SPRS NIST SP 800-171 WORKFLOW.pdf
PDF 97 KB Posted
- Attached to
- Wind River SIMICS Consultation Hours
- Solicitation number
- FA822225QB0020
About this file
The document is a workflow guide for NIST SP 800-171 cybersecurity compliance, outlining a five-step process for federal contractors to assess and document their cybersecurity standards. The workflow requires contractors to: 1) register in the PIEE system and obtain a "SPRS Cyber Vendor User" role, 2) develop an internal IT System Security Plan (SSP), 3) perform a NIST Assessment using the provided methodology, 4) create a Plan of Action if the assessment score is below 110, and 5) enter the assessment details into the SPRS system.
The document also details new Department of Defense Federal Acquisition Regulation Supplement (DFARS) provisions 252.204-7019 and 252.204-7020, which mandate that contractors have a current (within three years) NIST SP 800-171 DoD Assessment to be considered for contract awards. These provisions require contractors to post assessment results in the Supplier Performance Risk System (SPRS), provide government access to facilities and systems for assessments, and ensure subcontractors also comply with these cybersecurity requirements. Contracting officers must include these provisions in solicitations for commercial items, with exceptions for purely commercial off-the-shelf (COTS) items.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 13549 single_source_justification redacted.pdf | ||
| Solicitation - FA822225QB020.pdf | ||
| PURCHASE DESCRIPTON.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SPRS NIST SP 800-171 Workflow
Step 1. Obtain Access to SPRS; Register in PIEE and activate a “SPRS Cyber Vendor User” role:
Once your company registers with PIEE, your company will need to establish a Contractor Administrator (CAM). The CAM acts as your companies User Role approver. Your CAM will approve your request for a “SPRS Cyber Vendor User” role.
If there is only one CAM, and this person is applying for a SPRS User role, they must request User role activation from PIEE help desk.
PIEE HELPDESK
Email: disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil
Phone: 1-866-618-5988
Step 2. In order to perform the NIST Assessment, your company needs to have an internal IT System Security Plan (SSP) in place. Hopefully, your IT department has already written one of these.
If not;
System Security Plan (SSP) Guide & Template: https://csrc.nist.gov/publications/detail/sp/800- 171/rev-2/final
The template is found on the right hand side under documentation. Titled CUI SSP Template.
Step 3. Once the SSP is in place, you are ready to ‘perform’ the NIST Assessment.
NIST SP 800-171
Methodology: https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171- Assessment-Methodology-Version-1.2.1-6.24.2020.pdf (scoring template begins on page 12)
For assistance with conducting your NIST SP 800-171 assessment, assessment interpretation, definitions, deadlines, regulations, requirements, scope, etc.; you will need to contact the DCMA Help Desk at: DCMA_7012_Assessment_Inquiry@mail.mil.
Step 4 If your score is less than 110 you will need to complete a Plan of Action
Plan of Action Template: https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
The template is found on the right hand side under documentation.
Step 5. Entering score and other assessment details -- Walkthrough Guide:
NIST SP 800-171 Quick Entry Guide: https://www.sprs.csd.disa.mil/pdf/NISTSP800- 171QuickEntryGuide.pdf https://piee.eb.mil/piee-landing/ https://piee.eb.mil/piee-landing/ mailto:disa.global.servicedesk.mbx.eb-ticket-requests@mail.mil https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf mailto:DCMA_7012_Assessment_Inquiry@mail.mil https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://www.sprs.csd.disa.mil/pdf/NISTSP800-171QuickEntryGuide.pdf https://www.sprs.csd.disa.mil/pdf/NISTSP800-171QuickEntryGuide.pdf
Regulatory directives:
The new DFARS provision 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, and new DFARS clause 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, add additional cybersecurity measures to those already required under DFARS 252.204-7012 by establishing enforcement methodologies for ensuring contractors have implemented the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 DoD Assessment Methodology.
Contracting Officers are directed to include DFARS 252.204-7019 and 252.204-7020 in all solicitations and contracts including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of COTS items.
DFARS provision 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, advises offerors required to implement the NIST SP 800-171 to have a current (not older than three years) NIST SP 800-171 DoD Assessment on record in order to be considered for award. The provision requires offerors to ensure the results of any applicable current Assessments are posted in Supplier Performance Risk System (SPRS) and provides offerors with additional information on conducting and submitting an Assessment when a current one is not posted in SPRS.
The new DFARS clause 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, requires a contractor to provide the Government with access to its facilities, systems, and personnel when it is necessary for DoD to conduct or renew a higher-level (“MEDIUM “or “HIGH”) assessment. The clause also requires the contractor to ensure that applicable subcontractors have the results of a current Assessment posted in SPRS prior to awarding a subcontract or other contractual instruments. The clause also provides additional information on how a subcontractor can conduct and submit an Assessment when one is not posted in SPRS. Flow-down of this clause to applicable subcontracts is also mandated.
If you require a step-by-step guide for access to the SPRS system, please contact the contract specialist listed on the solicitation document.
File details come from the government source that posted it. Updated .