Parsing the Meaning of Performance Risk Scores

Photo: iStock

On Sept. 29, the Defense Department released an interim rule on addressing its increased requirements for assessing whether contractors are compliant with the 110 security controls in National Institute of Standards and Technology Special Publication 800-171. Contractors could be affected by how the Pentagon uses the assessment scores to evaluate supplier performance risks.

Under this new interim rule, which was set to go into effect Nov. 30, offerors must have a current assessment on file with the department to document their compliance before they can be eligible to be considered for award. It requires contractors to ensure that a summary score from an assessment conducted under the NIST 800-171 methodology is submitted into a Defense Department enterprise application called the Supplier Performance Risk System, or SPRS.

The department has recently taken two little-noticed actions that may provide some insight into how it plans to use the assessment scores.

First, a few months before the interim rule was published, the department added a number of entries to its Frequently Asked Questions relating to contractor cybersecurity requirements. The updated FAQs noted that scores under the assessment methodology were intended to be used to support “basic,” “medium” and “high” NIST 800-171 assessments and to provide “an objective assessment of a contractor’s NIST 800-171 implementation status.”

The department also clarified that it does not plan to establish a passing score threshold that contractors need to achieve in order to secure contracts. Rather, it indicated with respect to NIST 800-171 assessment scores that “this is essentially a risk decision,” and that “[a] decision to accept the risk should remain with the Requiring Activity.”

Second, a proposed rule published Aug. 31 expands SPRS from its current limited use in simplified acquisitions to a required evaluation factor for all solicitations for supplies and services, including those for commercial items. It also amends the Defense Federal Acquisition Regulation Supplement by requiring contracting officers to use the supplier risk assessments generated in SPRS as a factor in determining responsibility at DFARS 209.105–1 to “reduce supply chain risk.”

Under the proposed rule, SPRS would generate three types of risk assessments using evaluation criteria: item risk, price
risk and supplier risk.The system would collect data to generate the probability that a product or service, based on intended use, will introduce counterfeit or nonconforming material entering the Pentagon’s supply chain.

It would also collect historical pricing data from government sources and apply a common statistical method to calculate the average price paid for a product or services, generating a price range that contracting officers can use in the evaluation of fair and reasonable pricing to determine whether a price is high, low or “within range.”

Additionally, the system would calculate a supplier risk score for contracting officers to compare competing suppliers. This score includes three years of relevant supplier performance information from existing government data sources.

It is possible that the NIST 800-171 assessment scores could factor into the calculated risk analyses that are generated by SPRS, but how much of a factor they will be remains unclear.

Another uncertainty relates to the new Federal Acquisition Security Council.On Sept. 1, the Office of Management and Budget issued an interim final rule implementing the Federal Acquisition Supply Chain Security Act. This rule authorizes the executive branch to issue exclusion and removal orders for products and sources that it determines represent a security risk.

The new Federal Acquisition Security Council, also known as FASC, will be charged with the evaluation process. The review process can be triggered from a referral of the council or any member of the council; upon the written request of any U.S. government body; or based on information submitted to the council by any individual or non-federal entity that the council determines to be credible.

Presumably information in the SPRS could provide a basis for a review. Indeed, the rule mandates that “Executive agencies must expeditiously submit supply chain risk information to the [FASC’s Information Sharing Agency] ... when... [an] executive agency has determined there is a reasonable basis
to conclude a substantial supply chain risk associated with a source, covered procurement, or covered article exists.” However, the precise interaction between the Federal Acquisition Security Council and SPRS remains unclear.

Although there are numerous clues as to how SPRS may impact future procurements, much remains to be clarified. Supply chain issues are clearly top of mind for the government, and oversight of these risks is tightening in response to the evolving threat.

Further, the type of risk data that SPRS is compiling, as well as the generated risk assessments that it creates, indicate that the Defense Department is increasingly focused on collecting and using data to make decisions about its supply chain. Accordingly, contractors should continue to follow the development of the SPRS interim rule and the actions of the Federal Acquisition Security Council to ensure that they are aware of all of the information that the government may use to make a procurement decision.

Susan Cassidy is a partner, and Ryan Burnette and Darby Rourick are associates at Covington & Burling LLP.

Topics: Government Contracting Insights