SPRS login and how to submit your SPRS score
Published 2026-10-23, 18 min read
01
SAM registration
Your SAM POC lists an Electronic Business (EB) POC.
02
CAGE in a PIEE vendor group
A one-time request to the PIEE Help Desk.
03
A Contractor Administrator (CAM)
Named by the EB POC; approves every role.
04
Your own PIEE account
User type “Vendor”, role “SPRS Cyber Vendor User”.
05
SPRS Cyber Reports
You enter; the Affirming Official affirms a CMMC entry.
A break anywhere upstream shows up at the end: SPRS takes its CAGE list from SAM (changes typically arrive within 48 hours), the CAM activates your role, and a CMMC entry counts only once it is affirmed.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Which entry your contract asks for
“Submitting an SPRS score” covers four different records, and SPRS keeps them on different tabs of one module, Cyber Reports (CMMC & NIST). Which one you owe depends on the clause in your contract, not on what a prime's questionnaire happens to call it. Pick the clause and the panel shows where the entry goes, who signs it off and how long it lasts.
Find the clause line in your contract or the prime's purchase order, then pick it here.
NIST SP 800-171 Basic Assessment
- Where in SPRS
- Cyber Reports, the “NIST SP 800-171 Assessments” tab, “Add New Assessment” Quick Entry Guide 3.2
- Who enters it
- A user holding the “SPRS Cyber Vendor User” role Quick Entry Guide 2
- Affirmation
- None in SPRS: the form ends on “Save” Quick Entry Guide 3.3
- What you get
- A DoD Unique Identifier starting SB (Basic); DoD's Medium and High start SM and SH Quick Entry Guide 3.3
- How long it counts
- Not more than 3 years old unless the solicitation sets less; SPRS turns it red after three years 7019(b); Guide 3.4
- Fix a mistake
- Edit it: Basic is the only confidence level vendors can add, edit or delete Quick Entry Guide 3.4
One thing holds for all four: SPRS only stores results. Its own NIST page says the Basic Assessment “cannot be performed in SPRS”, and its FAQ expects the assessment, the score and the system security plan to be finished before you log in. Count the score first with the SPRS score calculator; what the 7019 and 7020 clauses demand of that score is in DFARS 7019 and 7020 explained.
Before you log in: SAM, CAGE and a CAM
Most “I can't get into SPRS” calls start three steps before SPRS. PIEE, the DoD portal SPRS sits behind, will not let anyone at your company register until three things exist, in this order:
- An active SAM registration with an Electronic Business point of contact (EB POC). PIEE copies the EB POC and your address from SAM.
- Your CAGE code in a PIEE vendor group. A company representative asks the PIEE Help Desk once, giving the CAGE code and a group name.
- A Contractor Administrator (CAM) for that CAGE. Only the EB POC can appoint one, a one-person company still needs one (it can be you), and the CAM's own first registration can carry no other role.
The CAM is the gatekeeper for everything after: every SPRS role anyone at the company asks for waits for the CAM's approval. Two practical notes from PIEE and SPRS. Logins are personal and “should not be shared”, so the office manager and the owner each register. And a vendor does not need a PKI certificate to reach SPRS. Your CAGE code, if nobody has it to hand, is on the DLA CAGE search.
Before you log in to SPRS: accounts and entry details, cuideck.com
Fill the right-hand column before you open SPRS: every line is something PIEE or an SPRS form asks for.
Accounts
- SAM registration active (expiry date)
- EB POC named in SAM
- CAGE code(s), and the highest-level owner CAGE
- CAM for each CAGE
- Your PIEE user ID, role “SPRS Cyber Vendor User” active
- Affirming Official, with a PIEE account and the same role (CMMC entries)
What the entry form asks
- Assessment date
- Score (NIST Basic) or each requirement's status (CMMC Level 2)
- Assessing scope: Enterprise or Enclave (a NIST Basic entry also offers Contract)
- Plan of action completion date (NIST Basic)
- SSP name, version or revision, and date (NIST Basic)
- Employee count (CMMC)
- Included CAGE codes, comma-separated
The SPRS role that can enter a score
SPRS offers vendors two roles in PIEE, and only one of them can enter anything. If you can see your company in SPRS but there is no add button, you hold the second.
| PIEE role | What it lets you do | Approved by |
|---|---|---|
| SPRS Cyber Vendor User | View, enter, edit and delete NIST SP 800-171 and CMMC records, for every CAGE in the company hierarchy. Needed to enter a score and to affirm one. | Your CAM |
| Contractor/Vendor (Support Role) | View only: your company's cyber records and its SPRS performance data, for your CAGE and its subsidiaries. | Your CAM, then the SPRS program office |
- 01Log in to PIEE, open “My Account” in the header, then “Add Additional Roles”.
No PIEE account yet: “NEW USER”, read the vendor Getting Started help, “Register”, and pick user type “Vendor”.
- 02Confirm your profile and the “Supervisor/Agency” information when prompted.
- 03Pick “SPRS – Supplier Performance Risk System” from the application list and tick one or both roles, then “Add Roles”.
If the SPRS Cyber Vendor User role is not offered, or the form asks for a training date or a DoDAAC, you registered as a Government user. Call the PIEE Help Desk to change it.
- 04Enter your CAGE code as the “Location Code / CAGE”. Repeat for a CAGE under a different highest-level owner.
- 05Finish the “Justification”, “Summary” and “Agreement” steps and submit.
The role is live only when your CAM activates it. Check under “My Account”, “Manage Roles”.
SPRS Vendor Cyber Reports Access, SPRS V4.0, DEC 2024, sections 2 and 3
One catch for the smallest shops. When you are the only CAM and the role request is your own, SPRS gives two answers: its access guide says to email the PIEE ticket desk for activation, and its FAQ says PIEE activates the role by itself and you log out and back in. Log out and back in first; if the role still shows pending, send the email. Running two companies with separate owners means one Cyber Vendor User role in each company's hierarchy; SPRS sets no limit on how many one person holds.
SPRS login: from PIEE to Cyber Reports
You never log in to SPRS directly: SPRS is reached through PIEE. SPRS's own “Login/Register” button sends you to PIEE, the single sign-on for a range of DoD acquisition applications. The path to the score screens is the same for a NIST score and a CMMC entry:
- 01Go to the PIEE landing page, piee.eb.mil, and choose “LOG IN”.
- 02Select the SPRS tile.
A tile that shows but does nothing means your role request is still waiting for the CAM.
- 03Open “Cyber Reports (CMMC & NIST)” from the SPRS menu.
- 04Pick the hierarchy from the drop-down. The first CAGE is the one on your PIEE profile; the CAGE in parentheses is the highest-level owner (HLO) SPRS has for your company.
An asterisk beside the pair means you hold the SPRS Cyber Vendor User role for it. No asterisk: you can look, not enter.
- 05Choose “Run Cyber Reports”. The NIST SP 800-171 and CMMC tabs open for that hierarchy.
CMMC Level 2 Quick Entry Guide, version 4.0, FEB 2025, sections 2 and 3
Three dead ends account for most help-desk tickets, and SPRS's FAQ names each. No “Add New” button: the Cyber Vendor User role is not active. A CAGE missing from the list: SAM has the wrong immediate or highest-level owner for it, and a fix in SAM typically reaches SPRS within 48 hours. Buttons that will not draw: an old browser, since SPRS names Chrome, Edge and Firefox as the ones it supports.
Entering a NIST SP 800-171 Basic Assessment
This is the entry most shops mean by “our SPRS score”. The 7019 clause still describes sending the summary by email for posting; SPRS's Quick Entry Guide has a Cyber Vendor User type the same details into the NIST tab instead.
- 01In Cyber Reports, open the “NIST SP 800-171 Assessments” tab and choose “Add New Assessment”.
- 02Fill the “Enter Assessment Details” form: date, score, scope, plan of action completion date, the SSP's name, version and date, and the included CAGE codes.
The guide's own note: finish the assessment and the SSP before you enter anything.
- 03Choose “Save”. SPRS assigns a DoD Unique Identifier at once, a 10-character code that starts SB for a Basic.
- 04To correct it later, use the pencil icon on the record in the “Basic” tab and save again.
Basic is the only confidence level a vendor can add, edit or delete. Medium and High records are DoD's.
NIST SP 800-171 Quick Entry Guide, version 4.0, MAY 2024, sections 3.2 to 3.4
The clause and the form do not use the same words, so here is how they line up. Where the form has no field for a clause item, the right-hand column gives our reading, not SPRS's.
| 7019 (d)(1)(i) | What the clause asks | Where it goes in SPRS |
|---|---|---|
| (A) | Cybersecurity standard assessed | Not a field: you are in the NIST SP 800-171 Assessments tab |
| (B) | Organization conducting the assessment | Not a field: a vendor's own entry is a Basic (contractor self-assessment) |
| (C)(1) | Every CAGE code the plan's systems cover | “Included CAGE(s)”, typed comma-separated or picked with “Open CAGE Hierarchy” |
| (C) | The system security plan (requirement 3.12.4) | “System Security Plan (SSP) Assessed”, “SSP Version/Revision”, “SSP Date” |
| (C)(2) | A short description of each plan's architecture, if more than one | No field on the form: one record per plan, each with its own CAGEs |
| (D) | Date the assessment was completed | “Assessment Date” |
| (E) | Summary level score, e.g. 95 out of 110 | “Assessment Score” |
| (F) | Date a score of 110 is expected, from your plan(s) of action | “Plan of Action Completion Date” |
The one field the clause does not mention is “Assessing Scope”. SPRS's FAQ defines its three choices:
- Enterprise
- “Entire company's network is under the CAGEs listed”
- Enclave
- “Standalone under Enterprise CAGE as business unit (test enclave, hosted resources, etc.)”
- Contract
- “Contract specific SSP review”
Entering a CMMC Level 1 (Self) assessment
A Level 1 entry is short because the rule makes the result binary. You assess the 15 FAR 52.204-21 requirements yourself (the Level 1 checklist walks them), then record the outcome:
- 01In Cyber Reports, open the “CMMC Assessments” tab and choose “Add New Level 1 CMMC Self-Assessment”.
- 02Enter the “Assessment Date” and the “Assessing Scope”: Enterprise for the whole company, Enclave for a set of systems inside one security perimeter.
- 03Answer the two questions: how many employees the assessment covers, and whether you are compliant with each of the security requirements in FAR 52.204-21 (“Yes” or “No”).
That one answer is the whole result. Level 1 is met or not met in its entirety; there is no score and no plan of action.
- 04Add the “Included CAGE(s)”, typed comma-separated or picked from “Open CAGE Hierarchy”.
- 05Choose “Continue to Affirmation”. If you are not the Affirming Official, enter their email and choose “Transfer to AO”.
Or “Save” and come back: a saved record shows as “Incomplete” and gets no CMMC UID until it is affirmed.
CMMC Level 1 Quick Entry Guide, version 4.0, DEC 2024; Level 1 Entry Tutorial
Once the Affirming Official affirms, the answer decides the record. “Yes” becomes a “Final Level 1 Self-Assessment” and gets its CMMC UID. “No” becomes “No CMMC Status”, shown in red. Only the Final record is visible to Government personnel, and it turns into “No CMMC Status (Expired Assessment)” after one year, so the assessment and the affirmation come round every year.
Mistakes are fixed by starting again. Only “Incomplete” and “Pending Affirmation” records can be edited; a Final or a No CMMC Status record has to be deleted and re-entered, and a delete removes it for every CAGE it included.
Entering a CMMC Level 2 (Self) assessment
A Level 2 (Self) entry is not a typed-in number. SPRS asks for the status of every requirement and works out the score itself, which is why a shop that has only ever posted a Basic score should expect a much longer sitting.
- 01On the “CMMC Level 2 (Self)” tab choose “Add New Level 2 CMMC Self-Assessment”, read the statement and “Acknowledge”.
- 02Work through the requirement families in the stepper. For each requirement pick “Met”, “Not Met” or “N/A”; the “Requirement Objectives” button shows the objectives behind it.
Multifactor authentication (IA.L2-3.5.3) and FIPS-validated encryption (SC.L2-3.13.11) open their objectives, because they can earn partial credit.
- 03Use “Save and Continue” to move family to family.
Jumping to a family by clicking the stepper does not save the one you were on.
- 04On the review step, every requirement must have an answer; a red line names the ones that do not.
- 05Add the “Assessing Scope”, “Employee Count” and “Included CAGE(s)”, then “Save and Continue”. SPRS computes the score and the status.
- 06If the result can be affirmed, “Continue to Affirmation” appears. Affirm it yourself if you are the Affirming Official, or use “Transfer to AO”.
CMMC Level 2 Quick Entry Guide, version 4.0, FEB 2025; Level 2 Self-Assessment Tutorial
SPRS will only let two results through to affirmation: a score of 88 to 109, which becomes a Conditional status, or 110, which becomes Final. Anything lower can be saved and finished later. The guide adds a trap that catches good scores: if a requirement that may not go on a plan of action is Not Met, the record is “No CMMC Status” whatever the score. The SSP requirement (CA.L2-3.12.4) is on that list, with five others named in the POA&M guide.
A Conditional record lasts 180 days, the window to close the plan of action out. A Final one lasts three years, provided it is affirmed every year. Until it is Final you can still edit the record; a Final record cannot be edited, only cancelled, and it then shows as “(Retracted by Vendor)”.
The Affirming Official and the yearly affirmation
A CMMC entry is not finished when it is saved. It counts only once your company's Affirming Official affirms it, and the rule decides who that can be:
An Affirming Official, a senior representative of the company, affirms in SPRS after every assessment, after a POA&M closeout, and annually after a Final status. DFARS 252.204-7021 asks for the affirmation for each CMMC UID and holds it current only while it is not older than one year.
In SPRS terms the Affirming Official needs their own PIEE account with the SPRS Cyber Vendor User role. Their name, title and email come from that PIEE profile and cannot be changed on the SPRS screen. The transfer email is a courtesy: an Affirming Official who never got it logs in, opens Cyber Reports and finds the record in “Pending Affirmation” (the pencil icon for Level 1, the “Affirm” button for Level 2). The last screen shows this statement above the certify box:
The yearly affirmation happens on the same record. For a Level 2 record the “Affirm” button moves to the “Affirmation Expiration Date” column when the annual one is due; SPRS's Affirming Official tutorial says that for C3PAO and DIBCAC records it appears 60 days before each annual affirmation expires. Level 1 works on a shorter loop: the Final record expires after one year, and a Level 1 self-assessment is repeated every year, with results and an affirmation in SPRS.
The CMMC UID and what the contracting officer checks
A CMMC UID is 10 alpha-numeric characters assigned to each CMMC assessment and reflected in SPRS for each contractor information system. Under 7021 you hand the contracting officer the UIDs for the systems that will hold FCI or CUI on the contract, and tell them when a UID changes. The NIST record has an identifier too, and the two are easy to mix up:
| Detail | DoD Unique Identifier | CMMC UID |
|---|---|---|
| Record | NIST SP 800-171 Basic, Medium or High | CMMC Level 1 or 2 (Self), Level 2 (C3PAO), Level 3 (DIBCAC) |
| Assigned | As soon as the entry is saved | When the Affirming Official affirms |
| Looks like | 10 characters; SB, SM or SH first | 10 alpha-numeric characters |
| Who asks for it | No clause names it; 7019 looks for the posted score | The contracting officer, by name, under 7021(e)(1) |
The UID is what the check runs on. Contracting officers must check SPRS and not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status posted in SPRS at the CMMC level required by the solicitation, or higher, for each CMMC UID; the same check comes before an option or an extension. SPRS's FAQ adds that a contracting officer cannot search SPRS by CAGE at all: they verify with the UID you gave them.
C3PAO and DIBCAC results arrive through eMASS
You never type in a third-party result. C3PAO and DIBCAC results go into the CMMC instance of eMASS, which passes them to SPRS. The record then appears on the “CMMC Level 2 (C3PAO)” or “CMMC Level 3 (DIBCAC)” tab, and your part is the same as for a self-assessment: the Affirming Official affirms it once SPRS receives it, and every year after.
When a C3PAO says it has submitted and nothing shows in SPRS, SPRS's FAQ points at one cause: a CAGE code the assessor reported is not in your SAM hierarchy. Compare the C3PAO's list with SAM and have the EB POC fix whichever side is wrong. A third-party result also brings a document a self-assessment never does: the CMMC Status is presented on a Certificate of CMMC Status only if the assessment was conducted by a C3PAO or DCMA DIBCAC.
Whether a contract can ask for a C3PAO assessment today is in the status box at the top of this page. Required is not the same as available: The Cyber AB said on 2026-07-15 that only the Phase 2 requirements were suspended and that C3PAO Level 2 certification assessments remain available. The class deviation is silent on voluntary assessments, so ask the C3PAO what it is booking now and what status it will enter in eMASS. What a C3PAO is, and how its assessment runs, is in what is a C3PAO and how to get CMMC certified.
What Class Deviation 2026-O0025 changes
Under the deviation, 252.240-7997 (FEB 2026) replaces 7020: the Government's Medium and High assessments use the 32 CFR 170.24 scoring, and the self-assessment route is CMMC Level 1 or 2 (Self) under 7021. Contracts already awarded keep the clause versions they carry.
In SPRS terms, the contractor's own entry on a new contract is the one 7021 describes:
So the four entries above split by contract date. A contract or PO carrying 7019 and 7020 (NOV 2023) still looks for the Basic score on the NIST tab. One written under the deviation looks for a CMMC Level 1 or Level 2 (Self) record, affirmed, and its UID. SPRS's guides predate the deviation and none of the SPRS pages we read mentions 252.240-7997: as far as they show, the deviation changes which tab a contract sends you to, not how the entry is made.
Questions shops ask about SPRS entry
Is the SPRS login the same as our SAM.gov login?
No. SPRS is reached only through PIEE, which has its own registration. SAM comes first because PIEE copies your EB POC and address from it, but a SAM account does not open SPRS.
Do we need a CAC or a PKI certificate?
SPRS's access page says a PKI certificate is not required for suppliers and vendors. PIEE asks you to pick an authentication method during registration; take the choices it offers on the day.
Can our IT provider enter the score for us?
The sources we read do not address outside firms. What they do say: PIEE logins are individual, a role is approved by your CAM, and a CMMC entry counts only when your Affirming Official, a senior person inside your company, affirms it. Whoever types, that sign-off stays with you.
We have two plants with two CAGE codes. One entry or two?
For a NIST Basic score, one record per system security plan, listing every CAGE code that plan covers (the 7019 clause asks for exactly that).
For a CMMC record, list every CAGE in the assessment's scope. SPRS's FAQ adds that CAGE codes there are for metrics and access control: what defines the assessment is the scope behind the CMMC UID.
Can we delete an old or wrong record?
A Basic NIST record, yes: vendors can add, edit and delete Basic records. A Level 1 CMMC record can be deleted unless it has already expired, and the delete removes it for every CAGE it included. A Final Level 2 (Self) record is cancelled rather than deleted and shows as retracted.
Who can see our score?
Your company sees its own records, controlled through your CAM. SPRS's FAQ says cyber scores are treated as CUI for federal employees. For CMMC records, Government users see affirmed Conditional and Final records only, never an incomplete or pending one.