NIST SP 800-171 Frequently Asked Questions.pdf

NIST SP 800-171 FAQ SPRS Release V 3.2.12

Approved for public release; distribution is unlimited

NIST SP 800-171 Frequently Asked Questions

NIST SP 800-171 FAQ

VERSION 3.2.12

NSLC PORTSMOUTH BLDG. 153-2 PORTSMOUTH NAVAL SHIPYARD, PORTSMOUTH, NH 03804-5000

FAQ V 201106 NOV 2020 1

NIST SP 800-171 Frequently Asked Questions

How do I enter our basic NIST SP 800-171 Assessment into

SPRS?

SPRS provides storage and retrieval for the NIST SP 800-171 assessment results only.

Please refer to the Defense Pricing and Contracting (DPC) Cyber page on Strategically Assessing Contractor Implementation of NIST SP 800-171 for preparation information including the assessment methodology.

If you have additional questions related to interpreting or conducting your assessment, please contact your DCMA representative or the DCMA general mailbox, dcma.lee.hq.mbx.dibcac-scheduling-inbox@mail.mil.

I have access to SPRS but I don’t see how to input my cyber information.

If you don’t see the “Create New Header” or “+Add New Assessment” buttons, you do not have the “SPRS Cyber Vendor User” role. Add this role by logging into PIEE, click “My Account” in the header and then “Add Additional Roles” in the middle of the next page.

Screenshot current as of Oct 27, 2020

Once you have the correct access, use the SPRS NIST SP 800-171 Quick Entry Guide to enter your results.

What is a Location Code?

Location Code = CAGE code

If you do not know your Commercial and Government Entity (CAGE) code you may search in the System for Award Management (SAM), www.sam.gov or check to see if your company has a CAGE manager. For additional CAGE info see this one page tip sheet from SAM.

FAQ V 201106 NOV 2020 3

What is my DoDAAC?

A DoDAAC is not required for private industry registering in PIEE. Please select “Vendor” as your user type.

Screenshot current as of Oct 27, 2020

Complete the registration and request access for the SPRS application with the “SPRS Cyber Vendor User” role.

If you have completed your registration with any other user type please contact the PIEE Help Desk, 866.618.5988, for further assistance.

Why don’t I see all of the CAGEs in the hierarchy associated with my company?

SPRS uses the CAGE hierarchy data from the System for Award Management (SAM).

Please contact SAM or your company’s CAGE manager to confirm or update your CAGE hierarchy. Changes in SAM will update in SPRS within 24hrs. Check out this one page ownership tip sheet from SAM.

I have access to multiple CAGEs in PIEE but I don’t see them all in SPRS.

Within the SPRS NIST SP 800-171 module currently, the hierarchy of only one Highest Level Owner (HLO) can be viewed by someone with an approved “SPRS Cyber Vendor User” role.

If your corporate structure includes multiple CAGE codes please contact SAM or your company’s CAGE manager to update/confirm your CAGE hierarchy. Changes in SAM will update in SPRS within 24hrs. Additional information is available in this one page ownership tip sheet from SAM.

If your companies are unaffiliated please contact SPRS Help Desk, WEBPTSMH.fct@navy.mil .

I am getting an error message in the PIEE registration process after entering my CAGE for the Location Code.

Messages that mention an eBusiness POC indicate that there is currently no Contractor Account Administrator (CAM) associated with the CAGE. The CAM is the gatekeeper that authorizes users requesting access to your company. The CAM must be the Electronic Business point of contact listed in the System for Award Management (SAM) or their designee.

Messages that state there are no groups in the system indicate that your CAGE code is not recognized by PIEE. Call the PIEE Help Desk to add you CAGE. PIEE Help Desk:

866.618.5988

For further information please see PIEE’s Getting Started Help page.

FAQ V 201106 NOV 2020 3

The “SPRS Cyber Vendor User” role is not an option when I select the SPRS application in PIEE.

You must select “Vendor” as your “User Type” when you are registering in PIEE. If you have completed your registration with any other user type please contact the PIEE Help Desk, 866.618.5988, for further assistance.

What is my cyber score? What is the cyber score of my subcontractor?

Cyber scores are considered Controlled Unclassified Information (CUI). Access is restricted to company personnel with approved access to SPRS. Apply for SPRS access through the Procurement Integrated Enterprise Environment (PIEE). Access instructions available here.

If you require the cyber score of one of your subcontractors, please contact them directly.

Can I edit my assessment after it has been entered?

Yes, there is an edit button to allow companies to make changes as necessary to their existing assessments. Anyone with the “SPRS Cyber Vendor User” role associated with your company CAGE is able to enter and edit assessment results.

Follow the instructions for entering assessment results in the SPRS NIST SP 800-171 Quick Entry Guide.

When I enter my CAGE on the “Create a New Header” page in NIST it defaults to a different CAGE. Why?

SPRS Assessments are categorized by Highest Level Owner (HLO) headers. Headers are the rows of information related to that HLO for each confidence level. The system recognizes your CAGE code belongs to a parent organization based on the corporate hierarchy provided by the System for Award Management (SAM) and automatically inputs the HLO. By completing this form and creating a header with a Basic confidence level you are beginning the process. You are not making a statement about the security of your parent company.

The SPRS NIST SP 800-171 landing page will now have a row with your HLO listed with “Basic” in the confidence level column. Click the company name in that row. This will take you to the details view referenced in the SPRS NIST SP 800-171 Quick Entry Guide. Add your assessment per instructions. You will have the opportunity to select or enter the specific CAGE(s) related to the assessment results you are inputting.

If the listed HLO is not correct in SPRS, please contact the System for Award Management (SAM), sam.gov, or your company’s CAGE manager to update your Commercial and Government Entity (CAGE) hierarchy. Additional CAGE information is available in this one page ownership tip sheet from SAM.