CMMC: What Primes Need to Request and Vendors Need to Provide

What Primes Need to Request From Their Vendors (Level 1)

When issuing a subcontract or PO under a Level 1 requirement, primes should request three items:

1.      SPRS Assessment Screenshot:

Contractors do not have access to vendors’ SPRS scores.   Vendors must provide a screenshot showing their posted assessment, score, and data in the Supplier Performance Risk System (SPRS).

2.      System Security Plan (SSP):

Even at Level 1, vendors must have a written cybersecurity plan describing how they meet the 15 basic safeguarding requirements in FAR 52.204-21.

Primes should request evidence of an SSP but are not entitled to receive the full plan (it may be sensitive).

Vendors can provide:

a.      A sanitized copy, or

b.      A confirmation letter summarizing or evidence of their cybersecurity posture

3.      Self-Assessment Score:

For most vendors, this will be included in the SPRS screenshot.
Primes should verify:

·       The score exists in SPRS

·       It is less than 12 months old

·       The vendor has an annual affirmation process in place

What Vendors Need to Do to Comply with Level 1

1.      Perform a Level 1 Self-Assessment

This covers 15 basic security practices (antivirus, access control, patching, etc.). The DoD provides a simple checklist which can be found at dodcio.defense.gov/resources-documentation.

2.      Create or Update the SSP

For Level 1, the SSP should map only to the 15 FAR 52.204-21 safeguarding requirements—not the full NIST 800-171 controls used at Level 2.

At a minimum, the SSP should include:

·       A written plan (required even at Level 1)

o   Describing how each of the 15 practices is implemented.

3. Upload the Score to SPRS

Vendors need:

·       A CAC or log-in through PIEE

·       The “SPRS Cyber Vendor User” role

Once approved, they can enter:

·       Assessment score

·       Date of assessment

·       System security plan scope

                Note: The SPRS score must be updated annually.

4. Keep Documentation Ready for Primes

·   To streamline subcontract awards, vendors should prepare a small “CMMC Level 1 Package” to send when asked: SPRS screenshot

·   SSP summary or sanitized SSP

·   Self-assessment date & score

·   Contact info for verification

How to Get Started in SPRS

Step 1: Go to PIEE (https://piee.eb.mil/)
Step 2: Request the “SPRS Cyber Vendor User” role
Step 3: After approval, log into SPRS
Step 4: Navigate to Cyber Vendor Summary
Step 5: Enter your self-assessment score
Step 6: Take a screenshot for your records and for any Prime requests

The DoD’s official SPRS quick-start guide is short and easy to follow.

Bringing It All Together

Level 1 compliance isn’t complicated, but not having the right documents in place will hold up contract awards.

·     Primes: Start collecting documentation now to avoid delays from auditors and contracting officers.

·     Vendors: Make sure your assessment is complete, your SPRS score is posted, and your SSP summary is ready to go.

CMMC is now officially in DFARS. The Final Rule became effective on November 10, so these requirements are active and will start showing up as contracts are modified or awarded. Having documentation ready on both sides will make subcontract releases smoother and avoid surprises during review.