The Annual CMMC Affirmation: What Your Affirming Official Is Actually Signing
Every CMMC Level 1 and Level 2 contractor affirms compliance in SPRS every year. Who the Affirming Official is, what the affirmation says, when it's due, and what should stand behind the signature.
Every organization with a CMMC requirement, Level 1 or Level 2, self-assessed or certified, has to affirm its compliance in SPRS, and then do it again every year. The affirmation is one short statement from one senior person. It's also the part of CMMC that turns your security program into a representation to the government, so the person signing it should know exactly what it says and what has to be true behind it.
- Who signs: the Affirming Official, a senior person from inside your organization with responsibility for CMMC compliance and the authority to affirm it.
- What they sign: that you've implemented, and will maintain, all applicable CMMC requirements for every system in your assessment scope.
- When: after every assessment (including a POA&M closeout) and annually after that, entered in SPRS.
- Still required during the Phase 2 pause. The pause affected C3PAO certification, not affirmations.
Who is the Affirming Official?
The CMMC rule defines the Affirming Official as "the senior level representative from within each Organization Seeking Assessment" who is responsible for the organization's compliance with CMMC and has the authority to affirm it (32 CFR § 170.4).
Three parts of that definition matter in practice:
- Senior level. This is an executive decision, not an IT task. In a small company it's usually the owner, president, or CEO.
- From within. Your MSP, your consultant, and your assessor can't be your Affirming Official. They can help you get it right; they can't sign for you.
- Each organization. Primes and subcontractors each affirm for themselves. A prime's affirmation doesn't cover its suppliers.
What exactly are they signing?
Under 32 CFR § 170.22, each affirmation contains two things: the Affirming Official's name, title, and contact information, and a one-sentence statement about the organization's security. Here's that sentence, with the four phrases that carry the weight:
The organization “has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope.”
- 1ImplementedIn place today for your current status. A Conditional status covers open POA&M items until closeout.
- 2Will maintainIt looks forward. Controls have to keep working until the next affirmation.
- 3AllNo partial credit. At Level 1, all 15 requirements must be met, and POA&Ms aren’t allowed.
- 4ScopeEvery system that handles your FCI or CUI, including ones added since your last assessment.
The affirmation isn't a recap of last year's assessment. It's a statement about today, and a promise about the year ahead.
When is an affirmation due?
Every affirmation is entered in the Supplier Performance Risk System (SPRS), and the rule lists exactly when one is due (32 CFR § 170.22(a)(3)):
- On reaching a Conditional status. Level 2 only, when an assessment ends with open POA&M items. Level 1 can't be Conditional.
- On reaching a Final status, at Level 1 or Level 2, by self-assessment or C3PAO.
- Annually after the Final status date, at every level. Level 1 repeats its self-assessment each year; Level 2 reassesses every three years.
- After a POA&M closeout assessment, which must happen within 180 days of the Conditional status date.
Over one full three-year cycle, that looks like this:
THE AFFIRMATION CALENDAR · ONE THREE-YEAR CYCLETwo details catch organizations out:
- A Conditional status needs its own affirmation, and then another one. If a Level 2 assessment ends with open POA&M items, you affirm when you reach Conditional status and again once the closeout assessment confirms they're fixed. Closeout has to happen within 180 days of the Conditional status date, or the Conditional status expires (32 CFR § 170.21).
- Primes have to check their suppliers. The CMMC contract clause, DFARS 252.204-7021, requires the contractor to make sure subcontractors that handle FCI or CUI complete an affirmation before subcontract award and keep it current every year.
The same clause also asks the contractor to "maintain as current" its own affirmation for each CMMC UID used on the contract, for the life of the contract. A lapsed affirmation isn't a paperwork gap. It's a contract requirement you're no longer meeting.
How do you submit it in SPRS?
Affirmations are entered in SPRS through the DoD's PIEE portal, usually by two people: someone who enters the assessment, and the Affirming Official who affirms it. The steps below follow the official SPRS CMMC Quick Entry Guides for Level 1 and Level 2 self-assessments.
AFFIRMING IN SPRS · WHO DOES WHATYOUR SPRS USERAFFIRMING OFFICIAL- SPRS USER01Get accessA PIEE account with the SPRS Cyber Vendor User role
- SPRS USER02Enter itCyber Reports → CMMC Assessments → add the assessment
- SPRS USER03Hand it off“Continue to Affirmation,” or “Transfer to AO” by email
- AFFIRMING OFFICIAL04AffirmReview the details and the statement, then select “Affirm”
What if you miss the date, or can't affirm?
Don't let it lapse. SPRS enforces the clock: a Final Level 1 self-assessment automatically becomes "No CMMC Status (Expired Assessment)" one year after its assessment date, and a Conditional Level 2 self-assessment is valid for only 180 days. A Final Level 2 status stays valid for three years only with its annual affirmations. Set a reminder well ahead of the anniversary of your CMMC Status Date.
If something has broken since the last assessment, fix it before you affirm. You can't affirm around a gap: at Level 1 there's no POA&M option, and at Level 2 a requirement that isn't allowed on a POA&M leaves you with no CMMC status, whatever the score. An honest delay is a contract conversation. A false affirmation is a statement to the government.
Why the signature matters
The Department checks SPRS to confirm the affirmations a contract requires have been submitted. But the bigger reason to take the signature seriously is that an affirmation is a representation to the government.
When an organization's security doesn't match what it has told the government, that's exposure under the False Claims Act, whether or not there's ever a breach. On September 1, 2026, Honeywell Aerospace agreed to pay more than $2 million to resolve allegations that a business unit didn't meet NIST SP 800-171 on one network covered by a DoD contract. No breach was alleged, and the case started with a whistleblower.
The CMMC Phase 2 suspension paused the C3PAO certification requirement for new contracts. Level 1 and Level 2 self-assessments and annual affirmations still apply, and with fewer third-party checks happening, the affirmation carries more weight, not less.
What should stand behind the signature?
An Affirming Official doesn't need to be a security expert. They do need to be able to answer a few questions with evidence, not memory, before they sign.
- Is the scope still right? New laptops, a new cloud service, a new office, or a new contract can all bring systems into scope since the last assessment.
- What changed this year? Staff turnover, a new MSP, a merger, or a reconfigured network can quietly break controls that passed before.
- Is the evidence current? Policies, your system security plan, access reviews, logs, and scan results should reflect how things work today. Keep the artifacts behind each assessment for six years from its CMMC status date.
- Are POA&M items closed? At Level 2, open items must be closed and confirmed within 180 days. At Level 1, there can't be any.
- Does the signer understand the statement? A short briefing on scope, results, and anything still in progress is the difference between affirming and guessing.
Make it a cycle, not a scramble
The organizations that affirm with confidence don't rebuild their evidence once a year. They check it as they go: a quarterly look at changes and evidence, an impact review whenever something significant changes, and a full review ahead of the annual date. By the time the Affirming Official signs, the answer is already on file.
For Level 1, the annual affirmation follows the annual self-assessment against the 15 requirements. Our CMMC Level 1 guide walks through all 15 and the yearly cycle.
Before your next affirmation date
If the date is coming up and nobody has looked at the evidence since the last assessment, start there. A CMMC Certified Assessor can walk your controls the way the official assessment would and tell your Affirming Official plainly what's ready to sign and what isn't. Continuous Compliance keeps that review running all year, so the answer is on file before the date arrives.