Getting access to SPRS
To get access to SPRS, you need a PIEE account.
To get a PIEE account, you need a CAGE code, or Unique Entity ID, from sam.gov
If you are starting from scratch, start by registering your company as a Federal Contractor on sam.gov.
If your company is already registered, find out who did the registration, that information may be important.
Next, register for an account on PIEE.
If your company is already registered on PIEE, it is very helpful to reach out to the person who originally registered it.
For official instructions, see the following sources:
You need to keep working with the PIEE Helpdesk until you see the SPRS icon on your screen when you log on. After that, for SPRS-specific questions, the helpdesk number is 207-438-1690.
PIEE Helpdesk: +1 866-618-5988. The menu options that worked for us were 2 – Vendor user, 1 -Account Activations, 3 – Account activation technical support.
Steps to Submit directly to SPRS using an account on PIEE
If you submit directly to your own account in SPRS, you will be able to avoid delays on the DoD side as they try to manually move thousands of assessments into SPRS.
Navigate your web browser to Procurement Integrated Enterprise Environment (PIEE)
If you already have an account for PIEE, you can skip the below registration steps. Log on and add the SPRS Cyber Vendor User role. ComplyUP has provided steps for existing accounts here.
If you don’t have an account yet, click on Register button (top right)
Accept (or don’t) the Privacy Act Statement and Terms and Conditions
Pick Vendor (the other options seem to be for PIEE administrators like contract officers)
If you have a Common Access Card or certificate, feel free to choose those. For most people, just enter the username and password you prefer.
Enter security questions…
Enter your name and contact information. This will be reviewed as part of your submission, so make sure it matches reality. I expect that it helps if your Organization matches the CAGE code you enter later.
Enter quality information for the Company fields. Supervisor is not required, though it might be helpful when your submission is reviewed.
This next bit is the tricky part.
ADD A ROLE
A) First registration in PIEE??
If you are the first person in your company to register a PIEE account, you need to set up a Contract Administrator first.
In Step 1, click the down-arrow and select PIEE. Then select the Contract Administrator role. At the bottom, click Group Lookup and type your CAGE code in, then click the Location button to look it up and accept the results. If the system does not find your CAGE code, call the PIEE helpdesk.
You should see your CAGE code displayed next to Contract Administrator role. Click Next.
Skip the Cyber vendor steps below and go straight to JUSTIFICATION.
Note, once you get your account activated, you will need to return to your account settings and add the SPRS Cyber Vendor role using the steps below.
B) Cyber Vendor Role – if your company already has an account.
In Step 1, click the down-arrow and select SPRS – Supplier Performance Risk System
In step 2, pick SPRS Cyber Vendor User
In step 3, click +Add Roles . A line will appear at the bottom with a Location Code* field. Enter the CAGE code for your organization (this should match the CAGE code associated with the contract that you are submitting for)
Update: If your CAGE code is not recognized, review the steps in this PIEE step-by-step instruction page. Most companies need to perform Step 3 (and later steps) if the message “There are no Contractor Administrators in the system for the Location Code” displays.
Your Contractor Administrator has to approve for SPRS to display
The next step is your Contractor Administrator for the CAGE Code will need to approve your role.
If you are a larger business, you can look this person up by going to the PIEE Find Government / Contractor Account Administrator page. You ONLY need to fill out the location code with your CAGE. Leave the other filters empty.
If you are the only person with a PIEE account at your business, try waiting an hour or two (business hours only). The helpdesk should approve your account, assuming your justification makes sense. If it takes longer, then you should call the PIEE helpdesk at +1 866-618-5988. The menu options that worked for us were 2 – Vendor user, 1 -Account Activations, 3 – Account activation technical support.
A quick conversation with the PIEE helpdesk and identification of the account and CAGE code got us approved. The SPRS icon will now display when we log on to PIEE.
If you have multiple CAGE Codes related to DoD contracts, repeat Step 3 +Add Roles to add additional lines and enter the CAGE codes.
Enter justification for an account. Attachments would be used for justification and/or identification purposes. Do not attach your self assessment here.
Registration Summary displays.
Now that I have access to SPRS, how do I submit my self-assessment?
This NIST SP 800-171 Quick Entry Guide from SPRS has instructions to submit the assessment.
I can’t create an SPRS account. Now what?
In some cases, you won’t be able to create an SPRS account. It seems to be highly dependent upon your organization’s CAGE code and whether that CAGE code has been registered in use on a DoD contract before.
If your CAGE code is not recognized, review the steps in this PIEE step-by-step instruction page. Most companies need to perform Step 3 (and later steps) if the message “There are no Contractor Administrators in the system for the Location Code” displays.
The alternative method is to submit your self-assessment to the firstname.lastname@example.org email address. Your submission should be sent via an encrypted email. How do you do this?
Do we need to submit our System Security Plan or POA&M?
At this point, there seems to be broad agreement that no documents need to be submitted with your self-assessment. The DoD only wants the exact information that is specified in the DFARS 252.204-7019 and 7020 rules (see picture at top of page).
How are multiple CAGE codes or multiple contracts handled?
Vince Scott from Defense CyberSecurity Group sent the following:
Q: If multiple CAGE codes or multiple contracts use the same information system, how do we explain this in the submission?
“(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the Offeror shall use the following format for the report:
Since this allows for “cage code supported” I would use this format for multiple plans or multiple cage codes, from an email submission perspective. I am planning to enter ours into SPRS this week, so I will let you know how that goes.
This format below may be better. Please comment if you know more.
Can subcontractors get access to SPRS, or only primes? Are primes supposed to submit on behalf of subcontractors?
It appears that subcontractors can get access to SPRS and can submit their own self-assessments.
What if my organization’s score is below 110?
You are in good company. Unless you have full time cybersecurity professionals on-staff and dedicated to compliance, your score is probably between -1 and -100. Go ahead and submit the true score.
Then start fixing your environment, update your system security plan, perform another assessment, and upload your improved score to SPRS. You can keep adding new self-assessments over time until you reach 110.
Should clouds used to store, process, or transmit CUI be included in the self-assessment?
Because NIST SP 800-171 only applies to internal contractor networks, and the DoD self-assessment asks for NIST SP 800-171 rather than the overall DFARS 252.204-7012 rule, some people may interpret their cloud as being out of scope.
This is incorrect. According to the DoD Acquisition Cyber FAQs, not only is the DoD expecting your cloud to be authorized at FedRAMP moderate or equivalent, but you are still responsible for some secure configurations. Examples: Managing user accounts and roles. Enforcing strong passwords and lockout settings. Verifying your personnel are screened. For more information, see our blog about CMMC, CUI, and Cloud Vendors – do you need FedRAMP?
Q127: How will Software as a Service solutions be scored with the NIST SP 800-171 DoD Assessment? For example: Integration with Office 365, which holds a FedRAMP moderate certificate, may create an issue as the vendor will not share specific details with clients.
A127: For cloud-based solutions (e.g., SaaS, Office 365), if authorized at FedRAMP moderate or equivalent, the solutions are assumed to meet NIST SP 800-171 requirements. However, typically certain configuration settings remain the responsibility of the subscriber/client, and when they are related to specific NIST SP 800-171 requirements, they are subject to assessment and scoring.
More answers to be added over time. Please comment or email us if you have any tips or guidance!
Remaining questions about submitting a self-assessment
- If we manage to send an encrypted email correctly, how long will it take for it to be posted into SPRS?
Please subscribe to our newsletter for useful information about CMMC and DFARS compliance and becoming a professional in this space. Please send me a connection on LinkedIn for community discussions about the CMMC and 800-171.
V. Amira Armond (CISSP, CISA, PMP, MBA) is a computer systems architect, cyber-security consultant, and owner of Kieri Solutions LLC. Kieri Solutions specializes in CMMC preparation and DFARS 252.204-7012 compliance, and designing secure and resilient enterprise systems for private sector and the DoD. Amira is the chief editor for cmmcaudit.org, a public resource for news and informational articles about the Cybersecurity Maturity Model Certification.