Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Finish · Attest and file · the record
The entry Elena R. Marsh, Meridian Defense Systems, Inc.'s senior official, posted in the SPRS CMMC Assessments module through PIEE: the scope, the CAGE codes it covers, the score, the plan of action it used and closed, and both status dates. That posting, not the platform, is the official CMMC record.
Contracting officers check SPRS before award. A Level 2 (Self) status meets a solicitation that names Level 2 (Self), and a solicitation that names Level 1 as well, since a higher status covers a lower one.
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
Every affirmation on the record, the 32 CFR 170.22(a)(3) record: at the assessment, after the POA&M closeout, and every year after. The next one is due July 22, 2027.
Your team builds the System Security Plan and the evidence on the platform, a credentialed officer reviews every step, and your senior official signs and posts the affirmation in SPRS.
The readiness checks and the clocks →The score and the closed plan of action →The sealed versions →
Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.