What Is a CMMC UID, and Who Do I Give It to at Level 1?

Short Answer

A CMMC UID is the 10 character alphanumeric identifier SPRS assigns to each CMMC assessment, reflected for each contractor information system. It is not your CAGE code. You receive it in SPRS after you enter your Level 1 self-assessment results. On a DoD contract with the CMMC clauses, you list your UIDs in your proposal and give them, and any later changes, to the Contracting Officer, who checks your status in SPRS. The subcontract version of the clause leaves that reporting step out.

Why the Confusion Exists

A Level 1 entry in SPRS carries more than one identifier. It lists the CAGE codes associated with the systems in scope, and suppliers already use CAGE codes. The CMMC UID is a separate identifier that came with the DFARS CMMC clauses effective November 10, 2025, so the two are easy to confuse.

The clauses also route the UID differently by tier. The prime contract clause has a step for reporting UIDs to the Contracting Officer, and the subcontract version drops that step. That leaves subcontractors unsure who should receive theirs.

What the Current Authority Says

DFARS 252.204-7021(a) defines the CMMC UID as 10 alpha-numeric characters assigned to each CMMC assessment and reflected in SPRS for each contractor information system.

DFARS 252.204-7025(d) states that the UIDs are provided in SPRS after the offeror enters the results of its self-assessments for each information system. It requires the offeror to provide, in the proposal, the UIDs for each contractor information system that will process, store, or transmit FCI or CUI during performance, and to update the list when new UIDs are generated.

DFARS 252.204-7021(e)(1) requires the contractor to submit to the Contracting Officer the UIDs issued by SPRS for those systems, and any changes to them during the life of the contract. Under DFARS 204.7503(b), the Contracting Officer checks SPRS and does not award to an offeror that lacks a current CMMC status at the required level for each UID it provided.

The CAGE code is a different item. 32 CFR 170.15(a)(1)(i)(D) requires the Level 1 SPRS entry to include all industry CAGE codes associated with the information systems in the assessment scope. The DoW CIO CMMC FAQs (C-A5) say a separate CAGE code for each location is not required, that an existing CAGE code within the company's hierarchy may be used to submit the assessment identified by the UID, and that company systems not represented by the UIDs provided for a solicitation cannot be used to process, store, or transmit FCI or CUI during performance.

For subcontracts, DFARS 252.204-7021(f)(1) has the prime flow down the substance of the clause, excluding paragraph (e)(1), the step of submitting UIDs to the Contracting Officer. Under (f)(2), the prime must ensure before award that the subcontractor has a current CMMC status at the level appropriate for the information flowed down.

What This Means

Enter your Level 1 self-assessment in SPRS first. The UID comes from SPRS after that.

If you are bidding directly on a DoD solicitation that carries the CMMC provision, list in your proposal each UID for the information systems that will process, store, or transmit FCI, and tell the Contracting Officer when a UID changes.

If you are a subcontractor, the clause you receive does not send your UID to the Contracting Officer. Your prime still has to confirm your status before award, and how you show it is between you and the prime. The DoW CIO CMMC FAQs (C-A4) note that suppliers may print verification of their status from SPRS to share with their primes.

Which systems a UID covers follows from the scope you set for the self-assessment. That scope is your decision.