Question 1

What is CSA Tool?

Accepted Answer

CSA Tool is a web-based platform that helps defense contractors perform NIST SP 800-171 and CMMC self-assessments, calculate their SPRS score, and prepare for compliance with Department of Defense cybersecurity requirements.

Question 2

How do I submit my SPRS score to PIEE?

Accepted Answer

To submit your SPRS score, log into the Procurement Integrated Enterprise Environment (PIEE) portal, access the Supplier Performance Risk System (SPRS) module, and enter your NIST 800-171 self-assessment score. CSA Tool provides guidance on calculating and preparing your score for submission.

Question 3

How do I get a CAGE Code?

Accepted Answer

A CAGE Code (Commercial and Government Entity Code) can be obtained by registering your business in the System for Award Management (SAM.gov). Once registration is complete, a CAGE Code will be assigned automatically and used for DoD contract compliance and SPRS submissions.

Question 4

How do I find a C3PAO for CMMC Level 2 certification?

Accepted Answer

Certified Third-Party Assessment Organizations (C3PAOs) are authorized by the Cyber AB to perform CMMC Level 2 assessments. You can find an accredited C3PAO through the Cyber AB Marketplace at https://cyberab.org/marketplace. CSA Tool helps organizations prepare for C3PAO audits by identifying compliance gaps.

Question 5

What are the requirements for a CMMC assessment?

Accepted Answer

A CMMC assessment evaluates your organization’s compliance with NIST SP 800-171 security requirements. For CMMC Level 2, contractors must implement all 110 controls, conduct a self-assessment, and in many cases undergo a third-party assessment by a C3PAO. The results, including your SPRS score, must be submitted through the SPRS portal in PIEE.

Question 6

What CFR rulings cover CMMC and DoD contracts?

Accepted Answer

CMMC requirements are codified in the Defense Federal Acquisition Regulation Supplement (DFARS). Specifically, DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021 require defense contractors to comply with NIST SP 800-171, report SPRS scores, and achieve the appropriate CMMC level for contract eligibility.

Start your CMMC self assessment