IAM has added a new guide to its CMMC Resource Center. It sets out the steps and a working timeline for transportation service providers (TSPs), agents, and subcontractors to get the CMMC unique identifier (UID) they will need to carry DP3 shipments. Level 2 self-assessments must be entered and affirmed in the Supplier Performance Risk System (SPRS) by March 1, 2027.
The CMMC UID must be provided to the Personal Property Activity (PPA) so it can verify a company’s Level 2 self-assessment in SPRS. Companies will need it in order to be awarded DP3 shipments on or after May 15, 2027. DP3-qualified TSPs already had to self-attest to Level 1, but subcontractors did not have to record their attestation in SPRS. Under new PPA guidance, subcontractors must now be registered in SPRS as well, and agents and subcontractors must complete their own assessments.
The one-page guide covers three government systems. First, register in SAM.gov to get a CAGE code, which typically takes two to four weeks. Next, request the SPRS Cyber Vendor User role through PIEE, which takes one to two weeks. Finally, enter and affirm the Level 2 self-assessment in SPRS, which generates the CMMC UID to be emailed to DPMO. The guide stresses that the self-assessment itself is the longest step, often taking weeks to months. Companies must assess all 110 NIST SP 800-171 requirements, write a System Security Plan, and track open items in a plan of action and milestones (POA&M). The guide advises starting now, alongside the registrations. A full score is 110. Companies scoring at least 88 can receive conditional status if open items are closed within 180 days.
The guide was developed by IAM Technology & Communications Chair Erin O’Connor of DICE Forwarding, with review by John Bedford of Total Military Management.
IAM Member Impact: About 16 weeks remain before the March 1 deadline. TSPs, agents, and subcontractors that have not yet registered in SAM.gov should start now, because registrations can stall if company names and addresses don’t match IRS records exactly. Members should begin their self-assessments at the same time rather than waiting for system access and should confirm deadlines against the latest DPMO advisory. IAM’s CUI System Security Plan template is available on the CMMC Resource Center.
Source: IAM CMMC Resource Center