Custodia walkthrough

File your CMMC Level 1 self-assessment in SPRS — the guided version

SPRS and PIEE aren’t intuitive the first time. We wrote out every screen and every click so you finish the federal-side step correctly the first time. By the end you’ll have a posted Final Level 1 Self-Assessment record with a CMMC Status Date, and your Custodia bid packet will be unlocked along with your Statement of Compliance.

Open PIEE in a new tab →Open my Custodia assessment

Before you start — have these on hand

Don’t worry — your Custodia bid packet renders every one of these as a copy-to-clipboard chip, so you can paste them straight into SPRS without retyping.

What SPRS does NOT issue

A common misconception: SPRS does not issue a confirmation number, tracking code, or government-issued certificate when you post your Level 1 self-assessment. The federal record is the combination of Status: “Final Level 1 Self-Assessment” and the CMMC Status Date SPRS stamps on the record. That date is what Custodia stores, what your Statement of Compliance quotes, and what primes will look up by your CAGE when they verify your filing.

  1. 1

    Confirm the right PIEE role on your CAGE

    SPRS is a tile inside the Procurement Integrated Enterprise Environment (PIEE). To post a CMMC Level 1 self-assessment you need the SPRS Cyber Vendor User role on the CAGE your company files under. The default Contractor/Vendor (Support Role)is view-only and cannot file. If you don’t see “Cyber Reports” inside the SPRS tile, your role isn’t Cyber Vendor User yet.
  2. 2

    Wait for your CAM to activate the role (1–5 business days)

    Every PIEE role request is reviewed by your company’s Contract Account Manager (CAM). If you are the first / only person on your CAGE, the CAM is you— but you can’t activate your own SPRS Cyber Vendor User role from inside the PIEE UI. You have to email the DISA Global Service Desk to do it for you. Activation typically takes 1–5 business days; don’t start the SPRS filing until the role shows active.
  3. 3

    Log into PIEE and open SPRS → Cyber Reports

    Go to piee.eb.mil and log in. On the PIEE landing screen click the SPRS tile. Inside SPRS, click Cyber Reportsin the left navigation. (If you don’t see Cyber Reports, your role activation from step 2 hasn’t taken effect yet.)
  4. 4

    Pick your CAGE from the hierarchy dropdown

    SPRS shows a Highest Level Owner (HLO)dropdown seeded from the CAGE hierarchy SAM imports automatically. Pick the CAGE you’re filing for. CAGEs your Cyber Vendor User role covers are marked with an asterisk (*) — if your CAGE isn’t starred, go back to step 1 and check the role provisioning.
  5. 5

    Open the CMMC Assessments tab → Add New Level 1 CMMC Self-Assessment

    Inside Cyber Reports, click the CMMC Assessments tab (the tab where Level 1 / Level 2 records live — distinct from the legacy NIST 800-171 scoring tab). Click Add New Level 1 CMMC Self-Assessment. SPRS opens a form titled “Level 1 CMMC Self-Assessment.”
  6. 6

    Fill in the assessment details (Custodia gives you every value)

    SPRS asks for a handful of fields: Assessment Date, Assessment Scope, Compliance Status, Affirming Official Name / Title / Email, System Security Plan reference. Each one is already captured inside your Custodia workspace — open your assessment’s bid-ready packet and use the “Copy these into SPRS” card to paste each field in order. When the form is complete click Continue to Affirmation.
  7. 7

    Affirm — or Transfer to the Affirming Official

    If you ARE the Affirming Official (e.g. owner / CISO / Senior Official with binding authority), click Affirm. Otherwise enter the AO’s email and click Transfer to AO. SPRS will email them with a link to come into PIEE, open this record, and click Affirm themselves. Until the AO affirms, the record stays in a draft state and is not visible to government contracting personnel.
  8. 8

    Status flips to Final Level 1 Self-Assessment — note the CMMC Status Date

    Once the Affirming Official clicks Affirm, the SPRS record posts with two visible fields: Status: Final Level 1 Self-Assessment and a CMMC Status Date (the posting date). The status line is the ONLY status string government personnel see; the Status Date is the ONLY date that constitutes the federal artifact. SPRS does not issue a separate confirmation number — the Status + Status Date are the record.
  9. 9

    Return to Custodia and paste the CMMC Status Date

    Come back to Custodia → your assessment’s bid-ready packet. The “Final step · File in SPRS” card has a date picker for the CMMC Status Date. Pick the date SPRS posted and click Record SPRS filing. We’ll email you a receipt, unlock your Statement of Compliance, and start counting down to your next annual re-affirmation (Sep 30 of the following federal fiscal year, per 32 CFR § 170.22).

Once SPRS posts your record — come back here

Open your Custodia assessment’s bid-ready packet, paste the CMMC Status Date into the “Final step · File in SPRS” card, and you’re done for this fiscal year. We’ll email a receipt, unlock your Statement of Compliance, and start your 60 / 30 / 14-day reminders before next year’s re-affirmation deadline.

Go to my assessment →