ATTACH_12_For Contractors - CMMC.pdf

This is an instructional guidance document from NAVFAC FAR EAST regarding Cybersecurity Maturity Model Certification (CMMC) requirements for federal contractors.

As of November 2025, contractors bidding on federal contracts must complete a self-assessment in the Supplier Performance Risk System (SPRS) within the PIEE platform to demonstrate their cybersecurity maturity meets military requirements. CMMC certification remains valid for one year unless the contractor's cybersecurity practices change. When solicitations include DFARS 252.204-7025 (Notice of Cybersecurity Maturity Model Certification Level Requirements) or contracts include DFARS 252.204-7021 (Compliance with the Cybersecurity Maturity Model Certification Level Requirements), the government will verify the contractor's CMMC status in SPRS during bid evaluation and contract award to confirm capability. The document outlines the step-by-step process for completing the self-assessment, including accessing PIEE at https://piee.eb.mil/, navigating to SPRS, selecting Cyber Reports, choosing the appropriate organizational level (parent company or subsidiary), and selecting either CMMC Self-Assessment Level 1 (basic) or Level 2 (comprehensive). Contractors must designate either a "Cyber Vendor Role" for input authority or "Contractor/Vendor Role" for view-only access. The process requires completing assessment details, designating an Affirming Official responsible for verifying accuracy and compliance, and obtaining final affirmation. Additional resources include FAQs and training videos at https://www.sprs.csd.disa.mil/nistsp.htm, and the SPRS Helpdesk at webptsmh@navy.mil for English-language inquiries.