NISTSP800-171 SPRS Walk Through.pdf

NIST SP 800-171

NIST SP 800-171 QUICK ENTRY GUIDE

VERSION 3.3

NSLC PORTSMOUTH BLDG. 153-2 PORTSMOUTH NAVAL SHIPYARD, PORTSMOUTH, NH 03804-5000

Approved for public release, distribution is unlimited.

NIST SP 800-171 Quick Entry Guide SPRS Release V 3.3

1. NIST SP 800-171 Assessment Database: The purpose of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 is to protect Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations.

This database contains data associated with NIST SP 800-171 Assessments.

2. PIEE Access: A “SPRS Cyber Vendor User” role is required to enter Basic Assessment information. Step-by-step PIEE Access Instructions can be found here.

https://www.sprs.csd.disa.mil/pdf/SPRS_Access_Instructions.pdf

3. SPRS Application Access: To Access SPRS, follow the below steps:

a. PIEE landing page: https://piee.eb.mil/piee-landing/

b. Click “log-in” and follow prompted log-in steps

Screenshot Dtd 2 NOV 2020

c. Select the SPRS Icon:

d. Select NIST 800-171 Assessment:

3.1 Creating a Header: A “Header” is required for each Highest Level Owner (HLO) CAGE. If a Basic Confidence Level header does not already exist for your HLO, it may be created by selecting “+ Create New HLO CAGE” from the Header View:

*Note: If you have SPRS access but do not see the create buttons, please confirm your “SPRS Cyber Vendor User” role has been activated in PIEE.

3.2 Header View: The header page only displays the HLO(s) for a company and will contain up to four rows per HLO, one for each Confidence Level (Basic, Medium, High Virtual, and High On-site). Basic is the only vendor self-assessed confidence level.

Version 3.3 AUG 2021 1

NIST SP 800-171 Quick Entry Guide SPRS 3.3

*Note: CAGE Hierarchy is imported from the System for Award Management (SAM).

Contact your company’s CAGE hierarchy authority to have your data updated in SAM.

Updates typically flow to SPRS within 48 hours.

3.3 Detail View: From the header view select “View Details” at the Basic confidence level to view, enter, and edit assessment summary results associated with any CAGE within that HLO’s hierarchy (see arrow above, section 3.2):

3.4 Assessment Entry: Select “+ Add New Assessment” button within Detail View

(see arrow above, section 3.3), enter assessment summary results within the Enter Assessment Details page, and select “Save”:

*Note: The Assessment Methodology and System Security Plan should be completed prior to entering assessment summary results within SPRS.

*Note: Information related to each data field may be viewed by moving the cursor over the field title or column header.

3.5 Assessment Edit: The user may update as necessary to reflect the company’s current status. While viewing the NIST assessments in Details View (Section 3.3 above), click the pencil icon to edit assessment details.

Version 3.3 AUG 2021 2

SPRS Access for NIST SP 800-171 SPRS Release V 3.2.12

Approved for public release; distribution is unlimited

SPRS Access for NIST SP 800-171

SPRS ACCESS FOR NIST SP 800-171

SPRS RELEASE V 3.2.12

NSLC PORTSMOUTH BLDG. 153-2 PORTSMOUTH NAVAL SHIPYARD, PORTSMOUTH, NH 03804-5000

SPRS Access for NIST SP 800-171 SPRS Release V 3.2.12

V201119 NOV 2020 1

SPRS Access for NIST SP 800-171 - Assessment Entry

To enter NIST SP 800-171 basic assessment scores you must have the “SPRS Cyber Vendor User” role for the SPRS application in PIEE. Once submitted, your request is reviewed and approved by the Contractor Account Administrator (CAM) associated with your CAGE. If you are the only CAM for your organization contact the PIEE Help Desk, disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil, OR the SPRS Help Desk, WEBPTSMH.fct@navy.mil, to activate.

• Go to PIEE & Login (For Instructions on How to Register in PIEE see page 2)

• Click “My Account” in the header then click “Add Additional Roles”

Screenshot current as of Oct 27, 2020

• Follow the prompts to confirm Supervisor information and arrive at “Roles”

• Complete Roles – Step 1, Select the SPRS application.

Step 2, select the Cyber Vendor role.

Step 3, Add Roles.

mailto:disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil mailto:WEBPTSMH.fct@navy.mil https://piee.eb.mil/piee-landing/

SPRS Access for NIST SP 800-171 SPRS Release V 3.2.12

V201119 NOV 2020 2

• Complete the Location Code using your Commercial and Government Entity (CAGE) code

NOTE: If you have multiple CAGE codes, please contact the PIEE Help Desk, 866.618.5988

• Follow the prompts to complete the request. You will see a button for SPRS on the PIEE landing page but it will not become active until your access is approved. You can check the status of your account by clicking “Manage Roles” in “My Account”.

• No CAM? No CAGE? See PIEE Getting Started Help.

How to Register in PIEE Access to PIEE will be granted upon completion of the registration process. SPRS access requires review.

• Go to PIEE & Click “Register”

• Read the Privacy Statement and Click “Agree” then Click your user type, “Vendor” https://piee.eb.mil/xhtml/unauth/web/homepage/vendorGettingStartedHelp.xhtml https://piee.eb.mil/piee-landing/

SPRS Access for NIST SP 800-171 SPRS Release V 3.2.12

V201119 NOV 2020 3

• Select your authentication method from the drop down menu and complete the related information

• Complete “User Profile” and “Supervisor / Agency” information (Registration Steps 3 & 4)

• Select Role (refer to page 1 of this document).

• Complete “Justification”, “Summary” and “Agreement” (Registration Steps 5-8)

To complete a Basic Assessment, you will use the DoD Assessment Methodology (attached) for the Scoring Template in Annex A and in Annex B you will find all the info that you need to put into SPRS to document your Basic Assessment. While the current Assessment Methodology is attached, it can also be found ASD(A) - DPC - Contract Policy

You will take the NIST SP 800-171A (use Google if you cannot access via the link; https://csrc.nist.gov/ publications/detail/sp/800-171a/final) and can go through each requirement to self-assess whether or not you meet the requirements stated there-in. A perfect score is 110. You will start off with a 110 and using the Annex A from the Scoring Template of the DoD Assessment Methodology, you will subtract backwards from 110 for all requirements that are not satisfied.

Once you have completed your self-assessment record results in SPRS (see Annex B). The SPRS website has added resources and video tutorials how to enter your Basic Assessment.

SPRS NIST SP 800-171: https://www.sprs.csd.disa.mil/nistsp.htm

Here are a few resources that have been helpful for small businesses.

Small Businesses Project Spectrum: https://projectspectrum.io/#!/

FAQs: https://dodprocurementtoolbox.com/faqs/cybersecurity/faq-revision-quick-look-up-0

SPRS: https://www.sprs.csd.disa.mil/

CUI: https://www.archives.gov/cui/about

Blank Page