Subcontractor CMMC Tracker
Findings · finding 11 of 12

Same CAGE code and CMMC UID on two lines, different answers

A CMMC status belongs to a contractor information system with its own CMMC UID (252.204-7021), so one subcontractor can rightly have several lines. This fires only where the same CAGE code or UEI carries the same CMMC UID, or no UID on either line, with different answers; the register cannot tell which is current.

What the register reads

a question

A question for the subcontracts lead: which line is current for this system, and is the other an old entry or a second system without its UID?

The rule sentences behind it

2 cited
DFARS 252.204-7021, "CMMC UID" and (d)(4)codified text, eCFR current to 24 Sep 2026; the same text is carried in Class Deviation 2026-O0025, effective 1 Feb 2026

Cybersecurity Maturity Model Certification unique identifier (CMMC UID) means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

Threshold read: a CMMC status belongs to each contractor information system, with its own CMMC UID; the affirmation is per system. Source
32 CFR 170.16(a)(1)(i)(D)codified text, eCFR current to 24 Sep 2026

All industry CAGE code(s) associated with the information system(s) addressed by the CMMC Assessment Scope.

Threshold read: SPRS results carry every CAGE code in scope. Source

A line that raises it

invented

Halvorsen Machine | 3HM90 | | | | 100 | 2025-01-15 | Level 2 (Self) | final | 2025-01-15 | 2026-01-15 | president | CUI

See it in the specimen