The SPRS Level 1 affirmation: how it works and who signs

What SPRS is

The Supplier Performance Risk System (SPRS) is the DoD system where CMMC self-assessment results and affirmations are recorded. Contracting officers check your status there before award. Under 32 CFR 170.22, affirmations are entered electronically in SPRS, and all of them have to be completed there.

Before you start: access

SPRS is reached through PIEE, the DoD procurement portal. According to an August 2026 SPRS briefing for suppliers from Johns Hopkins APL:

• The person entering the assessment needs the SPRS Cyber Vendor User role. Without it, the assessment option may not show up.
• Your company's PIEE Contractor Administrator (CAM) approves that role. CAMs can't approve their own roles, so you may need the PIEE help desk.
• The Affirming Official also needs the SPRS Cyber Vendor User role.
• Your CAGE hierarchy in SAM has to be correct, or you may not be able to select all your CAGE codes and your Affirming Official may not see the assessment.

What gets entered

For a Level 1 self-assessment, the APL briefing lists these fields:

• Assessment date
• Assessment scope: enterprise or enclave
• Number of employees
• FAR 52.204-21 compliance
• Included CAGE codes, meaning the CAGEs with access to the systems that were assessed

32 CFR 170.15 lists the required content as the CMMC level, the CMMC Status Date, the assessment scope, all CAGE codes tied to the in-scope systems, and the compliance result.

Who signs: the Affirming Official

32 CFR 170.4 defines the Affirming Official as the senior-level representative from within your company who is responsible for your CMMC compliance and has the authority to affirm continuing compliance. Every company, prime or subcontractor, needs one.

The affirmation includes the official's name, title and contact information, and a statement that your company has implemented, and will keep implementing, all applicable requirements. In the APL briefing, the Affirming Official logs in, checks their personal information, reviews the results, then affirms.

Timing, under 32 CFR 170.22: an affirmation is required when you reach Final status, then annually after that.

Things to know after you affirm

• Per the APL briefing, contracting officers can't see the record until it's affirmed for the first time.
• After affirmation, CAGE codes can't be added or changed on that assessment, so get them right first.
• Under DFARS 252.204-7021, primes have to confirm a subcontractor's current status before award. Subcontractors may share screenshots of their results with primes.
• Under DFARS 252.204-7021, a Level 1 status is only current if it's under one year old with no changes in compliance since, and the affirmation is under one year old too.

What happens if it's wrong

The APL briefing notes that False Claims Act language applies to the affirmation. A false affirmation can create exposure under the False Claims Act (31 U.S.C. 3729), which provides for three times the government's damages plus a civil penalty per claim, adjusted for inflation. "Knowingly" includes reckless disregard and deliberate ignorance, and no specific intent to defraud is required.

The Justice Department has used the False Claims Act against contractors over cybersecurity since it launched its Civil Cyber-Fraud Initiative on October 7, 2021. One recent example: on June 18, 2026, DOJ announced that LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve allegations that it submitted false claims on two Navy contracts while not meeting their cybersecurity requirements. The allegations involved NIST SP 800-171 controls (the Level 2 standard, not Level 1), and a DCMA assessment scored the company at -170 on a scale of -203 to 110. DOJ noted the claims are allegations only, with no determination of liability.

The lesson for Level 1 is simple: affirm only what you can prove, and keep the proof. If you're unsure about your exposure, talk to a government contracts attorney.

Onyx walks your Affirming Official through the entry and gives you a PDF of the record. See pricing.

Common questions

Can our IT provider or consultant affirm for us?

No. Under 32 CFR 170.4, the Affirming Official is a senior-level representative from within your own company with authority to affirm compliance. Outside help can prepare you, but your official signs.

How often do we affirm?

When you reach Final Level 1 status, then annually. Under DFARS 252.204-7021, the affirmation can't be more than one year old for your status to be current.

Does Level 1 have an SPRS score?

No. Level 1 is scored MET or NOT MET for each requirement, and all must be MET. The numeric SPRS score you may have heard about, -203 to 110, is for NIST SP 800-171.

What if something changes after we affirm?

DFARS 252.204-7021 treats a status as current only if there have been no changes in compliance since the status date. If something you affirmed stops being true, fix it and talk to counsel or your contracting officer about what to update.

Can we change our CAGE codes after affirming?

According to the August 2026 APL SPRS briefing, CAGE codes can't be added or changed once the assessment is affirmed, so confirm them first.

Sources

• 32 CFR 170.22, Affirmation (Cornell LII)
• 32 CFR 170.4, definitions incl. Affirming Official (eCFR)
• 32 CFR 170.15, CMMC Level 1 self-assessment (eCFR)
• DFARS 252.204-7021, Contractor Compliance with CMMC Level Requirements (acquisition.gov)
• Johns Hopkins APL, CMMC Supplier Webinar: SPRS Updates (Aug 2026)
• Cozen O'Connor, CMMC goes into effect on November 10, 2025
• 31 U.S.C. 3729, False Claims Act (Cornell LII)
• Crowell & Moring, DOJ launches Civil Cyber-Fraud Initiative (Oct 2021)
• U.S. Department of Justice, Alabama defense contractor agrees to pay $507,144 (June 18, 2026)

General information, not legal advice. Back to Onyx home.