Step 1 — Register in SAM.gov
Free, done at sam.gov, and it assigns your UEI and CAGE code. Up to 10 business days to go Active, renewed every 365 days. The step everyone completes, and the one that makes the rest of the path visible.
New to Department of Defense work
Starting to look at Department of Defense contracts? This is the security path, in order.
Selling to the Department of Defense adds a cybersecurity process on top of the contracting one, and most new contractors meet it one piece at a time: SAM.gov first, then a clause nobody had read, then a SPRS score a prime asks for two days before a deadline, then CMMC. This page lays the whole path out once, in the order it happens, for companies learning it for the first time. Each step links to the page that covers it in depth.
Who this is for, and who wrote it
Cyberneza works with defense contractors going through this process for the first time.
Cyberneza is a veteran-owned, SAM.gov-registered cybersecurity and compliance firm whose founder is a Cyber AB CMMC Registered Practitioner with 29+ years of DoD, federal contracting, and enterprise security experience, including operations for the Department's first SaaS provider. The work is contract clause review, FCI and CUI scoping, CMMC Level 1 and Level 2 implementation, NIST SP 800-171 assessment and SPRS scoring, and the documentation and evidence that go with them. Cyberneza does not perform CMMC certification assessments; when a third-party assessment is required, the assessor stays independent.
If you are reading this because a prime just sent you a flow-down, a solicitation mentioned CMMC, or your SAM.gov registration just went Active and you are wondering what comes next, you are the reader this page was written for.
The path
Five steps, each with its own page.
Step 2 — Read the clauses in your first contract
Two kinds of information decide everything that follows. Federal Contract Information brings FAR 52.204-21 and 15 safeguards. Controlled Unclassified Information brings DFARS 252.204-7012 and NIST SP 800-171. Learn to tell them apart before the first contract arrives.
Step 3 — Get your result on record in SPRS
What goes in depends on step 2. FCI-only work records a CMMC Level 1 self-assessment result and affirmation; no NIST SP 800-171 score is required. Work involving CUI requires a current NIST SP 800-171 assessment score in the Supplier Performance Risk System before award. Either way it takes a PIEE account, a role approval, and an honest self-assessment, and primes check it before they check anything else.
Step 4 — Meet CMMC Level 1 or Level 2
The Department's mechanism for verifying the safeguards are in place. FCI only means Level 1: 15 requirements, annual self-assessment. CUI means Level 2: 110 requirements, a System Security Plan, evidence. Under the current Phase 1 both are self-assessments.
Step 5 — Keep it current
SAM.gov renews annually. CMMC requires an annual affirmation and, for Level 2, a reassessment every three years. The SPRS score ages out after three years. And the safeguards only count while they are running: logging, endpoint protection, identity, patching, awareness.
When the solicitation arrives
It will ask, in writing, how you protect government information: DFARS 7012 compliance, CMMC status, the SPRS score, incident response, flow-down. Sometimes that is a cybersecurity volume of its own. A first-time bidder rarely has anyone who has written one.
Before you buy anything
Scope decides cost. Deciding where CUI is allowed to live, before it arrives, is what keeps a Level 2 boundary to a few users and systems instead of the whole company.
How long each step takes
- SAM.gov: up to 10 business days to go Active once submitted, longer when entity validation or the IRS match needs correction.
- Reading the clauses: an afternoon with the solicitation and the prime's flow-down, if you know what you are looking for.
- SPRS: days to get the PIEE role approved and the score entered, once the self-assessment behind it is done. The assessment itself is the work.
- CMMC Level 1: typically weeks for a small company with a managed Microsoft 365 or Google Workspace environment.
- CMMC Level 2: months. A defined boundary, 110 requirements, a System Security Plan, and evidence that each requirement operates.
Where new contractors get stuck
- Paying a third party for a free SAM.gov registration, and losing the Entity Administrator role to them.
- Learning what CUI is from the first marked drawing that lands in the general email system.
- Entering a SPRS score of 110 with no System Security Plan behind it.
- Assuming CUI means a third-party C3PAO assessment, and either over-building or giving up. Under Phase 1, Level 2 Self is what most contracts require.
- Putting the whole company in scope because nobody decided where CUI would live.
- Finding all of the above at proposal time, when the only options left are to bid non-compliant or not bid.
The two questions that sort everything
Which level, and how much of the company.
What information will you handle
Statements of work, schedules, and contract correspondence are FCI, and nearly every contract has them: Level 1. Technical drawings, specifications, export-controlled data, and anything marked CUI: Level 2. When the solicitation is silent, ask the contracting officer or the prime in writing and keep the answer.
Where will it live
Email, laptops, file shares, cloud applications, and a subcontractor's systems all count if government information passes through them. A small, deliberate boundary, sometimes a secure enclave beside the existing environment, is what keeps a Level 2 effort proportionate to the contract that requires it.
Who is selling to you
The first weeks after a SAM.gov registration bring offers for registration services, GCC High migrations, and CMMC platforms. Some are right for some companies. None of them can be evaluated before the two questions above are answered, and several become unnecessary once they are.
Questions from companies new to DoD work
The questions that come up in the first month.
Do I need CMMC before I can bid on a DoD contract?
It depends on the clause in the solicitation. Where DFARS 252.204-7021 is included, the required CMMC level must be met at the time of award. Where DFARS 252.204-7019 is included, a current NIST SP 800-171 assessment score must be in SPRS before award. Neither stops you from submitting a proposal, but both stop an award, so the work has to be done before the proposal deadline you care about.
Does CMMC apply to civilian agency contracts?
No. CMMC is a Department of Defense program carried by DFARS clauses. Civilian contracts involving Federal Contract Information still carry FAR 52.204-21 and its 15 safeguards, and individual agencies add their own requirements, but the CMMC assessment and SPRS obligations are DoD-specific.
Is Level 2 always a third-party assessment?
Not under the current implementation. Phase 1 allows Level 2 Self, a self-assessment against the 110 NIST SP 800-171 requirements with an annual affirmation, and mandatory third-party C3PAO assessment requirements are suspended while the program is under review. The contract states which assessment type applies.
Can a small company do this without a compliance team?
Yes, and most do. Level 1 is 15 requirements that a well-run small environment largely meets already. Level 2 is larger, and the usual arrangement is outside help for scoping, implementation, and documentation while the company keeps the parts it must own: the self-assessment, the SPRS submission, and the affirmation, which a consultant cannot make on its behalf.
What does a consultant do, and what stays with us?
A consultant reads the clauses, defines the boundary, identifies gaps, implements or specifies the fixes, builds the System Security Plan and evidence, and prepares the score. The company performs the self-assessment, submits to SPRS, and signs the affirmation. The government-facing representations are the contractor's, and that line does not move.
What should we do first, this week?
Confirm the SAM.gov registration is Active and renewing. Confirm who your SAM.gov Electronic Business Point of Contact is, have them establish the company's Contractor Administrator in PIEE, then request the SPRS Cyber Vendor User role, because each approval takes time and nothing in SPRS can happen without them. Then decide, in writing, whether the work you intend to bid will involve CUI. That decision sets the level, the boundary, and the budget.
Tell Cyberneza where you are on the path.
Registered last week or bidding next month, send the kind of work you are going after, the agencies or primes you are targeting, and the systems you run today. Cyberneza will tell you which level applies, what the boundary should be, and what needs to happen in what order, before anything gets bought.