How to Prepare for a Defensible SPRS Assessment Submission

Identify the assessment you are submitting

Distinguish a NIST SP 800-171 assessment record from a CMMC self-assessment record and its associated status and affirmation. Review your governing contract and any applicable deviations to establish the correct path, current method, reporting fields, and responsible organizational official. A prior assessment record should not simply be relabeled as a new CMMC result.

Make the scope and SSP traceable

Confirm that the assessment covers the intended information systems and CAGE codes. Keep the SSP version, environment description, assessment date, and recorded scope aligned. Shared infrastructure, cloud services, and provider responsibilities need to be considered before deciding that the assessment represents the relevant environment.

• Approve the boundary and identify the systems reviewed.
• Record the methodology and baseline used.
• Keep assessment evidence linked to the relevant requirement and scope.

Assess first, calculate second

Use the applicable procedures to determine whether requirements are implemented. Examine evidence, interview personnel, and test relevant practices rather than assigning a desired score and working backward. Record unresolved findings and preserve the rationale for conclusions. Apply the correct scoring method, including its treatment of partial implementation and requirements assessed as not applicable.

Keep findings, status, and affirmation distinct

A gap list is not an acceptable CMMC conditional status by itself. For Level 2, the rule limits which unmet requirements may be placed on a POA&M, sets a minimum score, and requires eligible items to be closed within 180 days. Level 1 permits no POA&M.

An assessment score describes evaluated implementation. An affirmation confirms continued compliance through the authorized organizational official. Confirm the reporting and affirmation steps separately, then retain the underlying assessment package under applicable record requirements.

Use a documented internal review before entry

Have the assessment owner and authorized official review the scope, evidence exceptions, calculations, and remaining obligations before submitting. Confirm the required PIEE/SPRS role and access using official guidance. Continuum can support evidence review and readiness preparation; organizational officials retain responsibility for their submissions and affirmations.