Who Can Submit SPRS Scores
Your ability to submit SPRS scores to the DoD depends on your CMMC certification level:
CMMC Level 1 (self-assessment): Your organization can conduct the assessment and submit the SPRS score directly to the DoD SPRS portal.
CMMC Level 2 (self-assessment): Your organization can conduct the assessment and submit the SPRS score directly to the DoD SPRS portal.
CMMC Level 2 (certification assessment): Only an accredited CMMC Third-Party Assessment Organization (C3PAO) can conduct the assessment and submit the results to SPRS on your behalf.
CMMC Level 3 (certification assessment): Only the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) can conduct the assessment and submit the results to SPRS.
How to Submit Your SPRS Score (Self-Assessments Only)
Log into the SPRS portal
Navigate to the NIST SP 800-171 Assessment section
Enter your score and assessment date
Submit for your organization's CAGE code
Important Notes
You must resubmit your SPRS score whenever there is a significant change to your security posture
SPRS scores should be updated at least annually
Ensure your CAGE code is correct before submitting
Keep documentation of your self-assessment for audit purposes