Do I need to upload my self-assessment score to SPRS?

SPRS is the authoritative system the government uses to retrieve contractor compliance information per DoDI 5000.79. For CMMC, it is the central point of record for self-assessments, affirmations, and visibility of certification status.

The systems of record

What you need to access SPRS

1. SAM.gov registration. Active SAM registration with valid Entities, UEIs, and CAGE hierarchy.
2. PIEE account. Procurement Integrated Enterprise Environment account — the single sign-on portal.
3. Contractor Administrator (CAM) role. Established in PIEE for your Vendor group.
4. SPRS Cyber Vendor User role. Approved by your CAM. Without this role you cannot add, edit, or affirm CS assessments.

The Level 1 entry workflow

1. Open SPRS, select your CAGE from the hierarchy.
2. Enter the assessment date, scope (Enterprise or Enclave), employee count, FAR 52.204-21 compliance, and Included CAGEs.
3. Either affirm directly (if you are the Affirming Official) or send the assessment to the AO for affirmation.
4. The AO logs in, verifies their identity and authority to affirm, reviews the results, and signs the affirmation.
5. SPRS issues a unique assessment record ID, the CMMC Status (Final or No CMMC Status), and an expiration date.

The Level 2 self-assessment entry workflow

1. Open SPRS, select CAGE.
2. Step through each NIST 800-171 requirement family, answering the assessment objectives in detail. SPRS provides pop-up details for each objective.
3. Certain practices require answering at the assessment objective level (not just the practice level).
4. SPRS calculates the score automatically based on your responses.
5. Once all requirements are answered, submit to the Affirming Official.
6. The AO reviews and signs the affirmation; SPRS records the CMMC Status with an expiration date.

The Affirming Official

Per § 170.22, the affirmation is signed by a senior company official. The AO must verify their personal information and their authority to affirm before signing. The AO can optionally add additional points of contact for government contracting officers to use when discussing the assessment.

Common errors

• Not having the SPRS Cyber Vendor User role. Without it, the CMMC entry options are not visible in SPRS — a common first-time blocker.
• Skipping the affirmation after entering scores. A score without an affirmation is not a valid submission. The CMMC Status only becomes effective after the AO signs.
• Letting the affirmation lapse. The annual affirmation cadence applies regardless of whether you currently hold a Final CMMC Status from a C3PAO or DIBCAC assessment.
• Affirming with a misaligned scope. The CMMC Assessment Scope on the SPRS entry should match the SSP and the scope documented in CMMC eMASS for certifications.