According to the DoD, uploading a NIST self-assessment score is supposed to be as easy as an easy-bake pie. If you are a prime already doing business with the federal government, it might just be as easy as popping that Sara Lee into the oven and grabbing a can of whipped cream. Easy because as a prime you already have a CAGE code and access to both PIEE and SPRS, only lacking the SPRS Cyber Vendor User role.
If you don't even have a CAGE code, forget about Sara Lee, and get ready for some scratch baking!
What’s a CAGE code? How do I get one?
CAGE stands for Commercial and Government Entity. This is used as an identifier for your business and a specific business location. Companies often use a single CAGE code in contracts but may have many. You won’t actually register on the CAGE website, but rather the SAM.gov (System for Award Management) website. The CAGE(s) code will be assigned automatically through SAM registration. This part of the process is the longest, and you should check the website for posted registration delays. Also, with multiple cage codes, you will be required to establish a corporate hierarchy. Learn how to do it, and be accurate!
What’s a PIEE account? How do I get one?
PIEE stands for Procurement Integrated Enterprise Environment. SPRS, which we talk about next, is managed through the PIEE platform. PIEE is the “procure to pay” application for Federal contracting and is used to manage all aspects of the contract lifecycle. SPRS is one of the applications available through PIEE. To access any application in PIEE, your company will need to designate a Contract Administrator (CAM) during PIEE registration. Then you’ll need to establish your Vendor Group Structure (VGS) which is related, but different, to the CAGE hierarchy. Be accurate! (BTW, I think our crust is burning …)
Hurray! Now we can request SPRS access.
But, to access SPRS through PIEE, you must request the right SPRS role and receive authorization from your CAM (your company’s designated contract administrator)! (If you are in the Sara Lee category, this is likely the only step you missed). The NIST score entry role in SPRS is the Cyber Vendor User role. The Contractor/Vendor Support role allows you only to view your data. Now you can access SPRS to upload your score! Easy right? For smaller companies (or enterprises with centralized PIEE management): there are no rules against having all roles from SAM to SPRS assigned to the same person. This will allow all PIEE applications to be automatically authorized (assuming VGS is correct).
Tip: If practical, have one person handle score upload for all your CAGE codes, too.
So, your SPRS self-assessment score upload may be less like a pie you buy at the grocery store on the way to Christmas dinner, and more like a homemade, time-intensive family recipe, baked in hand-thrown bakeware in a wood-fired brick oven (you also built). Not as simple as we thought it would be, and a little bit of a process to procure our ingredients, but it can be done!