How to submit your SPRS score, step by step

Your SPRS entry is what contracting officers and primes check before awarding work. The obligation attaches when your contract carries the CMMC clause (DFARS 252.204-7021) - not automatically to every contract with FAR 52.204-21 in it. Since November 2025, that clause has been phasing into DoD solicitations, so if you're bidding new work, assume it's coming. Check your contract for the clause; if it's there, no current entry increasingly means no award.

This guide covers the Level 1 submission end to end, based on the official SPRS quick entry guides and DISA's Affirming Official tutorial. It's more clicking than thinking - the thinking should already be done, which is the first point below.

Rule zero: don't submit until it's true

Not certain every requirement is genuinely met yet? Better to find out now than at the affirmation screen - the free 5-question check gives you a quick read in about three minutes, no email to start.

What to gather before logging in anywhere

Access problems cause more submission delays than the submission itself. Line these up first:

1. A current SAM registration. Your company hierarchy and CAGE codes flow into SPRS from SAM. If SAM has lapsed, renew it now - that takes days, not minutes. The timing matters differently depending on how you hold the work: if you're a subcontractor, the flow-down from your prime sets the pace, and your prime may check your status along the way. If you contract directly as a prime, SAM isn't just lead time - it's a hard eligibility gate, since no award is possible without an active registration and CAGE code.
2. Your CAGE code. Five characters, on your SAM record.
3. Your scope. SPRS asks Enterprise (the whole company) or Enclave (a defined subset). Most small shops are honestly Enterprise: one building, one network.
4. Your Affirming Official. A senior official with authority to represent the company - typically the owner. They personally certify the affirmation, so they should have read the assessment, not just heard it went fine.
5. Your assessment date. The date the self-assessment was completed with all 15 requirements met.

Step 1: PIEE account with the SPRS Cyber Vendor User role

SPRS lives inside the Procurement Integrated Enterprise Environment at piee.eb.mil. If you invoice DoD through WAWF, you already have PIEE - you may just need the role added. New users register through the vendor flow, which verifies against your SAM/CAGE record.

Either way, the role that matters is SPRS Cyber Vendor User - without it, the buttons in the next section literally don't appear. DISA's access instructions are here. Your Affirming Official needs a PIEE account with the same role. Start this a week before you need to submit; role approval is the slow part.

Step 2: Enter the Level 1 self-assessment

1. Log in at piee.eb.mil and open SPRS.
2. Choose Cyber Reports (CMMC & NIST).
3. Select your CAGE and hierarchy from the dropdown - an asterisk next to your CAGE confirms you have the Cyber Vendor User role - and click Run Cyber Reports.
4. Open the CMMC Assessments tab and acknowledge the pop-up.
5. Click Add New Level 1 CMMC Self-Assessment. No button means no role - back to Step 1.
6. Enter the assessment date, scope, included CAGE code(s), and the compliance result. The CAGE hierarchy is imported from SAM and can't be edited here.
7. Select Continue to Affirmation.

Step 3: The affirmation

If you're the Affirming Official, continue straight into the flow. If not, hand the record off - the AO logs in, finds the entry in the CMMC Assessments tab with status Pending Affirmation, and opens it with the pencil icon in the Edit column. (No pencil icon means the AO's account is missing the Cyber Vendor User role.) The AO reviews the entry, verifies their identity details - which pull from PIEE registration and can only be corrected there - reads the affirmation statement, checks the certification box, and clicks Affirm.

The record then shows an affirmed Level 1 self-assessment with a CMMC unique identifier. That's what your primes can verify, and it's the thing to have ready before they ask.

After you submit

• It's valid for one year. The affirmation renews annually - put the reminder on the calendar at eleven months, today.
• Keep your evidence for six years from the status date: account lists, MFA screenshots, visitor logs, sanitization records, patch logs. If the DoD or a prime ever asks, the folder is the answer.
• Re-affirm honestly. Next year's renewal is the same legal statement. If systems changed or habits lapsed, re-assess before re-affirming.
• If CUI or DFARS 252.204-7012 enters the picture, stop - that's Level 2, a different assessment with a scored result, and a Level 1 affirmation doesn't cover it.

For access and portal problems, the PIEE help desk (contact info on piee.eb.mil) is the right door, and the official quick entry guides at sprs.csd.disa.mil stay current as screens change. The submission itself is an afternoon. Being genuinely ready to make it is the real work - and it's very doable for a small shop.