missing controls or prepare an honest POA&M. If the client still refuses, terminate the engagement, document the reason, return or retain records per the engagement terms, and avoid any communication that implies endorsement. Confidentiality does not require silence about your own professional withdrawal, but do not disclose client information beyond what is necessary and legally required. Consider contractual notification duties and seek legal advice before contacting the prime or DoD.
3. How should you handle the request to focus only on the controls the assessor will sample?
Read the worked answer
The request to focus only on sampled controls should be reframed. Sampling is the assessor's method; the consultant's job is not to predict and mask gaps. Cedar Peak should prepare evidence for all implemented controls and use the assessor's likely sample to prioritize interviews and demonstrations. If a control is not implemented, the honest path is to fix it, document a POA&M if eligible, or disclose it. Helping the client 'tighten the story' by hiding contradictory evidence would be misleading. The consultant can help staff explain actual practices clearly, but not invent them.