To verify a cybersecurity vendor for a DoD contract, match the contract’s required CMMC level and assessment type to the current SPRS status for each applicable CMMC UID—the identifier associated with an assessed contractor information system. First establish which systems and services will handle the contract’s FCI or CUI. A company-wide compliance claim, badge, or certificate image does not prove that the system used for your work has the required status.
Start with the solicitation and the systems it covers
The solicitation or contract determines the required CMMC level and assessment type; requirements can differ between procurements. The CMMC program applies to covered DoD work involving Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor information systems, subject to phase-in, contract conditions, and exceptions.
As an Amazon Associate I earn from qualifying purchases.
Before asking a vendor for proof, identify the information and services involved. Map which vendor-operated or vendor-supported systems will process, store, or transmit FCI or CUI, or provide security protection for that information. Ask the vendor to explain how those systems and the service it will deliver fit within its CMMC assessment scope. A status for a different system, business unit, or environment may not establish that the proposed service meets the contract requirement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the vendor’s status in SPRS
Under DFARS 204.7503(b), the contracting officer checks the Supplier Performance Risk System (SPRS) before award and for options or extensions. The check is for a current status at the level required by the solicitation, or higher, for each relevant CMMC UID supplied for the offeror’s systems. Use the authorized procurement process to confirm the record; treat a vendor screenshot or sales statement as supporting information, not as the official verification.
- Confirm the requirement. Record the solicitation’s CMMC level and assessment type, including whether it calls for a self-assessment, third-party certification, or DIBCAC assessment.
- Define the service boundary. List the systems and services that will handle covered information or provide security protection, then ask the vendor to map them to its assessment scope.
- Request identifiers and status details. Ask for the CMMC UID for each in-scope contractor information system, the associated CAGE code or codes, the status and level, the status date, and confirmation that the required affirmation is current. SPRS inputs include assessment scope, CAGE codes, a score or compliance result, and a status date, depending on level.
- Have the authorized reviewer check SPRS. Confirm the current posted status for every applicable UID and compare it with the level and assessment type in the procurement requirement.
- Check the status conditions. Review its currency, any POA&M closeout deadline, and the affirmation record rather than relying on the age or appearance of a certificate.
- Resolve subcontract and flow-down questions. Establish whether the vendor is a prime or subcontractor, which systems support the work, and whether applicable CMMC requirements have been flowed down to qualifying subcontractors.
Match the assessment route—not just the level
CMMC has multiple assessment routes. The words “Level 2” alone are not enough to show that a vendor meets a solicitation that specifies a particular route.
| Assessment route | What to match in the procurement check |
|---|---|
| Level 1 self-assessment | Confirm the solicitation calls for this route and that the applicable system UID has the required current status. |
| Level 2 self-assessment | Confirm the solicitation accepts a self-assessment; it is not interchangeable with Level 2 C3PAO certification. |
| Level 2 C3PAO certification | Confirm the solicitation requires or accepts third-party certification and that the SPRS status for each applicable UID reflects the required route. |
| Level 3 DIBCAC assessment | Confirm the solicitation’s required level and route against the posted status for each applicable UID. |
“Conditional” and “Final” are distinct status states. A Conditional status is limited to 180 days and depends on compliance remaining unchanged, required affirmation, and timely closure of applicable POA&M items. Final-status validity periods vary by level and assessment route and are generally measured in one- or three-year windows under the applicable rules. Affirmations recur annually. Check the actual SPRS record and the current regulation for the precise conditions and dates that apply to the vendor’s status.
Rank #2
Check managed security providers and cloud services
A cybersecurity or managed service provider may be an external service provider (ESP) when it supplies IT or cybersecurity services and CUI or security protection data is processed, stored, or transmitted on its people, technology, or facilities. Ask the provider for a service description and customer responsibility matrix (CRM), and determine whether its services are included in the customer’s CMMC assessment scope. ESP services used to meet CMMC requirements are documented in the organization’s system security plan and may be assessed as part of that organization’s assessment. An ESP may voluntarily obtain certification to reduce assessment effort, but the rules do not mean every ESP must hold a separate CMMC certificate; the contract requirement drives the minimum assessment type.
For a cloud service processing CUI, check the exact service offering and its evidence of FedRAMP Moderate-or-higher authorization or the equivalent security requirements described by DoD policy. Do not rely on a provider-wide brand claim. The customer’s infrastructure connecting to the cloud service is also within assessment scope.
Compare vendors on the evidence that matters
For two cybersecurity vendors or managed-service offerings, compare the following before deciding whether either one fits the procurement requirement:
- Whether the assessed system and service boundary match the work being proposed.
- The required level and route: self-assessment, C3PAO certification, or DIBCAC assessment.
- The current status date and annual affirmation for each relevant UID.
- How the vendor and its subprocessors handle CUI and security protection data.
- Cloud authorization or equivalent evidence for the specific cloud service, when applicable.
- Whether the scope, service description, CRM, CAGE codes, and UID mapping are clear enough for the authorized reviewer to verify.
Common verification mistakes
- Searching only by company name: Match the UID to the actual system supporting the contract; a company-level statement does not answer that system-specific question.
- Accepting the wrong Level 2 route: A Level 2 self-assessment does not substitute for a required Level 2 C3PAO certification.
- Treating Conditional as an unrestricted pass: Check the 180-day period, affirmation, and any POA&M closeout conditions.
- Assuming every IT vendor needs its own certificate: ESP treatment depends on whether covered information or security protection data is handled on the provider’s assets and how the services fit the customer’s scope.
- Relying on a generic certification claim: Verify that the offering, system, scope, contract route, status, and affirmation all line up.
What can be checked publicly?
The official materials reviewed do not establish a public, company-name lookup that reveals another organization’s UID-specific SPRS status. Ask the vendor for the relevant identifiers and use the authorized procurement-side SPRS check. The vendor’s own statement can help identify records to review, but it is not a substitute for confirming them through that process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check the live requirement before award
The eCFR Title 32 material was current through October 1, 2026 and reported a last amendment date of August 17, 2026; DFARS Subpart 204.75 showed a revision date of November 10, 2025. Because implementation dates, acquisition clauses, vendor scopes, and posted statuses can change, verify the live solicitation, applicable rule, and SPRS record at the time of procurement.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
