A clear, step-by-step guide to accessing the Supplier Performance Risk System — from PIEE account setup through NIST SP 800-171 and CMMC self-assessment submission.
The foundational system every DOW (Department of War) contractor must understand before starting compliance.
SPRS is the authoritative Department of War (DOW) system for collecting, processing, and displaying vendor performance information. It is the single authorized source for contractor cybersecurity assessments required by DFARS 252.204-7012.
All DOW contractors who handle Controlled Unclassified Information (CUI) or Federal Contract Information are required to have a score on record in SPRS.
SPRS is accessed through the Procurement Integrated Enterprise Environment (PIEE), which provides single sign-on for a variety of acquisition-related DOW applications.
piee.eb.milTo view, enter, edit, or delete Cyber Assessments, your PIEE account must be assigned the "SPRS Cyber Vendor User" role, approved by your Contractor Account Administrator (CAM).
Your SPRS score reflects your implementation of the 110 NIST SP 800-171 security controls. Scores range from -203 to +110. Contracting officers review this score when awarding DOW contracts.
Before you can register, have these identifiers ready. These are the credentials associated with Lionfish Cyber Holdings LLC.
Follow these steps in order. You must complete PIEE setup before you can access SPRS.
Before registering online, a company representative must contact the PIEE Help Desk to have your CAGE Code (96LH8) added to a Vendor Group in the system. This must happen before any employees can register for PIEE applications.
Once your CAGE Code has been added to a Vendor Group, navigate to the PIEE portal and create your account.
After your PIEE account is created, you must request the specific role needed to access SPRS Cyber Reports. This role is required to submit any cybersecurity assessments.
Once your role is approved, here is how to navigate to the SPRS Cyber Reports module.
The NIST SP 800-171 Basic Self-Assessment is required for all DOW (Department of War) contractors handling CUI. Your score is calculated from 110 security controls.
Published by the National Institute of Standards and Technology (NIST), SP 800-171 defines 110 security requirements to protect Controlled Unclassified Information (CUI) in nonfederal systems. DOW (Department of War) requires contractors to assess themselves against these controls and submit the score to SPRS.
The Cybersecurity Maturity Model Certification (CMMC) is the DOW's (Department of War) framework for verifying contractor cybersecurity practices. Learn the difference between Level 1 and Level 2 assessments.
Three tiered levels of cybersecurity maturity — each with increasing requirements and assessment rigor.
Applies to contractors handling Federal Contract Information (FCI). Covers 15 practices aligned with FAR 52.204-21. Annual self-assessment is required.
Applies to contractors handling Controlled Unclassified Information (CUI). Aligns with all 110 NIST SP 800-171 practices. Self-assessments are allowed for some programs; others require a C3PAO assessment.
All the official DOW (Department of War) and DISA resources you need throughout the registration process.
Main login portal for all PIEE applications including SPRS
piee.eb.milOfficial step-by-step PIEE vendor onboarding instructions
piee.eb.mil/vendor-guideStep-by-step guide for gaining PIEE/SPRS access as a vendor
sprs.csd.disa.mil/access.htmDirect link to the PIEE application login and launch page
piee.eb.mil/piee-landing/Mon–Fri, 06:30 – 24:00 EST
866-618-5988For ticket requests and CAGE code additions
disa.global.servicedesk.mbx.eb-ticket-requests@mail.milUse this interactive checklist to track your progress through the SPRS registration process.