How to Submit and Affirm Your CMMC Level 1 Self-Assessment in SPRS

Most CMMC guides spend all their time on the 15 requirements and then go quiet at the finish line. But meeting the requirements isn't the last step — making it official is. You have to record your self-assessment in a government system and have a senior person formally affirm it, and until you do, you're not eligible for the contracts that require Level 1.

The good news: this part is procedure, not technical work. Here's the whole thing, start to finish.

(If you haven't worked through the 15 requirements yet, start with the Plain English CMMC Level 1 Guide — this article picks up once you believe you meet them.)

Before you submit: two things have to be true

1. You meet all 15 requirements — fully. Level 1 has no "we'll fix it later." There are no plans of action and milestones (POA&Ms) allowed, so you can't submit with a requirement half-done. Every one has to be genuinely met before you record your result.
2. You know your scope and your CAGE code. You need to know which systems handle your Federal Contract Information and the CAGE code (or codes) tied to them, because that's part of what you'll enter.

If either of those isn't settled, sort it out first — the submission step assumes both.

Step 1: Get access to SPRS through PIEE

Your results go into the Supplier Performance Risk System (SPRS), the DoD's database for contractor compliance information. You reach SPRS through PIEE (the Procurement Integrated Enterprise Environment), the government's procurement portal.

For a lot of small contractors, this access is the first real hurdle — not because it's hard, but because it takes setting up the right account and roles before you can enter anything. If you don't already have SPRS access, start this early so it's not what holds you up at the end.

Step 2: Enter your self-assessment results

Once you're in SPRS, you record your Level 1 self-assessment. At a minimum, that includes the date you completed the assessment, the information systems within your assessment scope, and the CAGE code (or codes) associated with them, along with your result. Because Level 1 doesn't allow partial credit, the result reflects that you've met all 15 requirements.

This is data entry, not a test someone grades. The honesty is on you.

Step 3: The Affirming Official affirms it

A self-assessment isn't complete until it's affirmed. This is done by an Affirming Official — a senior representative of your company who is responsible for your compliance and has the authority to attest to it. In a small business, that's typically the owner, an executive, or an authorized representative.

The Affirming Official electronically confirms in SPRS that the company complies with all Level 1 requirements. This is not a rubber stamp. The affirmation carries real legal weight — a false affirmation can expose the company to liability under the False Claims Act. That's why the person affirming needs to actually believe the assessment is accurate, which is another reason not to mark anything "met" that isn't.

Step 4: Keep your evidence — for six years

Level 1 is self-assessed, so no one reviews your evidence at submission time. But you're still required to keep it. Retain the artifacts behind each requirement — the proof that your controls are actually in place and working — for six years from your status date.

Two things matter here. First, evidence means proof the control functions, not just a written policy that says it should. Second, the fact that nobody checks today doesn't mean nobody ever will; reviews and spot checks happen, and "we did it but can't show it" is a weak place to be. Organize your evidence as you go, while it's fresh.

Step 5: Do it again every year

A Level 1 self-assessment and affirmation aren't one-and-done. You have to re-assess and re-affirm every 12 months to keep your status current. A lapsed affirmation ends your contract eligibility just as surely as a failed assessment would — so put the renewal date on the calendar the day you submit.

Why this matters right now

Under the current rollout, a submitted self-assessment and affirmation in SPRS is a prerequisite for winning or keeping DoD contracts that require Level 1. No record in SPRS, no eligibility — regardless of how compliant you actually are in practice. The contractors who get caught out are the ones who treated the paperwork as optional until an award was on the line.

The bottom line

The assessment is the work; SPRS and the affirmation are how that work becomes official. Meet all 15 requirements, get SPRS access through PIEE, enter your results, have a senior official affirm them, keep your evidence for six years, and renew every year. None of it is technically hard — it just has to actually get done.

The piece that trips people up is arriving at the submission confident they truly meet all 15, with the evidence to back it. That's the part worth getting right before you ever log into SPRS.

See exactly where you stand on CMMC Level 1.

CMMCheck walks you through every Level 1 requirement as plain-English yes / no / not-sure questions — no consultant, no jargon — and hands you a clear report showing what's done and what's left.

→ Start your Level 1 self-assessment at cmmcheck.com