If you hold a DoD contract, your SPRS score is one of the most important numbers in your business. This guide covers exactly how CMMC Level 1 and Level 2 scores are calculated, what the thresholds mean, and how to submit them correctly through PIEE — based on the official SPRS Quick Entry Guides.
What Is SPRS and Why Does It Matter?
SPRS — the Supplier Performance Risk System — is the DoD’s centralized database where defense contractors submit their CMMC self-assessment scores. Contracting officers and prime contractors use SPRS to verify your cybersecurity posture before awarding contracts or subcontracts.
As of November 2025, submitting your score to SPRS is mandatory for any DoD contractor subject to FAR 52.204-21 (Level 1) or DFARS 252.204-7012 (Level 2). Without an active score in SPRS, you may be ineligible to bid on or renew DoD contracts.
There are two different submission processes depending on your CMMC level. Here’s how each one works.
CMMC Level 1: 15 Practices, Annual Self-Assessment
Who It Applies To
CMMC Level 1 applies to contractors that handle Federal Contract Information (FCI) — information provided by or generated for the government under a contract that is not intended for public release. The DoD estimates roughly 63% of the Defense Industrial Base falls under Level 1.
The 15 Practices
Level 1 is based on the 15 security requirements in FAR clause 52.204-21, organized across six domains:
- Access Control (AC) — 4 practices: limit system access to authorized users and devices
- Identification & Authentication (IA) — 2 practices: verify identity before granting access
- Media Protection (MP) — 1 practice: sanitize or destroy media containing FCI before disposal
- Physical Protection (PE) — 2 practices: limit physical access to authorized individuals
- System & Communications Protection (SC) — 2 practices: monitor and control communications at system boundaries
- System & Information Integrity (SI) — 4 practices: protect against malware, patch systems, monitor security alerts
Level 1 Scoring
For Level 1, compliance with all 15 practices in FAR 52.204-21 is required to achieve a “Final Level 1 Self-Assessment” status in SPRS. This is the only status type visible to government personnel.
Validity Period
Per the official SPRS Quick Entry Guide (Version 4.0, December 2024), a Final Level 1 Self-Assessment automatically becomes “No CMMC Status (Expired Assessment)” after 1 year. Annual reassessment and resubmission is required.
How to Submit Your Level 1 Score
- Get PIEE access — you need a “SPRS Cyber Vendor User” role. Request access at sprs.csd.disa.mil/access.htm
- Log in to PIEE at piee.eb.mil and select SPRS → Cyber Reports
- Select your CAGE hierarchy from the dropdown (note: an asterisk * indicates you have the SPRS Cyber Vendor User role)
- Within the CMMC Assessments tab, select “Add New Level 1 CMMC Self-Assessment”
- Enter your assessment details and select “Continue to Affirmation”
- If you are not the Affirming Official (AO), transfer the assessment to the AO via email
- The AO reviews the details, certifies the affirmation statement, and selects “Affirm”
Note: CAGE hierarchy data is imported from SAM (System for Award Management). Ensure your SAM registration is current before submitting.
CMMC Level 2: 110 Practices, Conditional and Final Assessments
Who It Applies To
CMMC Level 2 applies to contractors that handle Controlled Unclassified Information (CUI). It is based on the 110 security requirements in NIST SP 800-171. Level 2 has two pathways: self-assessment (for non-prioritized programs) and third-party assessment by a C3PAO (for prioritized programs). This section covers the self-assessment pathway.
Level 2 Scoring Thresholds
Per the official SPRS Level 2 Self-Assessment Quick Entry Guide (Version 4.0, February 2025):
- Score of 110 — all 110 practices fully implemented → eligible for a CMMC L2 Final Self-Assessment, valid for 3 years with annual affirmations verifying continued compliance
- Score of 88–109 — minor gaps with a valid POA&M → eligible for a CMMC L2 Conditional Self-Assessment, valid for 180 days only, after which gaps must be remediated and resubmitted
- Score below 88 — not eligible for affirmation → results in No CMMC Status, which affects contract eligibility
Important: If any requirement cannot be subject to a Plan of Action and Milestones (POA&M), the result will be No CMMC Status regardless of overall score.
How to Submit Your Level 2 Self-Assessment Score
- Get PIEE access — same “SPRS Cyber Vendor User” role required. Access at sprs.csd.disa.mil/access.htm
- Log in to PIEE at piee.eb.mil and select SPRS → Cyber Reports (CMMC & NIST)
- Select your CAGE hierarchy and click “Run Cyber Reports”
- Within the CMMC Assessments / CMMC Level 2 (Self) tab, select “Add New Level 2 CMMC Self-Assessment”
- Enter assessment details — for each of the 110 requirements, select the applicable Compliance Status. Click “Requirement Objectives” to review detailed objectives for each requirement
- Navigate through each Requirement Family using “Save and Continue.” All requirement answers must be complete before proceeding
- Add Assessing Scope, Employee Count, and included CAGEs as required
- Review your score — if 88 or above, proceed to affirmation
- Affirm or transfer to the Affirming Official (AO)
Level 1 vs Level 2: Key Differences
| Factor | Level 1 | Level 2 (Self) |
|---|---|---|
| Applies to | FCI | CUI |
| Practices | 15 (FAR 52.204-21) | 110 (NIST SP 800-171) |
| Assessment type | Self-assessment only | Self-assessment or C3PAO |
| Status types | Final (full compliance required) | Conditional (88–109) or Final (110) |
| Validity | 1 year | 180 days (Conditional) / 3 years (Final) |
| POA&M allowed | Yes | Yes, for scores 88–109 only |
The False Claims Act Risk
When you submit your SPRS score, an Affirming Official certifies its accuracy. Under the False Claims Act, submitting an inaccurate score — even unintentionally — can expose your organization to significant legal liability, including treble damages on affected contracts.
The safest approach at both levels: score honestly, document everything, and use a POA&M for any gaps. A lower score with proper documentation is far safer than an inflated score with nothing to support it.
Free CMMC Resources
Not sure where your gaps are before you submit to SPRS? Start with our free CMMC Level 1 Readiness Checklist — the same gap analysis tool KyberStorm uses with paying clients, now available at no cost. It covers all 15 FAR 52.204-21 practices, shows you exactly which documents you’re missing, and gives you a starting point for your SPRS score calculation before you commit anything to the database.
Download the Free CMMC Level 1 Readiness Checklist
See exactly which practices and documents you’re missing before you commit a score to SPRS. Free, instant download.
Ready to Get Fully Documented?
If your gap analysis reveals missing documentation, KyberStorm has everything you need to get compliant fast.
CMMC Level 1 Documentation Kit — $897
The complete documentation package for Level 1 self-assessment. Includes all 12 editable Word documents:
- System Security Plan (SSP)
- Plan of Action & Milestones (POA&M) template
- CMMC Level 1 Control Tracker with SPRS scoring
- 5 mandatory policy documents: Access Control, Physical Protection, System & Communications Protection, System & Information Integrity, Media Protection
- 4 bonus policies: Clear Desk, Telecommuting, Acceptable Use Policy, Information Classification
Built by a CISSP-certified GRC professional. One-time purchase, instant download.
Get the Level 1 Documentation Kit — $897 →
CMMC Level 2 Advisory & Documentation
Handling CUI and need Level 2 documentation or advisory support? We work with defense contractors at both levels across the DMV region — from gap assessments and SSP development to full NIST SP 800-171 documentation packages and C3PAO preparation. Contact us at info@kyberstorm.com
AI Penetration Testing & Red Teaming
Need to validate your security controls before your assessment? KyberStorm offers penetration testing, red teaming, and vulnerability management services tailored to defense contractors. Contact us at info@kyberstorm.com
KyberStorm is a CISSP-certified cybersecurity advisory firm based in the Greater DMV area, specializing in CMMC, FedRAMP, and DoD compliance. Questions? info@kyberstorm.com.