What Is the CMMC Portal and Where Do I Find It?
Short answer first: There is no single "CMMC portal." The term gets used casually, but compliance actions happen in specific DoW systems depending on what you need to do.
If you're a small manufacturer or supplier trying to submit your CMMC self-assessment right now (Level 1 or Level 2 in Phase 1), you use the Supplier Performance Risk System (SPRS). That's where most people mean when they say "the portal."
Where to Go for the Main Stuff
To submit self-assessments, scores, and affirmations (what most small suppliers need now): SPRS at https://www.sprs.csd.disa.mil/ Access it through the Procurement Integrated Enterprise Environment (PIEE) at https://piee.eb.mil/. Log in with your PIEE account (get one if you don't have it), request the "SPRS Cyber Vendor User" role if needed, then go to Cyber Reports to enter/edit/affirm your CMMC Level 1 or Level 2 self-assessment. Affirm annually or it lapses. This has been required for new contracts since Nov 10, 2025.
For official program info, FAQs, resources, and timelines: DoW CIO CMMC page at https://dodcio.defense.gov/CMMC/. This is the authoritative source from the Department of Defense.
To find C3PAOs (for future Level 2 third-party certs starting Nov 2026), training providers, or assessors: The Cyber AB Marketplace at https://cyberab.org/. This is the accreditation body's site, not for submitting your own assessment data.
Quick Reality Check for January 2026
Phase 1 runs through Nov 9, 2026: Focus on self-assessments in SPRS for Level 1 (15 controls) and Level 2 (110 NIST SP 800-171 controls). No third-party "portal" needed yet for most. Phase 2 brings C3PAO certifications for prioritized CUI contracts, but affirmations still go through SPRS.
Many small shops get stuck because they hunt for a mythical unified portal instead of going straight to SPRS via PIEE. If your contract has CMMC clauses, check SPRS first for submission.
The gap: SPRS requires a DoW-issued login (via PIEE), and setup can take days if you're new. Don't wait until a solicitation deadline.