Entering CMMC results and affirmations in SPRS

The entry can be wrong even when the score is right, because the assessment has to name every CAGE code in scope. Under 32 CFR 170.15 and 170.16, the SPRS record must list all CAGE codes covered by the assessment. A subsidiary, division or facility that handles FCI or CUI but is missing from the entry leaves the record incomplete for that business unit. Check the scope statement against your contract list, your CAGE code registrations and the systems that process controlled information. Confirm the list with your contracts team before each posting, and record who approved it.

No. A requirement counts as MET only when every applicable assessment objective is satisfied with evidence in final form, not drafts. The assessment methodology in NIST SP 800-171A is the reference for those objectives, and 32 CFR 170.16, 170.17 and 170.24(b) apply the final-form rule. To check a score, pick a sample of MET requirements and confirm each has a signed or approved document, a dated log or screenshot from the system, and an owner who can explain it. Any requirement that fails that test should be scored NOT MET and, where the rules allow, placed on a POA&M.

Because the UID list in a proposal is a point-in-time record, and SPRS issues new UIDs as results are entered. DFARS 252.204-7025(d) requires offerors to list the CMMC UIDs for each system that will handle FCI or CUI and to update that list when new UIDs are generated. Before submitting an offer, compare each system name and scope against the current SPRS record. After award, repeat the comparison whenever a new assessment is entered, a system is added or retired, or a contract is amended.

The status date is the date the results were submitted to SPRS or to the CMMC instance of eMASS, as defined in 32 CFR 170.4. Pull the record from SPRS and compare its status date with the date in your own assessment file. If a Conditional status later becomes Final, the Final status keeps the Conditional date, so do not replace the original date when you update the record. A mismatch usually means a result was reposted from an old file or a new assessment was entered without retiring the earlier one. Keep one authoritative assessment file per scope and log every submission with its date and submitter.

It can, because an affirmation and a self-assessment describe the environment as it was assessed. A new cloud tenancy, a migrated identity provider, a changed network boundary or a new subcontractor handling CUI can change the scope or the results. Treat each material change as a trigger for review: confirm whether the system boundary, CAGE scope or requirement results have changed, and update the SPRS entry and affirmation if they have. Ask your Affirming Official to review the change log before the next annual affirmation, and ask your implementation partner to document the review.

The organization owns its SPRS entries, its scope and its affirmations. An implementation partner can prepare the system records, the evidence files and a reconciliation checklist, and can walk your team through the comparison, but it cannot post results on your behalf as the assessor. Only an independent assessor or certification body issues reports or certificates. Cost depends on how much preparation your environment needs, how many CAGE codes and systems are in scope, and how often you update the record. Ask any provider to scope the reconciliation work in writing before it starts.

A reconciliation compares four records: the SPRS entry, the assessment file, the proposal UID list and the contract clause obligations. Start by listing every CAGE code and system in scope, then match each one to a current SPRS entry with the same level, status date and score. Next, sample MET requirements and confirm final-form evidence exists. Finally, check that the UID list in open proposals and contract reports matches what SPRS shows. Record the date, the reviewer and any corrections. Repeat the check before each posting and after any material change.

Yes, for self-assessments. The organization enters its own Level 1 and Level 2 self-assessment results in SPRS and is responsible for the accuracy of what it submits. A Level 2 entry carries the CMMC level, status date, assessment scope, every CAGE code in scope, the overall score and any POA&M usage. Level 2 certification results follow a different path: a C3PAO uploads them into the CMMC instance of eMASS, which transmits them to SPRS. An implementation partner can prepare systems and evidence, but it does not submit results or issue findings. Confirm with your senior official who will sign and submit before entry begins.

The effort depends on how much evidence already exists and how large the scope is. The Level 2 model has 110 requirements, and each one is scored against the assessment objectives in NIST SP 800-171A. A requirement counts as MET only when all applicable objectives are satisfied with evidence in final form, not drafts. The main drivers are the number of systems that handle CUI, the number of CAGE codes in scope, the completeness of your system security plan, and how many requirements sit on a POA&M. Ask any quote to show whether it covers evidence review, scoring and the SPRS entry itself.

Enter results early enough that the status date and UIDs are settled before you submit the proposal. Under DFARS 252.204-7025, offerors list the CMMC UIDs that SPRS issues for each system that handles FCI or CUI, and SPRS issues those UIDs after results are entered. If a new UID is generated later, the list in the proposal must be updated. Read the solicitation to confirm the required level, then work backward from the submission date. Ask the contracting officer how the agency will treat a status date that changes during evaluation.

Yes. A partner can prepare systems, configurations, logs, policies and records so your team can make the entry with confidence. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. DeployOpen does not issue audit reports, attestations or certifications, and it does not make the affirmation for you. Your organization still owns each control and its status. Keep a written record of who reviewed each requirement and which evidence supports it.

Ask for a written statement of scope, deliverables and responsibilities before any work starts. The statement should cover:

• Which of the 110 Level 2 requirements are in scope and which systems and CAGE codes they apply to
• The evidence list, mapped to the NIST SP 800-171A objectives it supports, and the form each item takes
• Who reviews the evidence, who enters results in SPRS and who signs the affirmation
• How POA&M items are handled, including their closure plan and owner
• Whether the assessor is independent of the party that prepared the evidence, and what it will not do

Contracting officers can use your SPRS risk assessments, and you can see only your own. DFARS 252.204-7024 says contracting officers consider SPRS risk assessments, which the Government generates daily from its reporting systems, when they evaluate offers. Because the agency reads what you submitted, keep the scope, CAGE codes and score in SPRS consistent with your system security plan and your proposal. Entries that conflict with other documents invite questions during evaluation, so review them against your evidence before any bid.

The suspension changes the certification timeline, not the SPRS entry obligations. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The DoW CIO page says implementation is paused and may only require self-assessments at Levels 1 and 2, while the eCFR text still shows the original schedule. Check both sources and the solicitation before deciding whether a C3PAO assessment is needed.