Technical Guide #2: How to Access SPRS, and How It Interacts With Your SAM.gov Account

By Josh Hammer

The application itself is not difficult to use. The delay usually happens earlier. A SAM.gov registration is not active. A CAGE code is missing from the PIEE vendor structure. Nobody has been appointed as the Contractor Account Administrator. Or the user requests a view-only role when they actually need permission to enter assessment data.

Those dependencies must be resolved in the right order.

This guide walks through the full process: how SAM.gov, CAGE, PIEE, the Contractor Account Administrator, and SPRS fit together; the exact clicks for both access paths; the most common failure points; and what you need to do after you get in.

Important: SPRS access is an administrative step. It does not complete your NIST SP 800-171 or CMMC assessment. Before selecting a compliance tool, audit your environment, define the assessment scope, and build a remediation plan. The tool comes third.

What SPRS is and why you need access

The Supplier Performance Risk System, or SPRS, is the Department of Defense system used to record and review supplier performance and cyber assessment information.

For contractors, the relevant area is the cyber reporting functionality. This is where authorized vendor users enter or manage:

• NIST SP 800-171 self-assessment results
• CMMC self-assessment results, where applicable
• Assessment scope and status information
• Associated CAGE codes
• Assessment dates and compliance results

You do not log into SPRS directly. You access SPRS through the Department of Defense’s Procurement Integrated Enterprise Environment, or PIEE.

The access path is:

SAM.gov → CAGE code → PIEE vendor structure → PIEE account and role → SPRS

If you are working through the broader entry point for defense compliance and need the prerequisite context, start with how to get CMMC Level 1.

For contracts that include the relevant DFARS requirements, a current NIST SP 800-171 self-assessment score posted in SPRS is part of the award process. DFARS 252.204-7019 and DFARS 252.204-7020 establish the requirement to maintain and report the applicable assessment information.

The Department has paused CMMC Phase II third-party assessment requirements, but that pause does not eliminate existing self-assessment and affirmation obligations. It also does not eliminate the underlying responsibility to protect covered defense information under applicable contract clauses.

You can review the official SPRS access instructions in the SPRS New User guide, the existing PIEE account guide, and the SPRS NIST SP 800-171 access guide.

The four dependencies that control SPRS access

Before you try to register, confirm these four conditions. Each one can block the next.

1. Your SAM.gov registration must be active

Your company must have an active registration in the System for Award Management.

Check the following in SAM.gov:

• Registration status is active
• Registration has not expired
• Entity information is current
• Your CAGE code is reflected
• The appropriate Electronic Business Point of Contact, or EB POC, is listed

A registration that is expired, submitted, or still in work-in-progress status can prevent the information from flowing correctly into PIEE and SPRS.

Start by checking your entity record in SAM.gov. Do not begin the PIEE registration process until the SAM record is active and accurate.

2. Your CAGE code must exist in PIEE

Your Commercial and Government Entity code, or CAGE code, identifies your company in the federal procurement environment.

The CAGE code must be:

1. Assigned to your entity
2. Correctly reflected in SAM.gov
3. Added to the PIEE Vendor Group Structure

That step only makes sense if you have already determined whether you handle FCI or CUI, because scope and data type drive what you are ultimately reporting and defending.

If your CAGE code is not in the PIEE vendor group structure, the registration process may show an error stating that there are no groups or no Contractor Account Administrators for the location code.

A company representative must contact the PIEE Help Desk and request that the CAGE code be added. The representative should provide the CAGE code and, if required, the preferred vendor group name.

The PIEE vendor getting started guide identifies this as a required setup step.

3. A Contractor Account Administrator must exist

The Contractor Account Administrator, or CAM, is the person who approves PIEE access and role requests for your company.

If your company does not have a CAM, your request has nowhere to go.

The CAM must be associated with the relevant CAGE and must be registered in PIEE. The EB POC listed in SAM.gov can serve as the CAM or designate another person, subject to the PIEE process.

This is frequently the real bottleneck for small companies. The IT person may be ready to register, but nobody has taken responsibility for administering the vendor group.

At least one CAM must be appointed and active before other users can reliably obtain SPRS roles.

4. You must request the correct role

PIEE roles determine what you can do after you reach SPRS.

If you only need to monitor your company’s information, request the Contractor/Vendor (Support Role).

If you need to enter or update an assessment score, request SPRS Cyber Vendor User.

A common mistake is requesting the support role and then assuming the account is broken because the assessment entry screens are missing. The account may be working correctly. The user simply has the wrong role.

Path A: You do not have a PIEE account

Use this path if you have never registered for PIEE.

Step 1: Open the PIEE homepage

Go to the PIEE login page.

Select New User.

Step 2: Open vendor registration help

Select New Vendor Organization - Getting Started Help.

Review the preliminary setup requirements. If your CAGE code is not already in the PIEE Vendor Group Structure, stop here and contact the PIEE Help Desk.

Once the vendor group exists, select Register.

Step 3: Accept the privacy statement

Read the privacy statement and select Agree.

Step 4: Select the user type

When PIEE asks what type of user you are, select:

Vendor

Do not select a government or government support contractor option. Selecting the wrong user type can prevent the SPRS vendor roles from appearing later.

Step 5: Create your authentication method

Follow the registration prompts to create your user ID and password or select another available authentication method.

Use your own individual account. Do not share a PIEE login with another employee.

Step 6: Complete your profile

Enter the requested information under:

• User Profile
• Supervisor / Company

Use company information that matches the applicable vendor record.

Step 7: Select SPRS and request your role

In the application list, select:

SPRS - Supplier Performance Risk System

From the available roles, select one or both:

• Contractor/Vendor (Support Role)
• SPRS Cyber Vendor User

Select Add Roles.

When prompted, enter the applicable Location Code / CAGE. If your company has multiple CAGE codes, repeat the role request for each CAGE that must be associated with your access.

Step 8: Complete and submit the registration

Follow the remaining prompts for:

• Justification
• Summary
• Agreement

Submit the registration.

Your PIEE account and your SPRS role request are separate parts of the process. The account may be created, but the SPRS role still requires CAM activation.

Step 9: Wait for CAM approval

The request is sent to the CAM associated with the CAGE code.

Your access is active after the CAM approves the role. If you do not know who the CAM is, use the Find My Account Administrator option on the PIEE login page.

In the special case where there is only one CAM and that person is requesting a role for themselves, the request may be automatically activated. The user should log out and back into PIEE before testing access.

Path B: You already have a PIEE account

Use this path if you can already log into PIEE but do not have the SPRS role.

Step 1: Log in to PIEE

Open the PIEE login page and sign in.

Step 2: Open your account settings

From the header, select:

My Account → Add Additional Roles

Step 3: Verify your profile

Follow the prompts to verify your:

• User profile
• Supervisor / Agency information

Step 4: Select the SPRS application

From the application list, select:

SPRS - Supplier Performance Risk System

Step 5: Select the correct role

Choose:

• Contractor/Vendor (Support Role) for monitoring and viewing
• SPRS Cyber Vendor User for entering, editing, or affirming NIST and CMMC information

Select Add Roles.

Step 6: Enter the CAGE code

Enter the appropriate Location Code / CAGE.

If multiple CAGE codes are relevant to your company structure or assessment reporting, repeat the role request for each required code.

Step 7: Submit for approval

Complete the justification, summary, and agreement steps. Submit the request.

The CAM must approve the role. If the request remains pending, contact the CAM directly. A help desk cannot replace the company approval step.

What usually blocks access

If a CAGE code is missing from SPRS, first verify the CAGE and ownership information in SAM.gov.

SPRS imports entity and CAGE relationships from government systems. Changes may take time to flow through.

Also check your browser. The SPRS FAQ identifies current versions of Google Chrome, Microsoft Edge, and Mozilla Firefox as the preferred browsers.

What you do after you get into SPRS

After your PIEE role is approved:

1. Log into PIEE.
2. Select the SPRS tile.
3. Open Cyber Reports.
4. Select the NIST or CMMC function appropriate to your task.

Entering a NIST SP 800-171 self-assessment

To enter a NIST SP 800-171 assessment, you need the SPRS Cyber Vendor User role.

You should already have completed the underlying assessment and determined the score before opening SPRS. SPRS is the reporting repository. It is not where you perform the technical assessment.

Have the following information available:

• Your assessment score
• Assessment date
• Assessing scope
• Applicable CAGE codes
• Your System Security Plan information
• Any relevant remediation or POA&M information required by the applicable process

The score should reflect the actual condition of the assessed environment. Do not use a score as a placeholder while you are still determining whether controls are implemented.

Entering CMMC self-assessment information

Where applicable, the CMMC entry requires information such as:

• CMMC Level
• CMMC Status Date
• CMMC Assessment Scope
• Associated CAGE codes
• Compliance result or status

For CMMC, distinguish the assessment scope from the company’s administrative CAGE hierarchy. A CAGE code helps identify and manage the vendor record, but the assessment scope must accurately describe the systems and environment covered by the self-assessment.

CMMC Phase II third-party assessments are paused, but that does not make a self-assessment record meaningless. Applicable self-assessment and affirmation obligations remain. Your contract, solicitation, and current DoD guidance control what must be entered and maintained.

The annual affirmation

For a CMMC self-assessment, the record may require an annual affirmation by the company’s Affirming Official.

The Affirming Official is a senior representative with authority to affirm the organization’s continuing compliance. The official electronically reviews and affirms the assessment in SPRS.

This is self-attestation. It is not the same as a third-party assessment or certification.

It also carries legal and operational weight. The affirmation should be supported by current policies, system documentation, technical evidence, remediation records, and management review.

The need for accuracy is not theoretical. In September 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations involving failures to comply with NIST SP 800-171 requirements on a DoD contract network. The allegations covered conduct from April 2020 through December 2023; the settlement itself did not constitute a determination of liability. The Nixon Peabody alert provides the case details.

The practical lesson is simple: your SPRS record, assessment scope, System Security Plan, POA&M, and actual controls must tell the same story.

Do this in order: printable checklist

1. Confirm your entity registration is active in SAM.gov.
2. Check the SAM expiration date and verify that entity information is current.
3. Confirm that the correct CAGE code is reflected in SAM.gov.
4. Verify that the CAGE code exists in the PIEE Vendor Group Structure.
5. Contact the PIEE Help Desk if the CAGE code is missing.
6. Appoint at least one CAM for the vendor group.
7. Ensure the CAM is registered and active in PIEE.
8. Create a PIEE Vendor account or log into your existing account.
9. Request Support Role for viewing or SPRS Cyber Vendor User for data entry.
10. Obtain CAM approval, then log into SPRS and verify the Cyber Reports screens.

Keeping your SPRS record supportable

Getting into SPRS is only the first administrative step. The recurring problem is keeping the score current, keeping the scope accurate, and producing the evidence behind the submission when someone asks for it.

That is especially true when your supporting controls live in business systems your team uses every day. If you need an example of how administrative claims and technical evidence must line up, review our guide to configuring Microsoft 365 for compliance.

Sources

• SPRS New User guide
• SPRS guide for users with an existing PIEE account
• SPRS NIST SP 800-171 access guide
• PIEE vendor getting started guide
• SAM.gov
• Nixon Peabody alert on the Honeywell Aerospace False Claims Act settlement

Read next in this series: How to Get CMMC Level 1, How to Determine Whether You Handle FCI or CUI, and the free compliance readiness check.

Complynt is an enterprise compliance automation platform for control mapping, evidence collection, continuous monitoring, pre-built content packs, and policy-as-code across more than 150 frameworks, including CMMC, NIST SP 800-171, NIST 800-53 compliance automation, RMF, SOC 2, HIPAA, and ISO 27001. It runs on FedRAMP High and DoD IL5 authorized infrastructure on Palantir’s federal cloud. H&V is EDWOSB certified. H&V does not issue certifications and cannot guarantee any assessment outcome. The right sequence remains audit first, plan second, tools third. To assess your starting point, use the free compliance readiness check or visit hvfsusa.com.