SPRS NIST SP 800-171 WORKFLOW.pdf
PDF 97 KB Posted
- Attached to
- Operator Console
- Solicitation number
- FA822225QCNSL
About this file
The document is a workflow guide for the Supplier Performance Risk System (SPRS) NIST SP 800-171 Assessment process. It provides a comprehensive five-step workflow for contractors to complete their cybersecurity assessment and compliance with Department of Defense (DoD) requirements. Key steps include: 1) Obtaining access to SPRS by registering in PIEE and activating a "SPRS Cyber Vendor User" role, 2) Developing an internal IT System Security Plan (SSP), 3) Performing the NIST Assessment, 4) Completing a Plan of Action if the score is less than 110, and 5) Entering assessment scores and details in the SPRS system.
The document also outlines new regulatory directives from DFARS provisions 252.204-7019 and 252.204-7020, which establish additional cybersecurity measures for contractors. These provisions require contractors to have a current (not older than three years) NIST SP 800-171 DoD Assessment on record to be considered for award. Contractors must ensure assessment results are posted in the Supplier Performance Risk System (SPRS) and provide the government access to facilities, systems, and personnel for potential higher-level assessments. Subcontractors are also required to have current assessments posted in SPRS prior to being awarded subcontracts.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Combo FA822225QCNSL.docx | DOCX document | |
| Operator Console SSJ_Signed redacted.pdf | ||
| Operator Console Equipment List.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SPRS NIST SP 800-171 Workflow
Step 1. Obtain Access to SPRS; Register in PIEE and activate a “SPRS Cyber Vendor User” role:
Once your company registers with PIEE, your company will need to establish a Contractor Administrator (CAM). The CAM acts as your companies User Role approver. Your CAM will approve your request for a “SPRS Cyber Vendor User” role.
If there is only one CAM, and this person is applying for a SPRS User role, they must request User role activation from PIEE help desk.
PIEE HELPDESK
Email: disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil
Phone: 1-866-618-5988
Step 2. In order to perform the NIST Assessment, your company needs to have an internal IT System Security Plan (SSP) in place. Hopefully, your IT department has already written one of these.
If not;
System Security Plan (SSP) Guide & Template: https://csrc.nist.gov/publications/detail/sp/800- 171/rev-2/final
The template is found on the right hand side under documentation. Titled CUI SSP Template.
Step 3. Once the SSP is in place, you are ready to ‘perform’ the NIST Assessment.
NIST SP 800-171
Methodology: https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171- Assessment-Methodology-Version-1.2.1-6.24.2020.pdf (scoring template begins on page 12)
For assistance with conducting your NIST SP 800-171 assessment, assessment interpretation, definitions, deadlines, regulations, requirements, scope, etc.; you will need to contact the DCMA Help Desk at: DCMA_7012_Assessment_Inquiry@mail.mil.
Step 4 If your score is less than 110 you will need to complete a Plan of Action
Plan of Action Template: https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
The template is found on the right hand side under documentation.
Step 5. Entering score and other assessment details -- Walkthrough Guide:
NIST SP 800-171 Quick Entry Guide: https://www.sprs.csd.disa.mil/pdf/NISTSP800- 171QuickEntryGuide.pdf https://piee.eb.mil/piee-landing/ https://piee.eb.mil/piee-landing/ mailto:disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf mailto:DCMA_7012_Assessment_Inquiry@mail.mil https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://www.sprs.csd.disa.mil/pdf/NISTSP800-171QuickEntryGuide.pdf https://www.sprs.csd.disa.mil/pdf/NISTSP800-171QuickEntryGuide.pdf
Regulatory directives:
The new DFARS provision 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, and new DFARS clause 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, add additional cybersecurity measures to those already required under DFARS 252.204-7012 by establishing enforcement methodologies for ensuring contractors have implemented the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 DoD Assessment Methodology.
Contracting Officers are directed to include DFARS 252.204-7019 and 252.204-7020 in all solicitations and contracts including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of COTS items.
DFARS provision 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, advises offerors required to implement the NIST SP 800-171 to have a current (not older than three years) NIST SP 800-171 DoD Assessment on record in order to be considered for award. The provision requires offerors to ensure the results of any applicable current Assessments are posted in Supplier Performance Risk System (SPRS) and provides offerors with additional information on conducting and submitting an Assessment when a current one is not posted in SPRS.
The new DFARS clause 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, requires a contractor to provide the Government with access to its facilities, systems, and personnel when it is necessary for DoD to conduct or renew a higher-level (“MEDIUM “or “HIGH”) assessment. The clause also requires the contractor to ensure that applicable subcontractors have the results of a current Assessment posted in SPRS prior to awarding a subcontract or other contractual instruments. The clause also provides additional information on how a subcontractor can conduct and submit an Assessment when one is not posted in SPRS. Flow-down of this clause to applicable subcontracts is also mandated.
If you require a step-by-step guide for access to the SPRS system, please contact the contract specialist listed on the solicitation document.
File details come from the government source that posted it. Updated .