Updated September 29, 2026
Yes, when the companies work on the same computers and accounts, under the same rules, run by the same IT people. A CMMC assessment (the Defense Department's cybersecurity check for contractors) covers a set of systems, not a legal company. If two of your companies share those systems, one assessment covers both. A company that runs its own systems needs its own assessment, whoever owns it.
A CAGE code is the five-character ID the Defense Logistics Agency assigns to each business location when it registers in SAM.gov, the federal contractor registration site (DLA). A family of companies usually has several, and your posted assessment score is tied to them.
Getting this right is worth real money. DoD estimates a small company's Level 2 self-assessment at $34,277 and a third-party certification assessment at $101,752, per assessment (final rule, 89 FR 83092). Grouping correctly can halve that. Grouping wrong is worse than paying twice, as the third row below shows.
| Company | CAGE | Where the work happens | Decision |
|---|---|---|---|
| Precision Parts LLC | 1ABC2 | Engineering environment E-04 | Covered by the E-04 assessment |
| Precision Coatings LLC | 3DEF4 | E-04, same admins and laptops | Covered, once its people and building are added to E-04 |
| Acquired machine shop | 5GHI6 | Its own Microsoft 365 account, its own IT guy | Separate assessment |
The third row is where parent companies get into trouble. Shared ownership doesn't mean shared systems, and the E-04 score says nothing about systems E-04's admins have never logged into. Listing that CAGE on the E-04 result tells the government its systems were assessed. If they weren't, that's a False Claims Act problem: the government can recover three times its damages plus a penalty for each claim (31 U.S.C. 3729). Leave it off.
The one-file test
To decide whether two companies really share one environment, follow a file from each company's contract through the systems to the people allowed to see it. Both files should pass through the same sign-in system (Microsoft Entra or Google, usually), the same admins, the same security software on the laptops, and the same written policies. If Coatings has its own admins or keeps drawings on its own server, either bring those into E-04 before the assessment or plan a second one.
One security plan per environment
Write one SSP (system security plan: the document that describes how you protect controlled information) for each assessed environment, not one per CAGE. The requirement behind it, 3.12.4, asks the SSP to describe the system's boundary, how it operates, and what it connects to (NIST SP 800-171 Rev. 2). If E-04 covers two companies, its SSP names both, says which people and buildings belong to each, and says who owns the policies and the evidence. Use the same system name everywhere, word for word: the SSP, the assessment, and the score you post (why they must match).
Count employees once, across the covered environment. Adding up accounts across three companies double-counts everyone who has two logins.
On submission day
The score goes into SPRS (the DoD's Supplier Performance Risk System, where contractors post their results and primes look them up). Whoever enters it signs in through PIEE, DoD's procurement login portal, and needs the SPRS Cyber Vendor User role there.
On the Additional Assessment Details screen, SPRS asks for the scope, the employee count, and the included CAGEs. You add CAGEs through Open CAGE Hierarchy, which SPRS pulls from SAM, and you can't add one that isn't in your company's hierarchy (SPRS CMMC L2 Self quick entry guide).
So a missing CAGE gets fixed in SAM, not in SPRS. Pull your registrations in SAM.gov this week and check which companies are listed as parent and child. Finding out on submission day that Coatings isn't under Parts is a bad way to spend a Friday.
For a company that ran several sites on shared IT, see multi-site shared IT. For the rest of the entry, see how the SPRS entry works.