CMMC_Level 2_Quick Entry Guide.pdf
PDF 1000 KB Posted
- Attached to
- Sphinx Cafe Foodservice Equipment
- Solicitation number
- FA860126Q0052
About this file
This document is a Cybersecurity Maturity Model Certification (CMMC) Level 2 Self-Assessment Quick Entry Guide, Version 4.0, published in February 2025 by the Naval Submarine Base New London (NSLC) Portsmouth, Portsmouth Naval Shipyard, Portsmouth, New Hampshire.
The guide provides step-by-step instructions for federal contractors to enter CMMC Level 2 self-assessment data into the Supplier Performance Risk System (SPRS) via the Partner Information Enterprise Environment (PIEE). Users must obtain a "SPRS Cyber Vendor User" role to access and modify assessment information. The process begins by logging into PIEE, selecting SPRS, navigating to Cyber Reports (CMMC & NIST), and selecting the appropriate company hierarchy identified by Highest Level Organization (HLO) code. Within the CMMC Assessments and CMMC Level 2 (Self) tabs, users add a new Level 2 CMMC Self-Assessment and enter compliance status responses for each requirement family (Access Control, Account Management, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Media Protection, Personnel Security, Physical and Environmental Protection, System and Risk Assessment, System and Communications Protection, and System Integrity). Assessment data must be complete before advancing, and users must provide additional details including assessing scope, employee count, and included Commercial and Government Entity (CAGE) codes imported from the System for Award Management (SAM). The system generates a numerical score determining status type; only assessments scoring 88–109 points qualify as "CMMC L2 Conditional Self-Assessment" (valid for 180 days) and those scoring 110 points qualify as "CMMC L2 Final Self-Assessment" (valid for 3 years with annual affirmations). If the assessment preparer is not the Affirming Official (AO), the completed assessment can be transferred via email for review and affirmation. The final affirmation step requires certification and attestation that the information systems comply with CMMC requirements as defined in 32 CFR § 170, with misrepresentation potentially resulting in criminal prosecution, civil liability, and contract remedies.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CMMC Quick Entry Guide SPRS V4.0
Version 4.0 FEB 2025 1
Cybersecurity Maturity Model Certification (CMMC)
CMMC LEVEL 2 SELF-ASSESSMENT
QUICK ENTRY GUIDE
VERSION 4.0
NSLC PORTSMOUTH BLDG. 153-2 PORTSMOUTH NAVAL SHIPYARD, PORTSMOUTH, NH 03804-5000
Version 4.0 FEB 2025 2
1. PIEE Access: A “SPRS Cyber Vendor User” role is required to enter CMMC Assessment information. PIEE Access Instructions:
https://www.sprs.csd.disa.mil/access.htm
2. SPRS Application and Module Access:
a. PIEE landing page: https://piee.eb.mil/piee-landing/
b. Click “LOG IN”
Screenshot Dtd 09 JAN 2024
c. Select SPRS:
d. Select Cyber Reports (CMMC & NIST):
3. Cyber Reports (CMMC & NIST): Select the desired Hierarchy, identified by the HLO, from the drop down and select Run Cyber Reports button.
NOTE: An asterisk * indicates the user has the SPRS Cyber Vendor User role (access to add/edit/delete) https://www.sprs.csd.disa.mil/access.htm https://piee.eb.mil/piee-landing/ https://piee.eb.mil/piee-landing/
Version 4.0 FEB 2025 3
3.1 Add New CMMC Level 2 Self-Assessment: Within the CMMC Assessments and
CMMC Level 2 (Self) tabs, select “Add New Level 2 CMMC Self-Assessment”.
3.2 Enter Assessment Details: Enter assessment data; review Requirement Objectives to each Requirement Number by selecting the Requirement Objectives button. Select the applicable Compliance Status. Select Save and Continue to navigate through each Requirement Family.
Version 4.0 FEB 2025 4
3.3 Review Assessment Details: Answers to Requirements must be complete prior to continuing.
3.4 Additional Assessment Details: Add Assessing Scope, Employee Count, and Included CAGE(s) as required. Select the “Open CAGE Hierarchy” button to add CAGEs or enter comma delimited CAGEs in the data field provided. Select “Save and Continue.”
NOTE: CAGE Hierarchy data is imported from the System for Award Management (SAM). Users are unable to add CAGEs that are not part of their company hierarchy.
Version 4.0 FEB 2025 5
3.5 Score: Only CMMC L2 Conditional (score = 88 to 109) and Final Self-Assessments (score = 110) can be affirmed.
NOTE: If a requirement is not able to be subject to a Plan of Action and Milestones (POA&M), then the Status Type will be No CMMC Status regardless of score.
3.6 Transfer to Affirming Official (AO): If the user entering the assessment is not the AO, the assessment can be forwarded via email, to the AO by entering their email and selecting “Transfer to AO”.
Version 4.0 FEB 2025 6
3.7 Affirm the Assessment: Review the assessment details, certify review of the affirmation statement, and select “Affirm”.
3.8 Assessment Edit/Cancel/Delete: A Cyber Vendor User may Edit, Cancel, or Delete certain CMMC Status Types. Select the available icon to complete the action.
NOTE: A “CMMC L2 Conditional Level 2 Self-Assessment” is valid for 180 days. A “CMMC L2 Final Level 2 Self-Assessment”, with annual affirmations verifying compliance, is valid for 3 years.”
File details come from the government source that posted it. Updated .