How to enter your CMMC Level 1 self-assessment in SPRS
These steps follow the SPRS program office's CMMC Level 1 Self-Assessment Quick Entry Guide, Version 4.0, which we checked against the copy posted on the SPRS website on Nov. 1, 2026.
Finish the self-assessment before you open SPRS. SPRS only records the result. The DoD CIO's CMMC Assessment Guide, Level 1, explains how to test your company against the 15 requirements in FAR 52.204-21.
Before you sign in
A PIEE role request waits on your company's administrator or the PIEE help desk and can take days, so start well before an award is due.
- An active registration at SAM.gov and your CAGE code. SPRS copies your CAGE hierarchy from SAM, so if a location is missing, fix it in SAM first.
- A PIEE account at piee.eb.mil with the SPRS application and the SPRS Cyber Vendor User role. That role lets you add, edit and affirm assessments.
- Approval from your company's Contractor Administrator (CAM) in PIEE. A CAM cannot approve their own role request, so if you are your company's only CAM, the PIEE help desk activates it.
- A second PIEE account, with the same role, for your Affirming Official. The affirmation has to come from their own login.
Have these ready
- The assessment date, which is the day you finished the self-assessment
- The scope you assessed and the number of employees it covers (our Level 1 scoping guide covers both)
- Every CAGE code the assessment covers
- The Affirming Official's name, title and email address
Entering and affirming the assessment
SPRS changes between releases. If a screen does not match a step here, follow the current guide on the SPRS CMMC page.
- Request the role. New users register at piee.eb.mil as a vendor. If you already have an account, add a role from your account settings. Choose SPRS, then SPRS Cyber Vendor User, and enter your CAGE code as the location code. Repeat for each CAGE code. Then wait for your CAM to approve it.
- Open Cyber Reports. Sign in at piee.eb.mil, select SPRS, then Cyber Reports. Pick your company hierarchy, which is listed under its highest level owner (HLO). An asterisk next to a CAGE code means your role lets you add and edit for it.
- Start a CMMC entry. CMMC assessments have their own tab, apart from NIST SP 800-171 assessments. On the CMMC tab, choose the option to add a new CMMC Level 1 self-assessment. The button wording has varied between releases.
- Enter the details. SPRS asks for the assessment date, the assessing scope (the guide's samples show ENTERPRISE and ENCLAVE), the number of employees covered, a yes or no for whether you comply with the FAR 52.204-21 requirements, the CAGE codes covered and the Affirming Official's name, title and email. Answer yes only if every requirement came out MET or NOT APPLICABLE in your self-assessment. Check the CAGE codes carefully, because SPRS will not let you add any after the assessment is affirmed. You can save and come back later.
- Send it to your Affirming Official. If you are the Affirming Official, go straight to the next step. Otherwise transfer the record to the Affirming Official's email, and SPRS notifies them.
- Affirm. The Affirming Official signs in with their own account, opens the assessment and reviews the status, the unique identifier, the dates, the scope, the employee count and the CAGE codes. The affirmation statement attests that the systems in scope comply with the CMMC requirements in 32 CFR 170 and warns that a misrepresentation can bring prosecution under 18 U.S.C. 1001 and liability under the False Claims Act. They check the box and affirm.
- Check the record. It should now read Final Level 1 Self-Assessment, with an expiration date one year after the assessment date. Write down the unique identifier, which is your CMMC UID. Put it in your proposal when a solicitation includes DFARS 252.204-7025. Give it to the contracting officer under a contract with DFARS 252.204-7021. If you are a subcontractor, your prime may ask for it too. Government users can see only Final records.
Doing it again every year
A Level 1 status expires one year after the assessment date, and SPRS then shows No CMMC Status (Expired Assessment). From then on your company is not eligible for an award that requires Level 1. Before that date, redo the self-assessment against how the company runs now, enter it and have the Affirming Official affirm it again (32 CFR 170.15 and 170.22).
The CMMC Scoping Guide, Level 1, requires a new assessment sooner after significant architectural or boundary changes, such as expanding your network or a merger or acquisition. Adding or removing equipment inside the boundary you already assessed is covered by the annual affirmation. The affirmation says the company stays compliant, so a change that breaks a requirement needs a fix before you affirm again.
SPRS questions
Does CMMC Level 1 have an SPRS score?
No. The CMMC Assessment Guide, Level 1, scores each requirement MET, NOT MET or NOT APPLICABLE, and you can post a final Level 1 self-assessment only when none of the 15 is NOT MET. The 110-point SPRS score comes from NIST SP 800-171, which is Level 2. If a prime asks for your score, give them your CMMC Level 1 (Self) status, the date you posted it and your CMMC UID.
Can we post Level 1 with a plan to fix gaps later?
No. Level 1 does not allow a plan of action and milestones (POA&M). Fix the gaps, then enter the assessment and affirm it.
Who can be the Affirming Official?
A senior official of your own company who is responsible for meeting the requirements, such as an owner or officer. An outside IT provider can do most of the work but cannot affirm for you.
Does it cost anything to post in SPRS?
No. PIEE and SPRS are free to use.
Which official documents cover this?
32 CFR Part 170 is the CMMC program rule. FAR 52.204-21 lists the 15 requirements. The DoD CIO publishes the CMMC Scoping Guide, Level 1, and the CMMC Assessment Guide, Level 1, on its CMMC documentation page. The SPRS program office publishes the CMMC Level 1 Self-Assessment Quick Entry Guide, which these steps follow.
Sources: the CMMC Level 1 Self-Assessment Quick Entry Guide, Version 4.0, and the SPRS access instructions, both from the SPRS program office; the DoD CIO's CMMC documentation page, which has the CMMC Scoping Guide, Level 1, and the CMMC Assessment Guide, Level 1 (both Version 2.13, September 2024); 32 CFR Part 170; and FAR 52.204-21. Checked Nov. 1, 2026. This page summarizes public guidance and is not legal advice.
Templates for the self-assessment
The self-assessment takes most of the time: reading each requirement, deciding what it means for your shop and writing down what you do.
You can do all of that from the DoD guides. If you would rather start from a draft, the CMMC Level 1 Policy Kit has seven Word policy templates covering all 15 requirements, a self-assessment workbook, an evidence checklist, a records workbook and this walkthrough as a fill-in document. It costs $99, and the templates guide you through the process but do not guarantee compliance.
The templates are Word and Excel files you download right after you pay.
Get the kit for $99.00