DoD CMRS: Continuous Monitoring, ATO, and Contractor CMMC/SPRS

DoD CMRS stands for Continuous Monitoring and Risk Scoring, an internal Department of Defense software suite that pulls cybersecurity data from across DoD networks and turns it into a near-real-time view of security posture.¹ It is a government tool used by government cybersecurity teams. Defense contractors do not log into it. If you arrived here looking for the system where your company reports its cybersecurity compliance, you want CMMC and SPRS, which are covered further down.

What CMRS Is and What It Does

CMRS is a visualization and analytics engine. It consolidates feeds from the many cybersecurity tools already deployed across DoD networks and presents hardware and software inventories, patching compliance, configuration status, and vulnerability-based risk scores through a single set of dashboards.¹ Instead of logging into six scanners to answer one question, an analyst runs bulk analytics against the combined dataset in one place.

The system uses NIST and DoD data standards to normalize information coming from different sensors, so comparisons across commands and organizations are apples-to-apples. Scoring algorithms then weight findings by threat and vulnerability, which lets security teams prioritize remediation on the weaknesses that create real operational risk rather than chasing every low-severity finding.

What Data Feeds Into CMRS

CMRS does not generate its own scans. It ingests automated data from tools already in place, including the Assured Compliance Assessment Solution (ACAS) for vulnerability scanning, Trellix for endpoint protection, Microsoft Defender for Endpoint together with Microsoft Configuration Manager and Intune, Tanium, Tychon, and Comply-to-Connect. Active Directory data feeds in too, so assets can be mapped to owning organizations and user accounts.¹

The value comes from the layering. A vulnerability scan on its own describes weaknesses. CMRS combines scan results with asset inventories, patching records, and endpoint security status to produce a composite picture no single tool provides.

Who Uses CMRS (and Who Doesn’t)

CMRS is for military cybersecurity teams, component CIOs, Cybersecurity Service Providers, and senior leaders who need enterprise-wide visibility. It organizes data by DODIN Area of Operations, owning organization or unit, administration unit, Cybersecurity Service Provider, Combatant Command area of responsibility, and geolocation, which lets a Combatant Command see every network segment under its responsibility while a component CIO drills down to a single program.¹

Contractors do not access CMRS. Their cybersecurity obligations run through a separate framework. The one indirect connection: contractor-managed systems that operate on or connect to DoD networks show up in the CMRS view, so the government has a way to spot systems that fall behind on patching or configuration standards.

CMRS and the Authorization to Operate Process

CMRS supports the continuous monitoring step of the DoD Risk Management Framework, governed by DoD Instruction 8510.01.² Every DoD information system must receive an Authorization to Operate before it goes live, and that authorization depends on ongoing evidence that security controls remain effective. CMRS provides that evidence at scale by continuously tracking whether systems stay within their approved baselines.

The DoD CIO has identified CMRS as part of the evaluation criteria for continuous Authorization to Operate (cATO), the newer approach that replaces the traditional three-year reauthorization with ongoing, real-time compliance monitoring.³ For programs pursuing cATO, showing continuous compliance through CMRS dashboards is a practical requirement.

If You’re a Contractor, You’re Looking for CMMC and SPRS

The most common reason people search for “DoD CMRS” is a mix-up with the Cybersecurity Maturity Model Certification program. These are different systems, aimed at different audiences. CMRS watches government networks. CMMC certifies contractors, and the results live in the Supplier Performance Risk System (SPRS).⁴

What CMMC Covers

CMMC assesses whether contractors adequately protect two categories of sensitive information: Federal Contract Information (FCI), which is government-related information not intended for public release, and Controlled Unclassified Information (CUI), which carries stricter handling requirements set by law, regulation, or government-wide policy. The type of information in the contract determines the required CMMC level.⁴

There are three levels. Level 1 is an annual self-assessment against 15 basic requirements from FAR clause 52.204-21 and applies to contractors handling FCI only. Level 2 covers the 110 requirements of NIST SP 800-171 Revision 2 and is either self-assessed or audited by a certified third-party assessment organization (C3PAO) every three years, depending on contract sensitivity. Level 3 adds 24 requirements from NIST SP 800-172 on top of Level 2 and is assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC); you must already hold a Final Level 2 (C3PAO) status to pursue it.⁴

Every level requires an annual affirmation of continued compliance, submitted through SPRS. Miss the affirmation and your CMMC status lapses regardless of how the last assessment went.⁴

Where the Score Gets Posted

For Level 2 and above, your posture is reduced to a single number on a scale that starts at 110 for full implementation of NIST SP 800-171 and drops as gaps are counted, with heavier deductions for controls whose absence could allow significant exploitation or exfiltration of CUI.⁵

That score goes into SPRS, the authoritative repository the acquisition community checks before making award decisions. To submit, you need to register in the Procurement Integrated Enterprise Environment (PIEE) and obtain a “SPRS Cyber Vendor User” role.⁶ Your entry includes your CAGE code, the System Security Plan name and date, the summary score, the assessment date, and an expected date for reaching 110 if you are not yet fully compliant. The score must be no more than three years old at the time of contract award.⁷

C3PAO and DIBCAC assessment results are uploaded into a tailored CMMC version of the DoD’s Enterprise Mission Assurance Support Service (CMMC eMASS), and a limited subset flows to SPRS through an automated API.⁸

The 180-Day POA&M Window

If your assessment turns up requirements you have not fully implemented, you can document those gaps in a Plan of Action and Milestones and receive a conditional CMMC status. You then have 180 days from that conditional status to close out every POA&M item through a closeout assessment by the same type of assessor who did the original. Miss the window and the conditional status expires; you lose your CMMC status and start over.⁹ Contractors regularly underestimate how long remediation takes. Budget conservatively.

When Each Level Starts Appearing in Contracts

CMMC is phasing into contracts rather than switching on all at once. The current phase, running from November 10, 2025 through November 9, 2026, focuses on Level 1 and Level 2 self-assessments. Level 2 certification (C3PAO) requirements begin appearing in solicitations on November 10, 2026, and Level 3 certification requirements follow on November 10, 2027, with full implementation across applicable solicitations from that same date.⁴ If your contracts involve CUI and will need Level 2 certification, scheduling a C3PAO assessment can take months given limited assessor capacity.

The 72-Hour Cyber Incident Report

Separate from the assessment cycle, DFARS 252.204-7012 requires contractors to report cyber incidents to the DoD within 72 hours of discovery whenever an incident affects a covered contractor information system, the CUI on it, or the contractor’s ability to perform operationally critical functions.¹⁰ Reports go through the DIBNet portal and require a DoD-approved medium assurance certificate. Get the certificate before you need it. Obtaining one during an active breach wastes hours you cannot spare.

What Non-Compliance Costs

Without a current NIST SP 800-171 assessment score in SPRS, you are ineligible for contract award. DFARS 252.204-7019 makes a current score a precondition of being considered, no matter how strong the rest of your proposal is.⁷ Missing an annual affirmation lapses your CMMC status, and a lapsed status means you no longer meet the certification requirement in existing contracts that include the CMMC clause, which can trigger default.⁴ Failing to report an incident within 72 hours exposes you to breach-of-contract claims under DFARS 252.204-7012, and repeated or willful non-compliance can end in suspension or debarment from federal contracting.¹⁰

1
SAM.gov. Continuous Monitoring and Risk Scoring (CMRS)
2
Department of Defense. DoD Instruction 8510.01 – Risk Management Framework for DoD Systems
3
Department of Defense Chief Information Officer. Continuous Authorization to Operate (cATO) Evaluation Criteria
4
Department of Defense Chief Information Officer. About CMMC
5
U.S. Department of Defense. NIST SP 800-171 DoD Assessment Methodology
6
Supplier Performance Risk System. NIST SP 800-171 – Supplier Performance Risk System (SPRS)
7
eCFR. 48 CFR 252.204-7019 – Notice of NIST SP 800-171 DoD Assessment
8
Department of Defense Chief Information Officer. Introduction to the CMMC Enterprise Mission Assurance Support Service
9
eCFR. 32 CFR 170.21 – Plan of Action and Milestones Requirements
10
Department of Defense. DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting