How to Submit a CMMC Level 1 Self-Assessment in SPRS

To submit a CMMC Level 1 self-assessment in SPRS, complete the assessment, enter its results through your PIEE account, and have your company’s Affirming Official complete the affirmation. Saving an entry alone does not finish the process.

For Austin and Houston defense contractors, preparation starts with the information your business handles and the systems used for contract work. Business Communication Solutions provides CMMC consulting and Level 1 readiness support to help your team prepare before submission.

Before you begin: confirm Level 1 applies

Level 1 focuses on protecting Federal Contract Information (FCI). Review the required level and assessment type in your solicitation, contract, or subcontract. If you handle Controlled Unclassified Information (CUI), review the applicable higher-level requirements before assuming Level 1 is sufficient.

Read What Is FCI vs. CUI? and Do I Need CMMC Level 1 or Level 2? for related guidance.

1. Complete the self-assessment before entering results

Assess the 15 safeguarding requirements in FAR 52.204-21 using the mapped assessment objectives. All requirements must be MET to achieve Final Level 1 (Self). Level 1 does not permit a Plan of Action and Milestones (POA&M) to carry unresolved assessment gaps into a conditional status.

Identify the assessment boundary, examine the implementation, and organize supporting evidence. The official Level 1 Assessment Guide provides assessment guidance. Submission records the result; it does not perform the assessment for you.

2. Set up PIEE and the correct SPRS access

SPRS is accessed through the Procurement Integrated Enterprise Environment (PIEE). Your company needs SAM registration, an Electronic Business point of contact, and its CAGE code in the PIEE vendor group structure. A Contractor Account Administrator (CAM) authorizes company access requests.

Request the SPRS Cyber Vendor User role. The Contractor/Vendor Support role provides viewing access to Cyber Reports, rather than assessment entry. Existing PIEE users can add the required role; new users can request it during registration.

If the SPRS tile is inactive, check My Account → Manage Roles and contact your CAM. See the official SPRS access instructions.

3. Open the Level 1 self-assessment entry

In SPRS, select Cyber Reports, choose your company’s CAGE and hierarchy combination, and click Run Cyber Reports. Open CMMC Assessments and select Add New CMMC Level 1 Self-Assessment.

Use the CMMC entry workflow. The separate NIST SP 800-171 assessment tab serves a different reporting purpose.

4. Enter the assessment details accurately

Have these details ready:

• Assessment date: the date your assessment was conducted.
• Scope: Enterprise or Enclave, reflecting the environment actually assessed.
• Company size: the employee count requested for the organization to which the assessment applies.
• Compliance result: the Yes/No response concerning the FAR 52.204-21 requirements.
• Included CAGE codes: the codes covered by the assessed systems.

Use the form’s information buttons to check field definitions. See the official SPRS Level 1 entry tutorial for the workflow.

5. Have the Affirming Official review and affirm

The Affirming Official (AO) must be a senior representative within your organization with responsibility and authority to affirm continuing compliance. The AO needs their own PIEE account with the SPRS Cyber Vendor User role.

Select Continue to Affirmation. If someone else is the AO, enter that official’s email and select Transfer to AO. The AO can open the Pending Affirmation record through its edit icon, review the details and affirmation statement, select the certification checkbox, and click Affirm.

AO profile information comes from PIEE. Correct inaccurate profile details there before completing the process. Consult the official Affirming Official tutorial.

6. Verify the final status and save your record

A compliant, affirmed entry should show Final Level 1 Self-Assessment. An affirmed “No” compliance response produces No CMMC Status. An Incomplete or Pending Affirmation entry is unfinished.

After affirmation, SPRS assigns a CMMC Unique Identifier (UID). Open the record’s Detail view and save its print-friendly information as a PDF. Check the date, scope, included CAGE codes, status, and expiration information against your assessment records.

7. Maintain compliance and renew annually

Level 1 requires an annual self-assessment, submission of results in SPRS, and annual affirmation of continuing compliance. Retain the evidence artifacts for six years from the CMMC Status Date. These requirements are addressed in 32 CFR Part 170, including sections 170.15 and 170.22.

Assign a renewal owner and schedule preparation ahead of expiration. Review new devices, changed accounts, cloud services, and information flows as your business changes.

Common questions about Level 1 SPRS submission

Can our IT provider prepare the submission?

A provider can assist with readiness and preparation. Your authorized company officials retain responsibility for the submission and affirmation. Coordinate evidence review with the AO before starting the entry.

What if a requirement is not met?

Record the finding honestly, assign corrective work, and verify the correction before claiming compliance. A planned fix should not be described as completed implementation.

Why is the Add New button missing?

Check that your Cyber Vendor User role is approved for the selected CAGE and hierarchy. Your company’s CAM can help resolve access issues.

CMMC Level 1 readiness support in Austin and Houston

BCS helps contractors organize their assessment scope, identify gaps, implement corrections, and prepare documentation and evidence. We can work alongside your current IT team and explain the SPRS workflow so the responsible officials understand the next steps.

Submission guidance reviewed September 30, 2026. Check the current official SPRS guides for interface updates. BCS provides consulting and readiness support; the company’s authorized officials complete the required assessment reporting and affirmation.