Movegistics home pageResources

Resources / Free tools / Posting in SPRS

How to post your Level 2 self-assessment in SPRS

Your self-assessment counts once it is in SPRS, the Department's Supplier Performance Risk System, and your Affirming Official has affirmed it. Here is the path, taken from the official SPRS guides and a Johns Hopkins APL supplier briefing on SPRS (25 August 2026).

This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.

Facts last checked: .

Screens change. Keep the official SPRS Quick Entry Guide open as you go. Where it and this page differ, follow the guide.

Before you start

  • Start the SAM and PIEE steps early, even before your self-assessment is finished: access can take several business days.
  • Your self-assessment is done and your System Security Plan is current.
  • Your company is registered in SAM.gov, with a CAGE code and an Electronic Business point of contact.
  • Your CAGE code has at least one Contractor Account Administrator (CAM) in PIEE, the system you sign in through.
  • You know who your Affirming Official is: the senior person responsible for your CMMC compliance, with the authority to affirm it.

Sources: SPRS: access instructions, 32 CFR 170.22, 32 CFR 170.24, IAM: What You Need to Do for CMMC, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026

  1. Get into PIEE with the right role

    • SPRS is reached through PIEE. If you already have a PIEE account, sign in and add the SPRS role. If not, register in PIEE and ask for SPRS access as you register.
    • Ask for the “SPRS Cyber Vendor User” role. It lets you add, edit and affirm cybersecurity assessments.
    • Your CAM approves the request. A CAM cannot approve their own role; if that is a problem, ask PIEE support.
    • Your Affirming Official needs the same role to affirm.
    • The SPRS tile can appear before the role is active. To check, open My Account, then Manage Roles. Suppliers do not need a PKI certificate.

    Sources: SPRS: access instructions, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026

  2. Enter your self-assessment

    • In PIEE, open SPRS and choose “Cyber Reports (CMMC & NIST)”. Pick your company hierarchy and choose “Run Cyber Reports”.
    • On the “CMMC Assessments” tab, open “CMMC Level 2 (Self)” and choose “Add New Level 2 CMMC Self-Assessment”.
    • Answer every requirement, family by family. The “Requirement Objectives” button shows what each one checks; “Save and Continue” moves you on.
    • Add the details: your assessing scope, your employee count and the CAGE codes your scope covers. CAGE codes come from SAM, and you can only add codes in your own company's hierarchy.
    • Make sure your company's CAGE hierarchy in SAM is right before you start: if it is wrong, you may not be able to pick all your CAGE codes, and your Affirming Official may not see the assessment.
    • Check the CAGE codes carefully: new ones cannot be added after the assessment is affirmed.

    Sources: SPRS CMMC Level 2 Self-Assessment Quick Entry Guide, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026

  3. Affirm it

    • Only a Conditional result (a score of 88 to 109) or a Final result (110) can be affirmed. If an open gap is one that cannot wait on a plan of action, SPRS shows “No CMMC Status”, whatever the score.
    • If you are not the Affirming Official, enter their email address and choose “Transfer to AO”. They review the details, confirm the affirmation statement and choose “Affirm”.
    • They are attesting that your company has put every applicable requirement in place, and will keep it in place, for everything in your scope.
    • The Johns Hopkins APL supplier briefing on SPRS (25 August 2026) notes that the False Claims Act applies to the affirmation. Affirm only what is true and backed by evidence.
    • Contracting officers see the record only after the first affirmation.
    • SPRS gives your assessment a CMMC Unique Identifier (UID). For Level 1, IAM says DP3 TSPs had to send the UID, with evidence of the affirmation, to TRANSCOM's quality office, and it expects the same for Level 2. Check IAM's CMMC Resource Center for the current address.

    Sources: SPRS CMMC Level 2 Self-Assessment Quick Entry Guide, 32 CFR 170.22, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026, IAM CMMC Resource Center

  4. Keep it current

    • Conditional status: close the open gaps, post a closeout self-assessment within 180 days, and affirm again. Otherwise the conditional status expires.
    • Final status: affirm every year, and do a new self-assessment at least every three years, both counted from your CMMC Status Date.
    • Keep the dates in the workbook's SPRS dates sheet, and your evidence for six years from your CMMC Status Date.

    Sources: 32 CFR 170.16, 32 CFR 170.22, 32 CFR 170.4, SPRS CMMC Level 2 Self-Assessment Quick Entry Guide

Where to get help

This page is general information, not legal or compliance advice; see the disclaimer. Back to free tools.