Conducting A CMMC L2 Self-Assessment

• Get registered on the DoD’s Procurement Integrated Enterprise Environment (PIEE) site.  You can find guidance on how to register a new account here.  Alternatively, if you have a CAC card or an ECA certificate, you may be able to login to the site using those credentials. We have instructions on how to obtain an ECA certificate in this article.
• Setup a workstation according to these instructions for accessing the PIEE site: https://piee.eb.mil/xhtml/unauth/web/homepage/machineSetup.xhtml, or access the site from within the environment
• Browse to https://piee.eb.mil using an approved browser (or CMMC Space) and click Register from top right, then follow the instructions here: https://www.sprs.csd.disa.mil//pdf/PIEE-NonGovInstructions.pdf. NOTE: you’ll need your organization’s CAGE code to register.  Call the DISA Help Desk early in the process if you run into delays: 866-618-5988  or email.
• If the person at your organization that will be doing the reporting is other than the Electronic Business Point of Contact (EB POC) as listed in SAM.gov, that person will have to have a role of Contractor Administrator (CAM) in PIEE to be able request the proper role in SPRS.   The following are instructions from DISA for obtaining a CAM role:
  • Your role of Contractor Administrator (CAM) must be authorized by your Electronic Business Point of Contact (EB POC) as listed in SAM.gov.
  • If your EB POC has not yet submitted your appointment letter, they will need to complete and return this letter before you can be activated.
  • The latest version of the CAM Appointment Letter may be downloaded here:   https://piee.eb.mil/documentation/CAM-VendorAppointmentLetter.pdf
  • The CAM letter should be filled out as follows:
    • CAM Full Name, Email and Phone number should be the information of PIEE user being appointed as the CAM.
    • The Cage Code should be listed in part #1 where it states “Commercial and Government Entity (CAGE) codes”.
    • The user must sign on the Signature of CAM Appointee.
    • The Electronic Business POC must print and sign.
  • Your Electronic Business POC is listed on the System for Award Management (SAM) website (http://www.sam.gov) per your cage code.
  • Also note, the instructions appear to be incorrect so you need to make sure you request the “SPRS Cyber Vendor User” role and not the “Contractor/Vendor (Support Role)” as indicated in the PIEE instructions.  Submit your application and wait for an email with your account approval.
• Once you have access to SPRS, you’ll need to follow the instructions described here to report a CMMC self-assessment: https://www.sprs.csd.disa.mil/pdf/CMMCQuickEntryGuide.pdf.  We’ll also show you the reporting steps in the section below.

Reporting your CMMC Level 2 self-assessment results via SPRS

Once you’re in SPRS, reporting is relatively straightforward.  When you first login to SPRS, you will see:

You will need to input the self-assessment information into the 800-171 tab.

You will need to submit the following information:

• Your organization’s CAGE code, as well as CAGE codes for any Higher Level Organizations (HLO) if your organization is owned by another
• The date the CMMC  self-assessment was completed
  • Note: We recommend using the date on the front of your SSP.
• The assessment “scope”:
  • Enclave
• The number of employees in scope for the assessment
• The Affirming Official’s email, if not you.  The Affirming Official is a senior official at your organization who is responsible for ensuring the assessment at the given scope is accurate and takes responsibility for ensuring the organization complies with CMMC.