Skip to content
  • There are no suggestions because the search field is empty.

What is a CMMC UID (Unique Identifier)?

What is a CMMC UID?

A CMMC Unique Identifier (UID) is a 10-character alphanumeric code that SPRS generates for each CMMC assessment reflected in the Supplier Performance Risk System. Each UID is tied to one contractor information system — the boundary you assessed against CMMC requirements.

Think of the UID as the license plate for a specific assessed environment. The DoD uses it to verify, at contract award and throughout performance, that the system you'll use to handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) meets the required CMMC level.

 

When do I need a UID?

You need a CMMC UID for every information system that will process, store, or transmit FCI or CUI in performance of a DoD contract. Contractors are required to submit a CMMC UID in SPRS for each information system that processes, stores, or transmits FCI or CUI — so if you operate multiple enclaves (for example, a CUI enclave plus a separate FCI-only environment), each one needs its own assessment and its own UID.

 

Where do I find my UID?

Your UID lives in SPRS, not in FutureFeed. To retrieve it:

  1. Sign in to the Procurement Integrated Enterprise Environment at Procurement Integrated Enterprise Environment (PIEE).
  2. Open the SPRS application.
  3. Navigate to the CMMC Assessments module.
  4. Locate your assessment record. The UID is displayed in the assessment detail.
  5. Copy the UID exactly as shown and paste it into the corresponding field in FutureFeed.

If you don't yet have a UID, it's because no assessment has been posted to SPRS for that system. A UID is generated when an assessment — self-assessment, C3PAO certification, or DIBCAC assessment — is submitted.

 

How is the UID used after I have it?

  • At proposal time: You provide the applicable UID(s) to your contracting officer for each information system you'll use on the contract.
  • At award: Contracting officers check SPRS and will not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status posted in SPRS at the required level for each CMMC UID provided. OUSD Acquisition & Sustainment
  • Throughout the contract: Your affirming official must complete an annual affirmation of continuous compliance in SPRS for each CMMC UID. Holland & Knight
  • When things change: Contractors must submit changes to their CMMC UIDs in SPRS throughout the life of the contract — if your boundary, scope, or status changes, SPRS must reflect it. White & Case LLP

 

UID prefix — does it matter?

Yes. The first characters of the UID indicate the assessment regime the UID was generated under. CMMC 2.0 assessments and legacy NIST SP 800-171 self-assessments produce UIDs with different prefixes, and a legacy 800-171 UID does not satisfy CMMC compliance requirements. Primes and contracting officers increasingly inspect the prefix to confirm the UID reflects a true CMMC assessment.

If you're not sure which type of UID you have, contact FutureFeed Support and we'll help you verify.

 

How FutureFeed uses your UID

When you link your SPRS UID to a FutureFeed scope, the platform anchors your compliance evidence, RACI assignments, POA&M items, and affirmation history to that specific assessed system. This gives your affirming official a defensible, audit-ready trail when it's time to affirm continuous compliance in SPRS each year.

Still stuck? Email support@futurefeed.co

FutureFeed Footer – Newest